# TikTok Shop Hacked and Payout Bank Account Changed? > TikTok Shop seller account hacked in Malaysia and the payout bank account changed? What to lock first, how to report the takeover and protect your balance. - URL: https://www.awarexone.com/research/tiktok-shop-seller-hacked-payout-changed - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-05 - Topics: TikTok, Account recovery, Malaysia - Related service: Business and creator recovery: https://www.awarexone.com/services/business-creator-recovery ## Short answer Someone with access to your seller account has redirected your earnings. If you can log in, change the password, delete unknown bank accounts, devices and sub-accounts, and turn on two-step verification. If you cannot, report the account as compromised through Seller Center's Contact Us. If money moved, call your bank or NSRC 997 and make a police report. ## Summary - A stranger's bank account in your TikTok Shop payout settings means someone took over the seller account, which is different from a shop deactivated for a policy breach. - If you can still log in, change the password, remove unknown bank accounts, devices and sub-accounts, and turn on two-step verification straight away. - If you are locked out, report the takeover in Seller Center through Contact Us, choosing the option that says the account has been compromised, and keep the case reference. - If money already went to the attacker, call your bank or the NSRC on 997 at once and make a police report, then add those references to your TikTok case. - TikTok Shop says it never asks for your password, payment details or verification codes, so anyone posing as seller support who asks for a code is a scammer. - Only TikTok Shop can return the account and restore withdrawals, nobody can promise the money comes back, and some cases end without full recovery. You open Seller Center and the bank account under your payouts is not yours. Or a withdrawal you never asked for has gone out, your password stops working, or withdrawals are suddenly on hold while orders keep coming in. The short answer: this is an account takeover, not a policy problem. Lock what you can reach, report the takeover through TikTok Shop's own support, and if money has already moved, treat it as fraud and call your bank or the NSRC on 997. This guide covers how to tell a takeover from a deactivation, the first hour, the two recovery paths TikTok Shop documents, the ownership evidence and the scams that follow a hack. Last checked: 5 October 2026. ## What Should You Do If a Hacker Changed Your TikTok Shop Payout Account? Work in this order. If you can still log in, change the password, remove any bank account, device, sub-account or linked TikTok account you do not recognise, and turn on two-step verification. If you are locked out, go to Seller Center, open Contact Us and report that the account has been compromised, then keep the case reference number. If a payout or withdrawal has already reached the attacker, call your bank or the NSRC on 997 and make a police report. Do not share any code with anyone who contacts you about the problem. Nobody outside TikTok Shop, including AwareXone, can change your payout settings or release a frozen balance for you. ## Takeover or Deactivation: Which One Is This? The two can look alike at first, but they need different fixes. TikTok Shop Malaysia's [guide to securing your account](https://seller-my.tiktok.com/university/essay?knowledge_id=7403313212245777&lang=en) says attackers often target accounts "not for the content, but to redirect your earnings", and that the most common method is changing the bank details to theirs. A deactivation, by contrast, is TikTok Shop enforcing its rules. Seller Center wording varies by version and region, so match on the key words. *TikTok Shop takeover signs and the first step for each, based on TikTok Shop Academy pages at the time of writing.* | What you see | What it most likely means | First step | | --- | --- | --- | | A bank account or payout method you never added | Someone with access has redirected your earnings | Remove it now if you can log in; report the account as compromised if you cannot | | A login alert from a device or country you do not know | Someone has your password, or is trying to | Change the password, sign out unknown devices and turn on two-step verification | | Your password no longer works and the login email or phone has changed | A full takeover; the attacker now controls the recovery details | Use Seller Center's Contact Us route for a compromised account | | Withdrawals on hold soon after suspicious activity | Often a protective freeze, not a penalty | Do not open a new shop; secure the account and follow the recovery and appeal steps | | A violation ticket and a falling Account Health Rating, with no strange logins | A policy enforcement, not a hack | Read the ticket and appeal it; see our deactivated shop guide | If the last row is yours, the route is an appeal, not account recovery. Our guide to a [deactivated TikTok Shop in Malaysia](https://www.awarexone.com/research/tiktok-shop-account-deactivated-malaysia) covers the Account Health Rating and the appeal steps. ## The First Hour: Order of Actions 1. Screenshot the payout settings, withdrawal records, login alerts and change emails, with dates visible. 2. Secure the email linked to Seller Center first: new password, and remove forwarding rules you did not set. 3. Change the Seller Center password from a trusted device, or use the forgot password option. 4. Remove the unknown bank account, then review devices, sub-accounts and linked TikTok accounts. 5. If you cannot get in, use the compromised account route below until you receive a case reference. 