Account Recovery Scams: How to Spot Fake Services

An account recovery scam is when someone offers to get your hacked or disabled account back, takes your money or your login details, and delivers nothing, or takes over even more of your accounts. The biggest warning signs are an unsolicited offer, a promise of promised results or "insider" access, a request for your password or one-time codes, and payment by crypto or gift card. Real platforms don't sell unbans, and legitimate helpers never need your password.

The FTC calls refund and recovery scams "the worst of the worst" because they target people who have just lost something (FTC). This guide explains how these scams work for social media accounts, how to tell them apart from legitimate help, and what to do if you've already paid.

#Why are account recovery scams so common?

Two reasons. First, demand: social media is now where a lot of fraud happens and where people run businesses. In its April 2026 Data Spotlight, the FTC reported that nearly 30% of people who lost money to a scam in 2025 said it started on social media, with $2.1 billion in reported losses (FTC Data Spotlight, April 2026). Second, frustration: platforms mostly offer self-service help, and Meta states it has no general public customer-service phone number (Meta Help Center). Someone who feels stuck is an easy target for anyone claiming to have a way in.

#How do these scams usually work?

#The "hacker for hire" in your comments or DMs

You post "my Instagram got hacked, help!" and within minutes accounts reply recommending a "hacker" who "got mine back in an hour." These are often networks of fake accounts vouching for each other. The "hacker" then asks for an upfront fee, and then more fees for "server costs" or "unlocking."

#The fake "Meta support" or "Instagram support" account

A profile with a support-looking name, a blue badge in the profile picture, or a "Meta Business Help" page messages you saying your account is under review and you need to "verify" through a link. The link is a phishing page that steals your login. AwareXone has documented the fake Meta support scam in Malaysia. See how a case review works on the AwareXone social media account recovery page, or check pricing and the Trust Center.

#The "insider" unban broker

Someone says they have a friend at Meta or TikTok who can restore any disabled account for a fee. Read more in our article on Meta "unban" brokers.

#The fake phone number or Google ad

Searching "Instagram support phone number" can bring up numbers that aren't Meta's. Meta warns that phone numbers claiming to be Meta customer support are potentially scams (Meta).

#The "recovery" that takes your other accounts

Some scammers ask for your email password "to verify ownership", then take over your email and every account linked to it.

"The pattern people report most often before they reach us is a stranger in DMs or comments offering to 'recover' the account for crypto or a gift card, usually after the person posted that they were hacked. The FTC treats unexpected recovery offers that demand upfront payment as a scam signal. We never ask for passwords, OTP codes or payment before a written case review." - Md Shariar Shanaz Shuvon, Founder, AwareXone

#What are the red flags?

#What does legitimate help look like?

A legitimate recovery service or consultant will generally:

• Have a public identity: a website, a named founder or team, published contact channels, and written terms
• Explain the route it will use (the platform's own appeal, identity verification, or business support channels)
• Refuse to promise outcomes and say plainly that the platform decides
• Never ask for your password or OTP. You stay in control of logins.
• Turn down cases it can't help with, instead of taking money anyway
• Give a written quote before you pay, with clear refund terms

For a full checklist, see how to check if a recovery service is legit and our guide on how to choose a recovery service.

#How do I check whether a "support" message is real?

• Check the sender. Real platform emails come from the platform's own domains. Look at the full address, not just the display name.
• Don't trust DMs. Platforms generally contact you through in-app notifications and official email, not friendly DMs from random profiles.
• Go to the platform yourself. Open the app or type the help center address directly instead of clicking a link.

#I already paid a recovery scammer. What now?

1. Stop paying. Scammers often come back with "one final fee."
2. Contact your bank or payment provider right away. The FTC says the sooner you act, the better your chances of stopping or reversing a payment (FTC).
3. Change passwords on any account whose details you shared, starting with your email, and turn on two-factor authentication.
4. Report it:

- Malaysia: call your bank's 24/7 hotline or NSRC 997 as soon as you discover the loss. MyGOV advises reporting within 24 hours so authorities can try to block the transactions (MyGOV). Then make a police report. Our guides: NSRC 997, Semak Mule, what to bring to a police report. - Singapore: check with the ScamShield Helpline (1799) and file a police report online (ScamShield). - UAE: report through the official eCrime channels (UAE government portal). - US: ReportFraud.ftc.gov (FTC).

1. Report the scammer's profile to the platform it messaged you on.
2. Watch for a second wave. The FTC warns that scammers buy and trade lists of people who've already been scammed (FTC).

See also: lost money to a recovery scammer.

#Why can't a "hacker" just get my account back?

Even setting aside the legal problems, someone who claims they can break into a platform to "recover" your account is offering to commit unauthorised access, often the same crime that cost you the account. Read hiring an "ethical hacker" to recover an account for the legal and practical picture.

"As a researcher who has filed vulnerability reports with Google, Meta, Amazon, Sony and 50+ other organisations, I can tell you there is no 'back" - end door' that outsiders can rent. Platform accounts are restored through the platform's own review systems. Anyone claiming private back-end access is either lying or describing a crime." - Md Shariar Shanaz Shuvon, Founder, AwareXone

#What do recovery scam messages actually say?

The wording changes, but these templates appear again and again. Treat any of them as a red flag:

• "I got my account back with the help of @[handle], he's legit, message him."
• "Your account has violated our copyright policy and will be deleted in 24 hours. Appeal here: [link]."
• "This is Meta Support. We noticed unusual activity. Verify your identity with the code we just sent."
• "I work with Instagram's security team and can restore any disabled account. Fee is $X, half upfront."
• "Send your username and password so I can check whether the account can be recovered."

AwareXone covers the fake copyright variant in fake copyright violation messages.

#How do scammers find victims?

• Public posts and comments. Writing "my account got hacked" on another platform, or in a group, signals that you're looking for help.
• Hashtags and keywords. Scam accounts monitor terms like "hacked", "disabled" and "recover".
• Search results and ads for phrases like "Instagram support number" or "recover Facebook account".
• Lists of earlier victims. The FTC says scammers buy, sell and trade lists of people who've already been scammed (FTC).

The safest way to ask for help publicly is to warn friends that you've been hacked without asking for "recovery" recommendations, and to switch off DMs from strangers if you can.

#How can I protect older family members?

Older relatives can be targeted twice: first through the hack, then through the fake "recovery." A few simple rules help:

• Agree as a family that nobody shares login codes, whoever asks.
• Tell them that Meta, Instagram and Facebook don't phone people to fix accounts. Meta says it has no general public customer-service phone number (Meta).
• Give them one trusted person to call before they pay anyone or click a "verify" link.
• In Malaysia, save 997 and the bank's hotline in their phone.