# Social Media Account Recovery: Complete 2026 Guide

> How to recover a hacked, disabled or locked social media account in 2026: official routes for each platform, what evidence matters, and when to get help.

- URL: https://www.awarexone.com/research/social-media-account-recovery-complete-guide
- Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone
- Published: 2026-10-14
- Topics: Account recovery, Malaysia
- Related service: Social media problem solutions: https://www.awarexone.com/all-types-of-social-media-problem-solutions

## Short answer

Social media account recovery means getting back control of an account through the platform's own recovery and appeal processes. For almost every platform, the fastest legitimate route starts at the platform's official hacked-account or login help page (for example instagram.com/hacked or facebook.com/hacked), backed by proof that you own the account.

## Summary

- Start with the platform's official recovery page. Don't start with a DM, a Google ad, or a "recovery expert" on Telegram.
- A *hacked* account and a *disabled* account are different problems with different routes.
- Ownership evidence (old emails, original sign-up details, ID that matches the profile, business documents) matters most.
- Never give anyone your password, one-time codes (OTPs), or backup codes, including people who say they're helping you.
- Once you're back in, secure the account straight away: change the password, sign out other sessions, turn on two-factor authentication, and check your recovery email and phone.

Social media account recovery means getting back control of an account through the platform's own recovery and appeal processes. For almost every platform, the fastest legitimate route starts at the platform's official hacked-account or login help page (for example instagram.com/hacked or facebook.com/hacked), backed by proof that you own the account. No outsider can override a platform's decision, so anyone promising a promised result is a warning sign, not a shortcut.

This guide covers the main situations (hacked, disabled, suspended, locked), the official starting point for each major platform, what evidence actually helps, and how to decide whether to keep going alone or ask for help.

## What counts as "account recovery"?

People use the term for four different situations, and the route depends on which one you're in:

1. **Hacked (compromised):** someone else logged in and may have changed your email, phone, password or two-factor settings.
2. **Disabled or suspended:** the platform restricted the account for a policy reason, rightly or wrongly. Getting it back is an **appeal**, not a password reset.
3. **Locked or checkpointed:** the platform paused access until you confirm your identity, often after unusual login activity.
4. **Lost access:** you no longer control the email, phone number or two-factor device tied to the account.

Getting this right first saves days. A password reset won't fix a policy suspension, and an appeal won't help if a hacker has simply changed your email.

## What should I do in the first hour after a hack?

The US Federal Trade Commission's consumer guidance lists the classic signs of a hacked account: you can't log in, you get notices about password or username changes you didn't make, you see logins from unfamiliar devices or places, or friends get messages you didn't send ([FTC](https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account)). If you see any of these:

1. **Secure your email first.** The FTC points out that whoever controls your email can reset your other accounts' passwords. If your email was compromised, recover that before anything else.
2. **Check your inbox for the platform's security email.** Several platforms send a message when your email address is changed, and it may include a link to reverse the change. Use it only if it comes from the platform's real domain.
3. **Go to the official recovery page** for that platform (see the table below).
4. **Warn your contacts** that messages from you may be fake, especially any asking for money or codes. The FTC recommends this too.
5. **Start an evidence file:** screenshots of security emails, the date and time you lost access, your original username and email, and anything else that proves the account is yours.

> "The most costly first" - hour mistake is panic: requesting code after code, clicking 'recovery' links in DMs, or deleting the platform's security emails. Those emails often contain a 'secure your account' link and are evidence later. Check first whether your recovery email and phone are still yours." - Md Shariar Shanaz Shuvon, Founder, AwareXone

## Where do I start on each platform?


| Platform | Official starting point |
| --- | --- |
| Instagram | [instagram.com/hacked](https://www.instagram.com/hacked) |
| Facebook | [facebook.com/hacked](https://www.facebook.com/hacked) and Meta's [hacked-account help page](https://www.facebook.com/help/1216349518398524) |
| TikTok | [TikTok Support: "My account has been hacked"](https://support.tiktok.com/en/log-in-troubleshoot/log-in/my-account-has-been-hacked) |
| WhatsApp | [WhatsApp Help: recovering a compromised account](https://faq.whatsapp.com/1131652977717250) |
| YouTube | [YouTube Help: recover a hacked channel](https://support.google.com/youtube/answer/76187) (recovery goes through the Google Account) |
| X | X's Help Center "hacked account" flow (help.x.com) |

The steps inside each flow change often, so this table points to the platform's own page rather than copying steps that may be out of date. AwareXone keeps platform-specific guides in its research library, for example [Instagram: the first hour](https://www.awarexone.com/research/instagram-hacked-first-hour) and [Facebook hacked with email and phone changed](https://www.awarexone.com/research/facebook-hacked-email-phone-changed).

