# TikTok Hacked and Email Changed? How to Get It Back

> TikTok hacked in Malaysia and the email or phone changed? Secure your inbox, try friend verification and Need more help, report it, and avoid recovery scams.

- URL: https://www.awarexone.com/research/tiktok-account-hacked-email-changed
- Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone
- Published: 2026-09-29
- Topics: TikTok, Account recovery, Malaysia
- Related service: TikTok account recovery: https://www.awarexone.com/social-media-recovery/tiktok-account-recovery

## Short answer

Secure your own inbox and phone line first, because TikTok sends its codes there. Try every login method TikTok still offers, then ask at least two TikTok friends to verify you from the Recover your account screen. If nothing works, tap Need more help in the app, which TikTok says may take up to 30 days. Never share your codes.

## Summary

- If a hacker changed your TikTok email or phone, secure your own inbox and phone line first, because TikTok sends its codes there.
- Try every login method TikTok still offers, then ask at least two TikTok friends to verify you from the Recover your account screen.
- If nothing reaches you, tap Need more help in the TikTok app and fill in the form, which TikTok says may take up to 30 days.
- You can also report the takeover through TikTok's Report a problem form under Account access or security, with screenshots of what changed.
- TikTok never asks for your password or verification codes, so anyone who asks for them or charges to unlock the account is running a scam.
- Only TikTok can restore the account, reviews take time, and an account where the attacker controls every login method may not come back.

TikTok logs you out and your password fails. "Forgot password?" sends the code to an email or number that is not yours, and friends are asking why your account posted a giveaway link.

This is the hardest kind of TikTok takeover, but it is not always the end. Secure your own inbox and phone first, then work through TikTok's routes in order: the login methods still on file, verification by friends, the "Need more help?" form and a Report a problem request.

This guide covers only the case where the attacker has already swapped the email or phone. For a wider look at hacks, bans and lockouts, see our [TikTok recovery guide for Malaysian creators](https://www.awarexone.com/research/tiktok-account-recovery-malaysia).

Last checked: 29 September 2026.

## What Should You Do If a Hacker Changed Your TikTok Email?

Secure the email account and phone number you still own, then try "Forgot password?" with any method TikTok still has for you. If none reach you, tap the Help button on the login screen, choose "Recover your account" and ask at least two TikTok friends to verify you. If that fails, tap "Need more help?" and fill in the identity form; TikTok's [email and phone number page](https://support.tiktok.com/en/log-in-troubleshoot/log-in/email-and-phone-number) says this may take up to 30 days. You can also file TikTok's [Report a problem form](https://www.tiktok.com/legal/report/feedback) under "Account access / security". In Malaysia, if money was lost or you shared a code, call 997 and your bank first.

## Is Your TikTok Account Actually Hacked?

TikTok's [hacked account page](https://support.tiktok.com/en/log-in-troubleshoot/log-in/my-account-has-been-hacked) lists the signs it looks for. Any one of them is reason to act now:

- Your password or phone number was changed.
- Your username or nickname was changed.
- Videos were deleted, or posted without your permission.
- Messages you did not write were sent from your account.

A changed email is not on that list, but it means the same thing: treat the account as taken.

## How Could Someone Change the Email Without You Knowing?

In plain terms, the attacker got into your TikTok and at least one of the places TikTok sends codes. TikTok's email help says that when you change the email, it sends a code to the new address, and that both the old and the new address must be active and verified. Phone numbers work the same way.

That rule points to where the takeover probably started. If the email changed, check whether someone was in your old inbox: look for TikTok code emails you did not request, sign-ins you do not recognise and forwarding rules you did not set. If the phone changed, check whether your SIM still works.

## Which Situation Are You In?

What you can still reach decides where you start. Find the row closest to yours.

