# How to Report a Hacked Account in Malaysia > Hacked account in Malaysia? Which report goes where: the platform first, your bank and NSRC 997 if money moved, a police report at a station, and Cyber999. - URL: https://www.awarexone.com/research/report-hacked-account-malaysia - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-09-29 - Topics: Account security, Account recovery, Malaysia - Related service: Account security: https://www.awarexone.com/services/account-security ## Short answer Report it first through the platform's own hacked account page, because only the platform can return the account. If money moved, call your bank's hotline or the National Scam Response Centre before anything else. Then make a police report in person at a station, and report the incident to Cyber999. The platform still decides whether the account returns. ## Summary - Report the hack to the platform first through its own hacked account page, because only the platform can give the account back. - If money left your bank account or you were tricked into a transfer, call your bank's hotline or NSRC on 997 before anything else. - Make a police report at a police station, not online. PDRM's e-Reporting system is only for lost items and matters that do not involve a crime. - Report the incident to CyberSecurity Malaysia's Cyber999, which handles computer security incidents and can help escalate abuse reports. - No agency, bank or honest helper will ask for your password, PIN, TAC or OTP, so treat anyone who does as a scammer. - A report creates a record and can stop money moving, but the platform still decides whether the account comes back. Someone took over your Facebook, Instagram or Gmail. They may be messaging your friends for money, or your bank app may already show a transfer you did not make. You want to report it, and every site points somewhere else: the police, 997, Cyber999, MCMC. Each one handles a different part of the problem. The platform is the only one that can return the account. Your bank and the National Scam Response Centre (NSRC) on 997 handle money that has left your account. A police report records the crime. Cyber999 takes the computer security incident itself. This guide sorts out which report to make, in which order, what each one needs from you, and what none of them can do. Last checked: 29 September 2026. ## Where Do You Report a Hacked Account in Malaysia? Start with the platform's own hacked account page, such as facebook.com/hacked or instagram.com/hacked, because only the platform can restore access. If money left your bank account, or you were tricked into transferring money, call your bank's hotline or NSRC on 997 straight away, then make a police report at the nearest police station. Hacking is an offence under the Computer Crimes Act 1997 and PDRM enforces it, but the online e-Reporting system does not take crime reports, so go in person. Then report the incident to CyberSecurity Malaysia's Cyber999. MCMC is the route for harmful content and telco complaints, not for getting an account back. ## Which Agency Handles What? One takeover can touch five organisations at once. Here is what each one does, from its own pages. *Malaysian reporting routes for a hacked account, from each organisation's own pages at the time of writing.* | Where | What it handles | When to use it | What it cannot do | | --- | --- | --- | --- | | The platform (Meta, Google, TikTok and others) | Account recovery, removing the attacker, reversing changed details | Always, and first if no money is involved | It does not investigate the crime or recover lost money | | Your bank's hotline or NSRC 997 | Online financial fraud: money moved from your bank account without your knowledge, or a transfer you were tricked into | Immediately, if any money has moved | It does not recover social media accounts, and it is not a line for following up a case | | Police station (PDRM) | Crimes, including hacking under the Computer Crimes Act 1997 and cheating by personation | When money was lost, when someone is using your identity, or when you need an official record | A police report does not unlock the account on the platform | | Cyber999 (CyberSecurity Malaysia) | Computer security incidents, technical analysis, escalating abuse reports | For any hack, phishing link or stolen password, alongside the other reports | It is not a police report and does not replace one | | MCMC and the industry forums | Complaints about telco services and harmful online content | If your carrier mishandled a SIM replacement, or the attacker posted offensive or false content | MCMC lists hacking as a matter for PDRM, not for itself | ## Step One: Report It to the Platform The platform report is the only one that can get you back in, so do it first unless money is moving right now. - Facebook: Meta's page on [recovering a hacked Facebook account](https://www.facebook.com/help/203305893040179) says to visit facebook.com/hacked, ideally on a device you have used to log in before. It also says that when your email is changed, Facebook sends a message to the old address with a link to reverse the change. - Instagram: Instagram's page on [a hacked profile](https://help.instagram.com/149494825257596) says an email from security@mail.instagram.com about a changed email address may let you undo it with "secure my account". If that fails, it describes requesting a login link through "Forgot password?", and a video selfie check for accounts with photos of you. - Google and Gmail: Google's page on [securing a hacked account](https://support.google.com/accounts/answer/6294825?hl=en) sends you to the account recovery page if you cannot sign in, and asks you to review security events, devices, and Gmail forwarding rules and filters you did not set. Secure the email account behind your social accounts before anything else. Whoever controls that inbox can reset the password again after you report. For a step-by-step version for Instagram, see [what to do in the first hour after an Instagram