## How is a disabled or suspended account different?

If the platform disabled or suspended your account, nobody "hacked it back". The platform made an enforcement decision, and your options are:

- **Use the in-app or emailed appeal link** in the notice. Many platforms only offer an appeal within a limited window, so read the notice carefully and act quickly.
- **Stick to facts.** Explain clearly why the decision may be wrong, for example if the account was hacked and the violating content wasn't yours. Long emotional messages rarely help.
- **Keep records** of every appeal, reference number and reply.

Some suspensions follow a hack: an attacker posts scam or prohibited content, and the platform disables the account. Then you're dealing with both problems at once, and the evidence that you were hacked becomes part of the appeal.

> "Across the 1,300+ cases AwareXone has solved, a disabled Meta account often starts as a compromise that the owner has not spotted yet: the attacker changes the email or phone, posts scam content, and the platform then disables the profile for the content. The appeals that move forward usually include a clear timeline, the original recovery email, and screenshots of the hacker's posts, not a vague 'I was hacked' claim." - Md Shariar Shanaz Shuvon, Founder, AwareXone

## What evidence proves I own the account?

Platforms decide based on what they can verify. Useful evidence includes:

- The **original email address or phone number** used to create the account, and access to it
- **Security emails** from the platform about the takeover (keep them, don't delete them)
- **Government ID** whose name matches the profile, if the platform asks for it
- For businesses: **business registration documents**, a domain email matching the brand, and Business Manager or ad account records
- **Photos or videos of you** that appear on the account, for platforms that use video-selfie checks
- **Device history:** the phone or computer you've normally logged in from

AwareXone's guide to [proving account ownership](https://www.awarexone.com/research/prove-social-media-account-ownership) goes into more detail.

## Can I talk to a human at Meta, TikTok or Google?

Usually not by phone. Meta states that its products, including Facebook, Instagram and WhatsApp, have no general public customer-service phone number, and warns that phone numbers claiming to be Meta support are potentially scams ([Meta Help Center](https://www.meta.com/help/policies/23938634512490588/)). Meta says subscribers to Meta Verified get email and chat support, and advertisers can use Meta Business Support. See our articles on [Meta Verified vs paid recovery help](https://www.awarexone.com/research/paid-recovery-help-vs-meta-verified-support) and [whether Instagram has a support phone number](https://www.awarexone.com/research/is-there-a-phone-number-for-instagram-support).

## When does it make sense to get outside help?

Most people should try the official route first. Outside help can make sense when:

- The account is a **business asset** (a shop, a creator's income, a Page or ad account), and every day offline costs money
- You've hit a **loop**: rejected appeals, video selfies that keep failing, a code that never arrives
- You **lost the email, phone and 2FA** all at once
- **Several assets** are affected at once, like a Facebook profile, Page, Business Manager and Instagram account

A legitimate recovery service works through the same official channels you have, but with experience in how to prepare evidence and which route fits the case. It can't make the platform's decision for it. AwareXone, the publisher of this guide, offers this kind of help. We never ask for passwords or OTPs, we don't promise outcomes, we reply to new cases within five hours (9am-11pm MYT, every day), and recovery cases start from the quoted fee in Malaysia, and clients outside Malaysia are quoted and billed in USD, with the fee confirmed after case review. We also decline cases that look hopeless or improper. See [how a recovery case works](https://www.awarexone.com/research/social-media-account-recovery-service-how-it-works) and [when to get professional help](https://www.awarexone.com/research/when-to-get-professional-account-recovery-help).

## How do I avoid recovery scams?

Recovery scams target exactly the people this guide is for. The FTC warns that people who've already been scammed often get targeted again by someone offering, for an upfront fee, to recover what they lost ([FTC](https://consumer.ftc.gov/articles/refund-and-recovery-scams)). Red flags include:

- Unsolicited DMs or comments offering to "get your account back"
- Claims of "Meta insiders", "back-end access" or "promised recovery"
- Requests for your password, OTP or backup codes
- Payment only by crypto, gift cards or untraceable transfer

Read our full [guide to account recovery scams](https://www.awarexone.com/research/account-recovery-scams-how-to-spot-fake-recovery-services).

## What should I do once I'm back in?

The FTC recommends changing your password, signing out of all devices, turning on two-factor authentication, and checking that your recovery email and phone are yours ([FTC](https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account)). Also:

- Remove unfamiliar **connected apps** and **linked accounts**
- Check **admins and partners** on Pages, Business Manager and channels
- Save **backup codes** offline
- Review **posts and messages** sent while the account was out of your hands, and delete scam content

Our [two-factor authentication guide](https://www.awarexone.com/research/two-factor-authentication-instagram-facebook-tiktok) covers each platform.