*Common signs after a TikTok email or phone change and where to start, at the time of writing. Screen labels vary by app version, device and region.*

| What you see | What it usually means | Start here |
| --- | --- | --- |
| You are still logged in on a phone or tablet, but Account Information shows an email or number you do not know | The attacker changed details but has not logged you out yet | Change the password now, then fix the email and phone (Step 2) |
| The password reset goes to someone else's email, but your phone number still works | Only the email was swapped | Reset by phone through "Forgot password?" (Step 2) |
| Both the email and the phone on the account are the attacker's | Every self-service code goes to them | Friend verification, then "Need more help?" (Steps 3 and 4) |
| Your own inbox is also locked or showing strange activity | The takeover probably started with your email account | Recover the inbox with your email provider first (Step 1) |
| Your phone shows "No service" or "SOS only" for no reason | Your number may have been moved to another SIM | Call your carrier from another phone (Step 1) |
| The login screen asks for a 2-step verification code you never set up | The attacker turned on 2-step verification with their own details | "Need more help?" and a Report a problem request (Steps 4 and 5) |

## Step 1: Take Back Your Inbox and Phone Line First

Whoever controls the inbox or the number can reset TikTok again, even after you win it back. Deal with these before you touch TikTok:

- Change the email password to one you use nowhere else, and turn on the provider's own two-step login.
- Sign out every device in the email account's security settings, and remove recovery addresses or numbers you did not add.
- Delete forwarding rules and filters you did not create. They can hide TikTok emails from you.
- If the inbox itself was taken, use your provider's recovery page. Our guide to [recovering a hacked Gmail account](https://www.awarexone.com/research/gmail-hacked-recovery) walks through Google's steps.
- If your phone lost signal suddenly, call your carrier (Maxis, CelcomDigi, U Mobile, Unifi Mobile or your MVNO) from another phone. Ask them to block the SIM, check for a recent SIM replacement and issue a new SIM to you in person.

## Step 2: Try Every Login Method TikTok Still Has

Attackers sometimes change one detail and miss another. TikTok's [Forgot my password steps](https://support.tiktok.com/en/log-in-troubleshoot/log-in/the-way-i-logged-in-last-time-is-no-longer-available) start from the login screen:

1. Tap "Use phone/email/username".
2. Select "Email/Username" and enter your username.
3. Tap "Forgot password?".
4. Choose to reset with your phone number or email, whichever is still yours.

Still logged in on any device? Move fast, in this order. The paths are under Profile, the Menu button, then Settings and privacy:

1. Account, then Password: set a new password. TikTok says this logs you out of all other devices, which removes the attacker's session.
2. Account, then Account Information: put your own phone number and email back. TikTok sends a code to verify each one. If it will not accept the change, report the takeover (Step 5).
3. Security & permissions, then Manage devices: delete any device you do not recognise.
4. Security & permissions, then Security alerts: check for recent events you did not make, and screenshot them.

## Step 3: Ask Two TikTok Friends to Verify You

When the email and phone both belong to the attacker, TikTok offers verification by people you are connected with. Its [account safety page](https://support.tiktok.com/en/safety-hc/account-and-user-safety/account-safety) describes the steps:

1. Open the TikTok app and tap the Help button at the top of the login screen.
2. Tap "Recover your account".
3. Enter your username or the email that was linked, then tap Search. You can also tap "Search by phone number".
4. On your account page, tap "Can't access these?", then "Ask friends to verify".
5. Tap Start, then Share, and send the instructions to your friends by SMS, iMessage or another messaging app.

TikTok says at least 2 friends are needed, they only have a limited time to respond, and you can only send requests a limited number of times each day. Your friends see the request under Security & permissions in their own settings, so tell them where to look. If it fails, you can try again later or move to the next step.

If you have tried too many times already and TikTok is refusing more attempts, our guide to the ["Maximum number of attempts reached" message](https://www.awarexone.com/research/tiktok-maximum-attempts-reached) explains the wait.

## Step 4: Use "Need more help?" to Reset the Login Method

This is TikTok's route for people who can no longer reach the email they signed up with. The email and phone number page says to tap "Need more help?" in the app, fill out the form so TikTok can verify your identity, and then reset your authentication method once it has. TikTok says the process may take up to 30 days.