hack](https://www.awarexone.com/research/instagram-hacked-first-hour). ## If Money Was Lost: Your Bank and NSRC 997 Come First If money has left your account, speed matters more than paperwork. The National Anti-Financial Crime Centre's [NSRC page](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) says NSRC focuses on online financial fraud: money transferred out of your bank account without your knowledge, or money you were tricked into transferring through an online financial service. It names phishing and malware among the methods, which is how many account takeovers end. The same page says to contact your bank's 24-hour hotline or call 997 as soon as you discover the fraud, and that if you cannot get through to 997, you can go straight to your bank's hotline. The number is on the back of your bank card or on the bank's website. NSRC can try to block the stolen funds, but the page is clear that there is no guarantee you will get the money back. NFCC also says 997 is an emergency response number, not a line for following up a case; follow-ups go to the investigating officer on your police report. If your own bank account has been blocked, contact your bank instead. If friends sent money to the attacker because your account asked them to, they are the fraud victims, and they should call their own bank or 997. Our guide on [what to do when a hacked account messages your friends](https://www.awarexone.com/research/hacked-account-messaging-friends) covers what to tell them. ## Making a Police Report About a Hacked Account Go to a police station. PDRM's online [e-Reporting system](https://ereporting.rmp.gov.my/index.aspx?lang=english) says it is for lost documents or items that do not relate to crime. Before you can file, it asks you to tick "I hereby confirm the police report that I am lodging does not involve any crime matter." For anything with a criminal element, it shows: "This case involves criminal element. You are advised to lodge a police report at the nearest police station." Hacking is a crime. MCMC's [complaints page](https://www.mcmc.gov.my/en/make-a-complaint/make-a-complaint) lists hacking under the Computer Crimes Act 1997 and cheating by personation under the Penal Code, both enforced by the Royal Malaysia Police. If someone is in danger or the situation is still unfolding, the e-Reporting page says to dial 999. If money was involved, NFCC says you need to make the police report at the nearest station within 24 hours of contacting your bank or 997, and that without a police report the police cannot follow up. With no money lost, a report is still worth making when someone is using your identity, when the attacker threatens you, or when you need an official record. A police report does not make the platform restore your account. None of the Meta or Google hacked account pages we checked asks for one. Report to the platform in parallel, not after. If you are weighing a civil claim as well as a criminal report, our explainer on [whether hacking is a crime in Malaysia](https://www.awarexone.com/research/hacking-crime-malaysia-victims) sets out the difference. ## Evidence Checklist: What to Bring to Each Report NFCC's page lists what a fraud report needs: a short chronology, your details, the suspect's details, transaction details and receipts, any website address the scammer shared, and your communication with them. For a hack, we suggest gathering the following before you go, whether or not money was lost: - A written timeline: when you first noticed, what changed, and when you lost access. - Screenshots of every email or alert from the platform about a new login, a changed email or phone number, or a changed password, with the date visible. - The account's username, profile URL, and the email and phone number it used before the attacker changed them. - Any phishing link, fake login page or message that started it, including who sent it and when. Do not open the link again to screenshot it. - Screenshots of messages the attacker sent from your account, and from friends who received them. - Bank or e-wallet transaction references, amounts and times, if money moved. - The platform's case or ticket email, if it sent one. - Your MyKad, for the police report. > Warning: **Nobody who handles a report needs your codes.** NFCC says NSRC, PDRM, MCMC, Bank Negara Malaysia and the banks will only contact you after you have made a report, and will never ask for your username, password, PIN, TAC or OTP. The same goes for the platform and for any honest recovery service. A caller claiming to be a police officer or bank officer who asks for a code is running a scam. ## Reporting to Cyber999 CyberSecurity Malaysia describes [Cyber999](https://www.cybersecurity.my/portal-main/services/cyber999-overview) as the national point of contact for reporting computer security incidents. It provides technical analysis and helps Malaysian internet users escalate abuse reports to the relevant parties. It is not a police service and does not replace a police report. MyCERT's [reporting channel page](https://www.mycert.org.my/portal/full?id=9eb77829-7dd4-4180-814f-de3a539b7a01) lists four ways to report: the online form, email to cyber999@cybersecurity.my, the Cyber999 mobile app, and the 1-300-88-2999 line during office hours. It says calls are monitored during business hours, 8.30am to 5.30pm. For email reports, it asks for the source and time of the attack, email headers and log files where you have them. The [Cyber999 online form](https://mycert.org.my/portal/online-form?id=7a911418-9e84-4e48-84d3-aa8a4fe55f16) asks for your name, age group, email and phone, how many days ago the incident started, the suspected incident type, and a short description. For a stolen social media password, the closest types on the form are: - Fraud, which the form describes with examples including identity theft and stolen passwords. - Phishing, if a fake login page or message tricked you into typing your details. - Intrusion Attempt, if someone tried to get in and you stopped