6. If money has left, call your bank or 997 and make a police report the same day. 7. Warn your team and regular buyers from another channel that messages from the shop may not be you. ## If You Can Still Log In to Seller Center TikTok Shop's [self-service account recovery page](https://seller-sg.tiktok.com/university/essay?knowledge_id=5105414874531601&lang=en) sets out what to do when you can still log in. That page is published for Singapore sellers, so treat it as how TikTok Shop documents the process and look for the matching settings in your Malaysian Seller Center. Its steps, in short: - Restart your phone and uninstall any unknown or suspicious apps. - Reset your password through "Forgot the password?" and log in again with the new one. - Turn on 2-Step Verification under My Account, then Seller Profile, Account Information and Account Security, with an authenticator app as the recommended method and more than one method where possible. - Remove unknown devices and sub-accounts under Account Settings and User Management. - Remove unknown linked TikTok accounts. - Remove unknown bank accounts under Account Settings and Bank Accounts, and change your 6-digit withdrawal password there too. The Malaysian guide adds two checks: review "Authorised Devices" and sign out of anything unfamiliar, and confirm in "Payment/Withdrawal" settings that the account on file is yours and no secondary payout method has been added. > Note: **Why the code matters.** The Malaysian guide says every bank account or payout method change sends a one-time code to your registered phone number or email before it takes effect, and that an unauthorised person cannot complete the change unless you give them that code. If a stranger's account appeared anyway, either the code went to a phone or email the attacker controls, or someone was persuaded to read it out. Check both before you assume the problem is solved. ## If You Are Locked Out: The Compromised Account Route When the attacker has changed the password or login details, the same Singapore page describes a guided route through Seller Center. Malaysian sellers should follow the matching option in their own Seller Center; labels may differ slightly. 1. Go to Seller Center, then Contact Us, then Seller Service. Choose your region, the topic Account, then Seller Account, and the issue "Account has been compromised". 2. In the pop-up, select "Recover my account" and answer the question that follows as the page directs. 3. Choose personal or corporate shop and enter the shop details: shop name or code, region, owner or company name, identity card or company registration number, and the email or phone used to log in. Then select "Verify and lock account". 4. If the login email or phone still matches TikTok's records, you receive a one-time code to enter yourself. If it does not match, an option to "Skip without safeguarding your account" appears. 5. Submit the information. TikTok Shop says you then receive a case confirmation email with a reference number, and that the investigation only starts once this step is complete. If the attacker also took the TikTok account linked to the shop, recover it in parallel; see our guide to a [TikTok account hacked with the email changed](https://www.awarexone.com/research/tiktok-account-hacked-email-changed). The Malaysian guide says locked-out users should use the in-app account recovery flow and the official in-app Help Centre. ## What Happens to Your Balance and Withdrawals The Singapore recovery page says that once a takeover is detected, TikTok Shop automatically freezes the withdrawal function to prevent unauthorised transfers, and that withdrawals are restored only after the account is recovered. It describes the frozen balance as protected until then. The Malaysian guide is less specific: it says TikTok may pause sensitive actions after an unfamiliar login and may restrict access or require extra verification when it detects a takeover attempt. On the Singapore page, getting withdrawals back is a separate step: after the recovery email, the seller appeals through Shop Health and Violation Records with supporting documents. That page sets Singapore deadlines and timings, so do not treat them as Malaysian rules; check the notices and case emails in your own Seller Center, and act early. > Warning: **Do not open a second shop.** A frozen balance is frustrating, but starting a new shop to keep selling does not move the money and can complicate the review of the original account. Recover the account you have. ## Evidence Checklist for the Ownership Check The Singapore page asks for at least three supporting documents in the withdrawal appeal, such as a bank statement, an identity document with a selfie holding it, and business registration documents for a company. Gather these before you need them: - A statement from your real payout bank account, showing the name that matches the shop. - Your identity card, and a clear selfie holding it, for a personal shop. - Company registration documents and the representative's identity card, for a corporate shop. - Screenshots of the unknown bank account, withdrawals, login alerts and change emails, with dates visible. - The case reference number from TikTok Shop's confirmation email. - Your police report number and NSRC or bank reference, if money moved. - A short, factual timeline: when you last had normal access, what changed and when you noticed. ## How Attackers Get the Payout Code The Malaysian guide says that in many cases attackers do not hack the platform itself. They use phishing and social engineering to get passwords, verification codes or payment details, often posing as TikTok support with a link to a fake login page, or as "TikTok Support" or "System Notification" asking for the payout code. The same scripts can arrive in English, Bahasa Malaysia or Chinese. Watch for: - A "TikTok Shop Seller Support" message on WhatsApp or Telegram saying your shop will be closed unless you verify, with a login link. - A courier or logistics officer who needs "the code we just sent" to release a parcel or confirm a pickup. - A bulk buyer or brand who wants to place a large order and asks you to log in through their link or share a code to "verify the seller". - Someone offering to unfreeze withdrawals or recover the shop for a payment, often after you post about the hack. - An agency asking for the owner login instead of a staff seat. TikTok Shop's Malaysian guide is plain about this: TikTok