- Answer from memory and records, not guesses. Give the same details every time you are asked.
- Give the original email and phone number, not the attacker's.
- Watch the inbox you entered, including spam, and reply only to messages that arrive through the app or that form.

## Step 5: Report the Takeover to TikTok

Alongside the login routes, tell TikTok the account was taken. TikTok's [Report a problem page](https://support.tiktok.com/en/safety-hc/report-a-problem/report-a-problem) describes two ways: "Chat with us" in the Help Center inside the app, which needs you to be logged in to the right account, and an online form, which does not.

On the [online form](https://www.tiktok.com/legal/report/feedback), choose the topic "Account access / security" and follow the steps. TikTok says you may be asked to attach screenshots or files, and that only the TikTok Support team can assist with your requests. Describe what changed, when you last had access and which details were yours.

## Evidence to Gather Before You Fill In Any Form

A consistent story is easier for TikTok to check. Put these in one folder before you start:

- Your username, profile link, and the new username if the attacker changed it.
- The email and phone number that were on the account before the change.
- Any TikTok emails or SMS codes you did not request, with dates and times.
- Screenshots of the login error, the reset screen showing someone else's masked email, and anything the attacker posted.
- The date and time you last logged in normally, and the phone model you used.
- Your sign-up method (email, phone, Google or Apple) and roughly when you created the account.
- For creators and sellers: payout, TikTok Shop or brand records that name your handle.

## Recovery Scams Aimed at People in This Spot

A lost TikTok attracts "helpers" fast: comments saying "DM this recovery agent", accounts claiming to work for TikTok, and emails from lookalike addresses asking you to "appeal" through a link. TikTok's [phishing guidance](https://support.tiktok.com/en/safety-hc/account-and-user-safety/avoid-fraudulent-message-attacks-on-tiktok) says it will never contact you to ask for your password, verification codes or other sensitive personal information.

In Malaysia these messages arrive in English, BM and Chinese. The wording below is illustrative, not quoted from a real message:

- "Saya boleh pulihkan akaun TikTok anda dalam 24 jam. Hantar kod pengesahan."
- "TikTok Malaysia team here. Pay a verification fee to unlock your account."
- "帮你找回TikTok账号，先把验证码发给我。"

> Warning: **What not to do.** Do not send anyone your password, a verification code, a TOTP recovery code or a screenshot of one. Do not pay unban sellers, "hackers for hire" or anyone offering to buy the account back from the attacker. Do not install apps or tools that promise to switch off someone else's 2-step verification. A new account does not recover the old one or its followers, so keep working the official routes.

## If Money Was Lost or a Code Was Shared in Malaysia

Hijacked accounts are often used to ask followers for money, sell fake products or spend through linked payment methods. The government's [NSRC 997 hotline page](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline) says to call 997 within 24 hours of discovering a scam so authorities can try to block the money, contact the relevant bank and lodge a police report at the nearest police station. The line runs daily, 24 hours.

Check e-wallets and cards linked to your phone or TikTok for charges you did not make. To report the hacking as a computer security incident, CyberSecurity Malaysia's [Cyber999 centre](https://www.cybersecurity.my/portal-main/services/cyber999-overview) is the national point of contact and takes reports by online form, email, phone and its mobile app.

## Once You Are Back In, Lock It Down

Getting in is half the job. TikTok's account safety steps close the doors:

- Set a new password of 12 to 15 characters that you use nowhere else. TikTok recommends that length.
- Link both a phone number and an email you control, so one can rescue the other.
- Open Security & permissions, then Security checkup, and work through each task until it shows a green tick.
- Turn on 2-step verification with at least two methods. TikTok lists phone, email, an authenticator app and password. Save the TOTP recovery code offline if you use an authenticator.
- Add a passkey under Account, then Passkey. TikTok says it uses your phone's Face ID, passcode, Touch Unlock or PIN instead of a password.
- Check Manage devices again a day later, and delete anything the attacker posted.

