# When to Get Help Recovering a Hacked Account > Tried every recovery step and still locked out? The signals that mean it is time for help in Malaysia, how legitimate help works and how to spot scammers. - URL: https://www.awarexone.com/research/when-to-get-professional-account-recovery-help - Author: Md Shariar Shanaz Shuvon, Founder & CEO, AwareXone - Published: 2026-10-05 - Topics: Account recovery, Scams, Malaysia - Related service: Social media recovery hub: https://www.awarexone.com/all-types-of-social-media-problem-solutions ## Short answer Most people should try the platform's own free recovery route properly first, because only the platform can restore an account. Get outside help when that route keeps looping, when the email, phone and two-factor were all changed, or when a business or income depends on it. Legitimate help never asks for your password, OTP or backup codes. ## Summary - Start with the platform's own free recovery route, such as facebook.com/hacked, instagram.com/hacked, TikTok's hacked account steps or Google's account recovery page. - Consider outside help when those routes keep looping, when the email, phone and two-factor were all changed, or when a business, Page or income depends on the account. - Legitimate help starts with a review of your case, works only through official platform processes and never asks for your password, OTP or backup codes. - Anyone who messages you first, comments as a hacker or promises a guaranteed result for an upfront payment is almost certainly a recovery scammer. - If money was lost or you shared a code, call your bank or the NSRC on 997, make a police report, and report the intrusion to Cyber999. - Only the platform can restore an account, nobody outside it can promise an outcome, and some accounts do not come back. You have filled in the recovery form, waited for the email, tried the video selfie and asked for a new code. The account is still out of reach, and now you are wondering whether you should pay someone to get it back. The short answer: most people should try the platform's own recovery route properly first, because it is free and it is the only route that can actually restore an account. Help from outside makes sense in a narrower set of situations, and only from someone who works through those same official routes. This guide gives you a checklist of signals that point to getting help, the signals that say you can finish it yourself, what legitimate help looks like, and how to tell a recovery scammer apart from a real service. Last checked: 5 October 2026. ## When Should You Get Help Recovering a Hacked Account? Get help when you have worked through the platform's official recovery flow and it keeps looping or rejecting you, when the attacker changed the email, phone number and two-factor authentication together, when a business Page, ad account or your income depends on the account, or when several linked accounts were taken at once. Before that point, the official route is usually the better first move. In Malaysia, if money was lost or you shared a code, call your bank or the NSRC on 997 before anything else. Whoever helps you, only the platform can restore the account. ## Try the Official Recovery Routes First Each platform has a free, self-service starting point. Use it before you decide anything else, and use it on a phone or computer you have logged in with before. Meta's [Account Recovery page](https://www.facebook.com/help/292105707596942) says that gives the best results. *Official recovery starting points, based on each platform's help centre at the time of writing. Labels can vary by app version and region.* | Platform | Official starting point | What it relies on | | --- | --- | --- | | Facebook | [facebook.com/hacked](https://www.facebook.com/help/203305893040179), ideally on a device you used before | A special link Facebook sends to your previous email when the email is changed, which lets you reverse the change | | Instagram | [instagram.com/hacked](https://help.instagram.com/149494825257596), or "Forgot password?" and "Send login link" | The "secure my account" option in an email from security@mail.instagram.com, a login link, or a support request with a video selfie for accounts with photos of you | | TikTok | The steps on TikTok's [hacked account page](https://support.tiktok.com/en/log-in-troubleshoot/log-in/my-account-has-been-hacked) | Changing the password, linking your phone number and removing unknown devices under "Manage devices" while you still have access | | Google and YouTube | Google's account recovery page, then [YouTube's hacked channel steps](https://support.google.com/youtube/answer/76187?hl=en) | Answering recovery questions from a familiar device, browser and location | Give each route a fair attempt. Google's [recovery tips](https://support.google.com/accounts/answer/7299973?hl=en) say to answer every question you can, guess rather than skip, and use the device and location where you usually sign in. Instagram's help page says that if a video selfie fails, you can submit a new one for another review. Details like these matter. ## Signals That Point to Getting Help None of these means you must hire anyone. Each one means the case has become harder to handle alone, and a second pair of eyes may save you from a mistake you cannot undo. Tick the ones that apply. - The official flow loops. You submit the form, get an automated reply, and land back at the same screen with no new option. - Every recovery method is gone. The attacker changed the email, the phone number and the two-factor method, so every code goes to them. - The account is tied to money. It runs a business Page, an ad account with your card on it, a shop or brand deals. - Several accounts fell together. Your email, Instagram and Facebook were taken in one go, so fixing one in the wrong order lets the attacker back into the others. - You cannot prove ownership in the form the platform wants. The account has no photos of you, it was set up by a former staff member or agency, or the sign-up details are long lost. - Your appeal was rejected, and you are