Shopee Account Hacked, Unauthorised Order: What to Do

A bank alert says you paid Shopee. Or you open the app and see an order you never placed, sometimes to an address that is not yours. Your stomach drops. You want to know whether your account has been hacked, whether your money is safe and who to call first.

This guide follows Shopee Malaysia's own help pages and the Malaysian reporting routes those pages name. It gives you an order of steps, and it does not promise that money will come back or that any helper can undo a charge. One wrong step can cost you the account, so know what you are doing before you start.

Last checked: 26 October 2026.

#First, Is It Really an Unauthorised Order?

Shopee's help page, What to do if there is an unauthorised Shopee transaction on your credit card or bank account, starts with a check, not an alarm. It says to log in to your Shopee account and search for an order that matches the transaction in your Purchase History. Then it splits into two cases.

This check matters. A family member using a saved card, or a charge that belongs to another service, looks the same at first glance. Do the check before you assume the worst, but do not spend long on it if the order is clearly not yours.

#Steps If Someone Else Has Used Your Shopee Account

Follow the order below. It combines the transaction page with Shopee's page on locking access.

1. Change your Shopee account password and your ShopeePay PIN immediately. Use a password you have not used anywhere else.
2. Contact Shopee Customer Service. The lock page says Customer Service can block your Shopee account temporarily and that you may be asked to share the reason for the request.
3. Expect identity verification. The page says that after a successful identity verification by the Customer Service team, Shopee will temporarily block your account.
4. Call your mobile service provider and ask to block your SIM card. The page says this is to avoid any code request that could be used to reset your PIN.
5. Tell your bank or card provider straight away, as the transaction page says, and ask whether the payment can be cancelled.

Shopee's lock page also says that without your ShopeePay PIN no one will be able to purchase or withdraw your ShopeePay balance, which is why the PIN comes with the password in step 1. It says you will need to contact Customer Service again to reactivate the account, so keep a note of when and how you made the request.

The ShopeePay app page, ShopeePay App - Account Management, adds that Shopee sends an in-app notification or email about critical changes such as a new password, phone number or email address, and about a first login on a new device, browser or location. It says that if you get one you did not cause, you should change your password and PIN immediately and contact Customer Service. If the alert concerns changes you made, no action is needed. So look through your email and notifications for such alerts, because they show when the account changed.

#Do Not Share Your Codes With Anyone

Shopee's transaction page lists tips for keeping information safe: log out on public computers, double-check the URL before entering personal details, never share your one-time password with anyone, set up two-factor authentication and stay updated on recent scams. The ShopeePay page repeats that you should never share a one-time password with anyone, even Shopee staff.

After an incident, people claiming to be Shopee, a bank or the police may call or message you. Ignore any request for your password, PIN or a code, whoever it seems to come from. Our guide on how to spot fake recovery services lists the signs, and we never ask for those either.

#Who Do I Report to in Malaysia?

The transaction page has a section for victims of fraud. It lists these steps, and we keep to its wording. We do not print phone numbers here, so take the contact details from the page itself or from each body's own website.

The Semakmule portal at semakmule.rmp.gov.my is run by the Commercial Crime Investigation Department of the Royal Malaysia Police. When we opened it on 26 October 2026, the page showed the heading of the Commercial Crime Investigation Department of the Royal Malaysia Police and no further instructions we could read. Shopee's page says it is for checking whether a bank account or phone number is involved in commercial crimes. Never enter your own passwords or codes into it.

#What to Keep as Evidence

The pages do not list an evidence set for a Shopee case, so this part is plain logic. Keep a record before you change anything, so you can show your bank, Shopee and the police what happened.

• A screenshot of the order in Purchase History, with the date, the amount and the delivery address.
• The bank or card statement line showing the charge, with all but the last digits of the card number hidden.
• Any Shopee email or in-app notification about a changed password, phone number, email address or new device.
• The time you noticed it, and anything you clicked or shared before then, such as a link or a code.
• The reference number of any police report, and the name of whoever helped you at the bank.

If you shared a code or clicked a link before it happened, our guide to Touch 'n Go eWallet hacked covers the same Malaysian steps for a different wallet.

#What the Pages Do Not Say

The pages we read do not say whether your bank will cancel the payment, and they do not say whether Shopee will cancel the order. They do not give a time for Customer Service to respond, or say how long a temporary block lasts. They do not say how the thief got in. We do not know your outcome, and we will not guess it.

#When It Is Safer to Get Expert Help

Some people sort this out alone, and the official steps stay first. The risks are plain. Shopee's lock page says the temporary block means you must contact Customer Service again to reactivate, so a rushed request can leave you without access for longer. If the SIM is not blocked, the page says a code request could still be used against your PIN. A wallet and a bank account can be linked, so a missed step may leave one of them open. People who offer to recover your money or your account are a risk to expect after a fraud, and Shopee's own pages tell you to report to the bank, the police and NSRC instead. Our guide on fake recovery services, linked earlier in this guide, lists the signs.

If you are unsure about any step, or the account matters for your income or business, handing the case to an experienced team such as AwareXone is the safer choice. We can help you work through the steps in order, secure your other accounts and prepare your evidence. We never ask for your password or codes. See our account security help page, and use the Apply for Case Review button at the end of this guide.

#When a Case Review Makes Sense

If the same email or password is used for other accounts, or a wallet or bank account was touched, or you also sell on Shopee, a review can help you decide what to secure first. SocialSafe by AwareXone is a Malaysia-based service, independent of Shopee, that helps you use the official routes. We never ask for your password or login codes, and we cannot change Shopee's decisions. See how we work on our trust page. If you sell on Shopee, our guide to a frozen seller account covers the seller side.

#Frequently Asked Questions