## Country-specific help

If money was stolen, contact your bank and the local authorities as well as working on the account:

- **Malaysia:** for online financial scams, call your bank and the National Scam Response Centre on **997** right away ([MyGOV](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline)), then make a police report. See our [Malaysia recovery guide](https://www.awarexone.com/research/social-media-account-recovery-malaysia).
- **Singapore:** see the [Singapore hub](https://www.awarexone.com/research/social-media-account-recovery-in-singapore).
- **UAE:** see the [UAE hub](https://www.awarexone.com/research/social-media-account-recovery-in-uae).

## Which recovery situations are hardest?

Some patterns come up again and again as the hardest to fix through self-service:

- **Email, phone and 2FA all changed by the attacker.** The platform has fewer ways to confirm it's really you, so identity checks matter more.
- **No photos of you on the account.** Video-selfie checks rely on matching your face to the account's photos, so brand, meme and faceless creator accounts can be harder.
- **The account was disabled after the hack.** You need to show the violating activity wasn't yours, while also getting control back.
- **Business assets tied to one personal profile.** If the only admin profile is compromised or disabled, the Pages, ad accounts and Instagram accounts linked to it can be stuck too.
- **The account was set up by someone else**, like a former employee, agency or family member, using their email or phone.

> "In Malaysia, the pattern that shows up most often before someone contacts us is phishing: a fake login page, a 'copyright' or 'verification' message, or a friend asking for a WhatsApp or Instagram code. CyberSecurity Malaysia's Cyber999 reports keep showing phishing as the bulk of fraud. The preparation step that would have blocked most of those cases is an authenticator" - app 2FA plus a recovery email the attacker cannot reach." - Md Shariar Shanaz Shuvon, Founder, AwareXone

## How do I prepare for a hack before it happens?

Recovery is far easier for people who planned ahead. A short checklist:

1. **Use a dedicated, secure email** for important social accounts, with its own strong password and two-factor authentication.
2. **Turn on app-based two-factor authentication** where available, and store backup codes offline.
3. **Keep your recovery phone number current.** If you change numbers, update every account first.
4. **For businesses, add at least two trusted admins** to Pages and Business Manager, using separate secure profiles.
5. **Keep an ownership file:** sign-up emails, invoices for ads, business registration documents, and the account's creation date if you know it.
6. **Learn what real platform messages look like** so a fake "copyright violation" or "account will be deleted" message doesn't catch you out.

AwareXone's [business social account protection checklist](https://www.awarexone.com/research/protect-business-social-accounts-checklist) covers business-specific steps.

## What do recovery terms mean?

- **Checkpoint:** a security pause where the platform asks you to confirm your identity before you can continue.
- **Appeal:** a formal request asking the platform to review an enforcement decision.
- **Video selfie verification:** a short recording the platform uses to compare your face with photos on the account.
- **Backup codes:** single-use codes that let you log in if you lose your two-factor device.
- **Session:** a logged-in device or browser. Signing out of all sessions removes an attacker who is still logged in.

> Note: **About this guide.** **About the publisher:** This guide is published by AwareXone, whose Malaysia-based recovery service, SocialSafe by AwareXone, works only through official platform channels. See the [SocialSafe by AwareXone social media account recovery page](https://www.awarexone.com/all-types-of-social-media-problem-solutions), [pricing](https://www.awarexone.com/pricing) and the [Trust Center](https://www.awarexone.com/trust).

### How long does social media account recovery take?

There's no fixed timeline. It depends on the platform's review queues, the type of problem and the strength of your evidence. Be wary of anyone who promises a specific turnaround for the platform's decision.

### Can I recover an account without the old email or phone number?

Sometimes. Several platforms offer identity checks such as video selfies or ID uploads when you've lost both. Success depends on whether the platform can match you to the account.

### Is it safe to pay someone to recover my account?

Only if they work through official channels, never ask for your password or codes, and don't promise an outcome. Unsolicited offers in DMs are almost always scams.

### Should I create a new account while I wait?

It's fine to create one to stay in touch with people, but read the platform's rules first. Some platforms treat a new account as evading a ban if the original was disabled for a policy reason.

### Does reporting to the police help me get the account back?

A police report rarely restores the account by itself, but it can support identity claims and is important if money was lost or someone is impersonating you.

## Official sources

- [FTC, How To Recover Your Hacked Email or Social Media Account](https://consumer.ftc.gov/articles/how-recover-your-hacked-email-or-social-media-account)
- [FTC, Refund and Recovery Scams](https://consumer.ftc.gov/articles/refund-and-recovery-scams)
- [Meta Help Center, Phone support availability](https://www.meta.com/help/policies/23938634512490588/)
- [Instagram, hacked account flow](https://www.instagram.com/hacked)
- [Facebook, hacked account flow](https://www.facebook.com/hacked)
- [TikTok Support](https://support.tiktok.com/en/log-in-troubleshoot/log-in/my-account-has-been-hacked)
- [WhatsApp Help Center](https://faq.whatsapp.com/1131652977717250)
- [YouTube Help](https://support.google.com/youtube/answer/76187)

---

AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.