not sure whether a second attempt would help or hurt. - The account is now restricted or disabled because the attacker posted content that broke the rules. - You are spending hours each day on it, and the stress is making you more likely to trust a stranger who promises a quick fix. One situation is not a recovery case at all: managing or closing an account that belonged to a relative who has died. If that is what you are dealing with, our guide to [a dead relative's old social media accounts](https://www.awarexone.com/research/remove-dead-relatives-old-accounts) is the one to read instead. If you ticked one or two, the next step is usually organising your evidence, not handing the case to someone. If you ticked three or more, especially the money and the linked-accounts signals, a case review is worth considering. ## Signals That You Can Probably Finish It Yourself You may well be able to finish it through self-service if any of these is true: - You still have access to the email that was on the account, and Facebook or Instagram sent a message there about the change. - You are still logged in on at least one device, even if the password no longer works elsewhere. - Your phone number still receives codes from the platform. - You have saved backup codes for two-factor authentication. - The account has clear photos of you and the platform offers a video selfie check. For the specific case of a lost email, phone or two-factor device, our guide to [recovering without your old email or phone](https://www.awarexone.com/research/lost-email-phone-2fa-account-recovery) walks through each route in order. ## A Quick Decision Check Answer these in order. Stop at the first one that gives you a clear next step. 1. Did you lose money, or share a password, OTP or backup code with anyone? Yes: call your bank or 997 now, then come back to the account. No: go to question 2. 2. Do you still control the email or phone on the account, or a logged-in device? Yes: use the official flow in the table above, starting with the change-reversal email if there is one. No: go to question 3. 3. Have you completed the official flow at least once, including any identity check? No: do that first. Yes: go to question 4. 4. Does a business, a Page, an ad account or several linked accounts depend on this one? Yes: a case review makes sense now. No: go to question 5. 5. Has the platform rejected or ignored you after a complete, accurate attempt? Yes: get your evidence in order, and consider a review before you submit again. No: wait for the platform's reply and watch your secure email. If you are weighing the two paths more broadly, our comparison of [doing it yourself versus getting professional help](https://www.awarexone.com/research/account-recovery-diy-vs-professional-help) sets out what each costs you in time and risk. ## What Legitimate Recovery Help Looks Like Real help is less dramatic than the adverts suggest. Nobody outside a platform can switch an account back on. What a legitimate service does is make your request through the official route as clear, complete and well evidenced as it can be. - It reviews your case first and tells you honestly whether there is a route left, including when the answer is that you can do it yourself. - It works only through the platform's own forms, appeals and identity checks, the same ones you can use. - It never asks for your password, an OTP, a login code or backup codes, and never asks you to log in on its own website. - It does not need access to your other accounts, your phone or your banking app. - It describes its work as best effort and says plainly that the platform makes the final decision. - It has a real business identity you can check, and a written explanation of how it handles your data. Meta's own page on [third-party offers to manage your account](https://www.facebook.com/help/359711567494793/?locale=en_GB) says some services offer to fix account issues for payment, and that none of them are affiliated with or endorsed by Meta. That includes honest services. A legitimate one will say so openly rather than hint at a special connection. ## How to Spot a Recovery Scammer Many of the people who contact you after a hack are scammers. They watch for public posts about lost accounts and reply quickly, in English, Bahasa Malaysia or Chinese. Use this checklist before you reply to anyone: - They found you. A cold DM, a reply under your post, or a comment from an account calling itself a hacker or a recovery expert. - They talk about hacking the account back, a secret method, or a contact inside Meta, TikTok or Google. - They promise a guaranteed result or name a short deadline. - They want payment up front for software, an unlock tool, a server or a verification charge, and the amount grows each time. - They ask for your password, a code sent to your phone, your backup codes or a screenshot of your login screen. - They pressure you to decide now, or say your account will be deleted if you wait. - Their testimonials are screenshots you cannot verify, and their only contact is a chat app. > Warning: **Never share a code.** Google's [recovery tips](https://support.google.com/accounts/answer/7299973?hl=en) say Google never asks for your password or verification codes by email, phone call or message. No real recovery helper needs them either. A code sent to you is the key to your account, and whoever holds it can lock you out again. If someone has already contacted you with an offer, our guide to [fake hackers offering account recovery](https://www.awarexone.com/research/fake-hackers-offering-account-recovery-scam) explains how the script usually unfolds and how to report it. ## If a Scam or Intrusion Is Involved in Malaysia Deal with the money before the account. The NSRC's [FAQ on the NFCC website](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) says to contact your bank's 24-hour hotline or the NSRC on 997 as soon as you notice an unauthorised transaction, and to make a police report at the nearest station within 24 hours. It adds that there is no guarantee money comes back, and that NSRC, PDRM, MCMC, BNM