will never ask for your password, payment details or 2FA code by direct message, call or email, and will never ask you to share a verification code. Check that any login page is on an official TikTok domain before you type anything. ## If Money Already Left: Bank, NSRC 997 and a Police Report Treat a payout to a stranger's account as fraud. The NSRC's [FAQ on the NFCC website](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) says to contact your bank's 24-hour hotline or the NSRC on 997 as soon as you discover an unauthorised transaction, then make a police report at the nearest station; it says reports must be made within 24 hours. It also says acting quickly can reduce losses, with no guarantee the money comes back, and that the NSRC, PDRM, MCMC, BNM and banks will never ask for your password, PIN, TAC or OTP. Give them the date, amount and any receiving account details in the payout record, and add the police report number to your TikTok Shop case. A phishing link or fake support page can be reported to CyberSecurity Malaysia's [Cyber999 incident response centre](https://www.cybersecurity.my/portal-main/services/cyber999-overview). If your phone suddenly shows no service while codes stop arriving, call your carrier from another phone and ask whether your SIM was replaced. ## Lock It Down So It Does Not Happen Again Once you are back in, close the gaps the attacker used. The Malaysian guide and Singapore page together suggest: - Turn on two-step verification with an authenticator app on a phone only you use, and add a second method. - Use a unique password that you do not use for your email or other apps. - Never share the owner login with an agency or staff. Give them limited access through User Management, and remove it the day the relationship ends. - Keep a separate business bank account for shop payouts, so your personal savings stay apart if the shop is ever compromised. - Check Payment/Withdrawal settings and Authorised Devices regularly, not only after an alert. This is also a contract point. TikTok Shop's [Malaysian seller terms](https://seller-my.tiktok.com/university/essay?knowledge_id=2500708885432065) say the seller keeps account access details confidential and is responsible for access that results from not keeping them secure. A shared password makes the ownership story harder to tell. Our guide to [two-step verification on TikTok and other apps](https://www.awarexone.com/research/two-factor-authentication-instagram-facebook-tiktok) explains which method to choose. ## Mistakes That Slow Recovery - Removing the attacker's bank account but leaving their device, sub-account or linked TikTok account in place. - Changing the Seller Center password while the attacker still controls your email. - Stopping the compromised account form before the case reference arrives. - Sending documents that do not match the shop's registered name. - Paying an "unfreeze" service or sharing a code with someone who messaged you. - Waiting for TikTok to reply before telling your bank or the NSRC about lost money. If you are unsure which channel is the real one, our guide to [contacting TikTok support from Malaysia](https://www.awarexone.com/research/tiktok-support-contact-malaysia) lists the official routes. ## When a Case Review Makes Sense You can often handle this alone with the steps above, and only TikTok Shop can return the account or restore withdrawals. A second pair of eyes helps when the shop and the linked TikTok account were both taken, or when the ownership documents do not line up neatly with the shop. SocialSafe by AwareXone reviews the case first and tells you honestly whether an official route is still open; sometimes you already have what you need. We work only through TikTok Shop's own processes, on a best-effort basis, and never ask for passwords or codes. Read how [business and creator recovery](https://www.awarexone.com/services/business-creator-recovery) works, and see our [Trust Center](https://www.awarexone.com/trust). Some accounts do not come back. ## Frequently Asked Questions ### Can a hacker change my TikTok Shop bank account without the code? TikTok Shop's Malaysian guide says a payout change needs a one-time code sent to your registered phone or email, and cannot be completed without it. If the change went through, check whether the attacker changed your login phone or email first, or whether anyone was given the code. ### Will I get back the money paid to the hacker's account? Nobody can promise that. The NSRC says quick reporting to your bank or 997 can reduce losses, but there is no guarantee. Report at once, make a police report and add both references to your TikTok Shop case. ### Why are my TikTok Shop withdrawals frozen after a hack? TikTok Shop's Singapore recovery page says it freezes withdrawals automatically when a takeover is detected, to stop money leaving, and restores them after recovery. Check your own Seller Center notice for what applies to your Malaysian shop. ### Is "TikTok Shop Seller Support" on WhatsApp real? Treat it as a scam if it asks for a password, code or login through a link. TikTok Shop says it never asks for your password, payment details or verification codes by message, call or email. ## Official sources - [TikTok Shop Academy (Malaysia): A Creator's Guide to Securing Your Account (read 5 October 2026)](https://seller-my.tiktok.com/university/essay?knowledge_id=7403313212245777&lang=en) - [TikTok Shop Academy (Singapore): Self-Service Account Recovery (read 5 October 2026)](https://seller-sg.tiktok.com/university/essay?knowledge_id=5105414874531601&lang=en) - [TikTok Shop Academy (Malaysia): TikTok Shop Seller Terms of Service (MY) (read 5 October 2026)](https://seller-my.tiktok.com/university/essay?knowledge_id=2500708885432065) - [NFCC: National Scam Response Centre FAQ (read 5 October 2026)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) - [CyberSecurity Malaysia: Cyber999 Cyber Incident Response Center (read 5 October 2026)](https://www.cybersecurity.my/portal-main/services/cyber999-overview) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.