them. ## Where MCMC Fits, and Where It Does Not Many people search for "MCMC aduan" first. MCMC's complaints page covers communications services and online content, and its own table lists hacking as a matter for PDRM. MCMC is not the place to get an account back. MCMC is useful in two situations. If your carrier moved your number to another SIM without proper checks, the page says to complain to your service provider first, then to the Communications and Multimedia Consumer Forum, and then to MCMC through the complaints portal at aduan.mcmc.gov.my. It lists the MCMC Consumer Care Centre on 1800-188-030, 8.30am to 5.30pm, Monday to Friday. And if the attacker posted obscene, menacing, false or offensive content from your account, that falls under the online content problems MCMC lists. ## Mistakes That Make Reporting Harder - Waiting to report to the platform until you have a police report. The platform does not need one, and the delay gives the attacker time to change more details. - Trying to file a hacking report through e-Reporting. It is for non-crime matters, and the system tells you to go to a station. - Calling 997 to ask about a case you already reported. NFCC says follow-ups go to the investigating officer. - Deleting the attacker's messages or the platform's alert emails before you screenshot them. - Paying a "hacker for hire" or an "unban" seller who promises to get the account back. Breaking into an account is itself a crime, and these offers are a common scam. - Stating anything in a police report you are not sure of. The e-Reporting page warns that giving false information is an offence under section 182 of the Penal Code, and that applies at the counter too. Fake support pages often target people straight after a hack. Our breakdown of [the fake Meta support scam](https://www.awarexone.com/research/fake-meta-support-scam-malaysia) shows what they look like. > Note: **What reporting can and cannot do.** Reports to NSRC, PDRM and Cyber999 can freeze money, start an investigation and create an official record. None of them can restore a social media account. Only the platform decides that, and some hacked accounts do not come back, especially when the attacker changed the email, phone and password before you acted. ## When Expert Recovery Help Makes Sense You can make every report in this guide yourself, and most people should. A second pair of eyes helps when the platform's hacked account flow keeps failing, when a business or creator account is involved, or when a SIM swap, a stolen email and lost money are all tangled together. SocialSafe by AwareXone, our recovery service, reviews what has happened first and tells you honestly which official route is still open. We are a Malaysian team, so we know how the NSRC, PDRM and bank reports sit alongside the platform's process. Our [account security service](https://www.awarexone.com/services/account-security) explains how a review works, and our [Trust Center](https://www.awarexone.com/trust) lists what we will never ask you for, including your password and login codes. ## Frequently Asked Questions ### Can I make a police report for a hacked Facebook account online? No. PDRM's e-Reporting system is only for lost documents or items that do not involve a crime, and it tells you to go to the nearest police station for anything with a criminal element. Hacking is a crime under the Computer Crimes Act 1997, so report it in person. ### Should I call 997 if my Instagram was hacked but no money was lost? No. NFCC describes 997 as an emergency line for online financial fraud, such as money moved from your bank account. Report the hack to Instagram, then to Cyber999, and make a police report if someone is using your identity. ### Will a police report help me get my account back? Not directly. The platform runs its own recovery process, and the Meta and Google hacked account pages we checked do not ask for a police report. The report matters for money, identity misuse and an official record. ### Is Cyber999 the same as making a police report? No. Cyber999 is CyberSecurity Malaysia's incident response service. It analyses incidents and helps escalate abuse reports, but a police report is a separate step made at a police station. ### Can I report a hacked account to MCMC? MCMC's own complaints page lists hacking as a matter for PDRM. MCMC is the route for telco complaints, such as a mishandled SIM replacement, and for harmful content, after you have gone to the service provider first. ### How long do I have to make a police report after losing money? NFCC says to call your bank or 997 first, then make the police report at the nearest station within 24 hours. Without a police report, it says, the police cannot follow up. ## Official sources - [NFCC: National Scam Response Centre (NSRC) and FAQ (read 29 September 2026)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) - [PDRM: e-Reporting (read 29 September 2026)](https://ereporting.rmp.gov.my/index.aspx?lang=english) - [CyberSecurity Malaysia: Cyber999 Cyber Incident Response Center (read 29 September 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview) - [MyCERT: Reporting Channel (read 29 September 2026)](https://www.mycert.org.my/portal/full?id=9eb77829-7dd4-4180-814f-de3a539b7a01) - [MyCERT: Cyber999 Online Form (read 29 September 2026)](https://mycert.org.my/portal/online-form?id=7a911418-9e84-4e48-84d3-aa8a4fe55f16) - [MCMC: Make a complaint (read 29 September 2026)](https://www.mcmc.gov.my/en/make-a-complaint/make-a-complaint) - [Facebook Help Center: Recover your Facebook account if you were hacked (read 29 September 2026)](https://www.facebook.com/help/203305893040179) - [Instagram Help Center: If you think your Instagram profile has been hacked (read 29 September 2026)](https://help.instagram.com/149494825257596) - [Google Account Help: Secure a hacked or compromised Google Account (read 29 September 2026)](https://support.google.com/accounts/answer/6294825?hl=en) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.