and banks will never ask for your password, PIN, TAC or OTP. The hack itself, a phishing page or a fake recovery service can be reported to CyberSecurity Malaysia's [Cyber999 reporting channel](https://www.mycert.org.my/portal/full?id=9eb77829-7dd4-4180-814f-de3a539b7a01) by online form, email, phone or its mobile app. For email reports, MyCERT asks for details such as the time of the attack, the source, email headers and log files where you have them. Keep a copy of whatever you send. ## What to Prepare Before You Ask Anyone for Help Whether you try again alone or ask for a review, the same evidence makes the request stronger. Gather it now, while the details are fresh: - The username and profile link, plus any old usernames the account used. - The email and phone number that were on the account before the hack, and when you signed up, even roughly. - The device you usually logged in with, and whether it still has the app installed. - Screenshots of every notice and email from the platform, with the date visible. - Any email telling you that your email, phone or password was changed. - For business accounts: ad receipts, Page role history and the name of anyone else with access. - A short timeline in plain words: when you last had access, what you noticed and what you have tried. - Police report or Cyber999 reference numbers, if you have made a report. Our [checklist for preparing a recovery case](https://www.awarexone.com/research/what-to-prepare-before-account-recovery-case) goes through each item in more detail, including how to capture screenshots that a reviewer can use. ## Limits Nobody Can Remove Some limits apply however good the help is. Only the platform can restore an account. A strong, honest request improves your chances; it does not decide the outcome. - Time matters. YouTube's [hacked channel page](https://support.google.com/youtube/answer/76187?hl=en) says its creator support is limited to hacking incidents within the past nine months, because of its data retention policy. - Recovery comes before appeals. YouTube says an appeal against a channel termination may not be accepted if the Google Account recovery is incomplete. - Even once you are back in, YouTube notes it is not always possible to confirm the attacker has been removed, so secure every linked account straight away. - Google's [recovery tips](https://support.google.com/accounts/answer/7299973?hl=en) list creating a replacement account as the next step if you still cannot sign in. Sometimes that is the honest answer. ## When a Case Review Makes Sense If you ticked several signals above, the official routes have stalled, or the account carries a business, a review can help you decide what to do next without risking another rejection. SocialSafe by AwareXone, our Malaysian recovery service, looks at the case before anything is agreed, works only through the platforms' official processes, and will tell you when the honest answer is that you already have what you need. You can see the platforms and situations we cover on our [recovery hub](https://www.awarexone.com/all-types-of-social-media-problem-solutions), and our [Trust Center](https://www.awarexone.com/trust) sets out what we never ask for, starting with your password and codes. ## Frequently Asked Questions ### Should I hire someone to recover my Instagram? Not before you have tried instagram.com/hacked, the login link and any identity check Instagram offers. If those fail, or the account carries a business, a case review from a service that never asks for your codes is a reasonable next step. ### Can anyone recover a hacked account faster than the platform? No outside person controls the platform's review queue. Someone claiming a shortcut through a contact inside the company is either a scammer or offering something the platform does not allow. ### Is it safe to give a recovery service my login details? No. A legitimate service never needs your password, OTP, login code or backup codes, and AwareXone never asks for them. Anyone who does could take the account for themselves. ### I tried everything and I am still locked out. What now? Check that you completed each step fully, from a device you used before, and that your evidence is in order. If you have, decide whether the account is worth a review, and accept that the platform may still say no. ### Where do I report a recovery scammer in Malaysia? If you paid, call your bank or the NSRC on 997 and make a police report. Report the scam account on the platform where it contacted you, and send phishing links or fake recovery sites to Cyber999. ## Official sources - [Facebook Help Center: Recover your Facebook account if you were hacked (read 5 October 2026)](https://www.facebook.com/help/203305893040179) - [Facebook Help Center: Account Recovery (read 5 October 2026)](https://www.facebook.com/help/292105707596942) - [Facebook Help Centre: About third-party website offers to manage your Facebook account (read 5 October 2026)](https://www.facebook.com/help/359711567494793/?locale=en_GB) - [Instagram Help Center: If you think your Instagram profile has been hacked (read 5 October 2026)](https://help.instagram.com/149494825257596) - [TikTok Support: My account has been hacked (read 5 October 2026)](https://support.tiktok.com/en/log-in-troubleshoot/log-in/my-account-has-been-hacked) - [Google Account Help: Tips to complete account recovery steps (read 5 October 2026)](https://support.google.com/accounts/answer/7299973?hl=en) - [YouTube Help: Recover a hacked YouTube channel (read 5 October 2026)](https://support.google.com/youtube/answer/76187?hl=en) - [MyCERT, CyberSecurity Malaysia: Cyber999 reporting channel (read 5 October 2026)](https://www.mycert.org.my/portal/full?id=9eb77829-7dd4-4180-814f-de3a539b7a01) - [NFCC: National Scam Response Centre FAQ (read 5 October 2026)](https://nfcc.jpm.gov.my/index.php/en/about-nsrc) --- AwareXone is an independent Malaysia-based provider, not affiliated with any platform. The platform makes the final decision on every account. AwareXone never asks for passwords, OTP codes, backup codes or session cookies.