If the attacker messaged your followers, post a short warning from an account you control. Our guide to [hacked accounts messaging your friends](https://www.awarexone.com/research/hacked-account-messaging-friends) has wording you can adapt.

> Note: **TikTok makes the final decision.** Only TikTok can restore a TikTok account. Friend verification can fail, the identity form can take weeks, and an account where the attacker controls the email, the phone and 2-step verification may not come back. Nobody outside TikTok can promise otherwise.

## When a Case Review Makes Sense

Most people can work through the steps above alone. A second look helps when the account carries a business, TikTok Shop sales or a large following, when both the email and phone were taken, or when "Need more help?" and Report a problem have already been tried. SocialSafe by AwareXone, our recovery service, looks at the case first and tells you honestly which official route is still open, if any. We use only TikTok's own forms, and we never ask for your password or codes. See how [TikTok account recovery](https://www.awarexone.com/social-media-recovery/tiktok-account-recovery) works and read our [Trust Center](https://www.awarexone.com/trust) for what we will not do.

## Frequently Asked Questions

### Can I recover my TikTok if the hacker changed both the email and phone number?

Sometimes. Try friend verification from the Recover your account screen, then the "Need more help?" identity form, and report the takeover under Account access / security. TikTok decides, and some accounts are not restored.

### How long does TikTok take to restore a hacked account?

A reset by phone or friend verification can work the same day. TikTok says the "Need more help?" process may take up to 30 days, and it does not publish a timeline for Report a problem requests.

### Does TikTok have a phone number or email I can contact in Malaysia?

The TikTok help pages we checked send hacked accounts to in-app tools and the online Report a problem form, not a phone line. Treat anyone in messaging apps or comments who says they are TikTok staff as a scammer.

### Akaun TikTok kena hack dan e-mel ditukar, apa perlu buat?

Selamatkan e-mel dan nombor telefon anda dahulu, kemudian cuba "Forgot password?", pengesahan oleh rakan dan borang "Need more help?" dalam aplikasi TikTok. Jangan hantar kod pengesahan kepada sesiapa.

### Will TikTok delete my account if the hacker posts rule-breaking videos?

It can happen, because TikTok bans accounts that consistently violate its Community Guidelines. If a ban follows the hack, open the ban notice, tap Appeal and explain that the account was hacked, with the dates.

### Can AwareXone get my TikTok account back?

Nobody outside TikTok can restore a TikTok account. SocialSafe by AwareXone can review your case and help you prepare TikTok's official requests, but TikTok makes the decision.

## Official sources

- [TikTok Help Center: My account has been hacked (read 29 September 2026)](https://support.tiktok.com/en/log-in-troubleshoot/log-in/my-account-has-been-hacked)
- [TikTok Help Center: Email and phone number (read 29 September 2026)](https://support.tiktok.com/en/log-in-troubleshoot/log-in/email-and-phone-number)
- [TikTok Help Center: Account safety (read 29 September 2026)](https://support.tiktok.com/en/safety-hc/account-and-user-safety/account-safety)
- [TikTok Help Center: Forgot my password (read 29 September 2026)](https://support.tiktok.com/en/log-in-troubleshoot/log-in/the-way-i-logged-in-last-time-is-no-longer-available)
- [TikTok Help Center: Report a problem (read 29 September 2026)](https://support.tiktok.com/en/safety-hc/report-a-problem/report-a-problem)
- [TikTok: Report a problem online form (read 29 September 2026)](https://www.tiktok.com/legal/report/feedback)
- [TikTok Help Center: Avoid phishing on TikTok (read 29 September 2026)](https://support.tiktok.com/en/safety-hc/account-and-user-safety/avoid-fraudulent-message-attacks-on-tiktok)
- [MyGOV Malaysia: NSRC 997 Hotline (read 29 September 2026)](https://www.malaysia.gov.my/en/categories/safety-and-community/cybersecurity/nsrc-997-hotline)
- [CyberSecurity Malaysia: Cyber999 Cyber Incident Response Center (read 29 September 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview)

---

AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.