Jika akaun anda kena hack, amankan e-mel dan nombor telefon di sebalik akaun itu dahulu, kerana sesiapa yang mengawalnya boleh menetapkan semula akaun. Kemudian gunakan laluan pemulihan rasmi platform itu dan beri amaran kepada rakan. Jika wang hilang, hubungi bank dan Pusat Respons Scam Kebangsaan segera. Jangan kongsi kata laluan atau kod log masuk. Hanya platform yang boleh memulihkan akaun.
Summary
If your account kena hack, secure the email inbox and phone number behind it first, because whoever controls those can reset the account again.
Then use the platform's own recovery route: facebook.com/hacked, instagram.com/hacked, the WhatsApp login code, TikTok's help form or Google's account recovery page.
Warn friends and family from a channel you still control, because attackers often use a taken account to ask your contacts for money or codes.
If money left your account or you shared a code, call the National Scam Response Centre on 997 and your bank quickly, then make a police report.
Never give a password, login code or backup code to anyone who offers to help, and do not pay people selling quick recovery.
Only the platform can return the account, and some accounts do not come back, so keep screenshots of everything from the start.
Your friend messages you: "Eh, kenapa you minta pinjam duit?" You never sent that message. You try to log in to Facebook and the password no longer works, or WhatsApp suddenly asks you to verify your number again. You type "akaun kena hack apa perlu buat" into Google, which is how you got here.
Most takeovers can still be fought through official routes if you move in the right order. Secure your email and phone first, then use the platform's own hacked-account page, then warn your contacts and report any money lost. Every major app has a free recovery route, and none of them needs a stranger to hold your password.
This guide covers the first steps for every app, the official link for Facebook, Instagram, WhatsApp, TikTok and Google, the Malaysian agencies to call, and the scams that follow a hack.
Start with the account that can reset all the others, which is usually your email, and change its password and sign out every other session. Then go to the platform's official recovery page, such as facebook.com/hacked or instagram.com/hacked, from a phone or computer you have used on that account before. Tell your contacts not to send money or codes to your account. If money has already left your bank or e-wallet, call the National Scam Response Centre on 997 and your bank straight away, then make a police report. The platform decides whether the account comes back, and nobody outside it can promise a result.
A hack means someone else controls or is using your account. A lockout means you cannot get in, but nobody else is inside. The difference matters, because a forgotten password needs a normal reset while a hack needs the platform's hacked-account route.
Your profile picture, posts or messages changed and you did not do it.
Your password or two-factor authentication suddenly stops working.
You got an alert about a login, or an email saying your email, phone or password changed, and it was not you.
Settings show a device or location you do not recognise.
If the account shows a notice saying it was disabled or suspended, that is the platform's own decision, and it needs an appeal rather than a hacked-account report.
This is stressful, and the order matters more than speed.
Secure your email. Change the password, sign out of all other sessions, and remove any forwarding rules or filters you did not create. Google's Malay help page on a hacked Google Account tells Gmail users to check forwarding, filters and labels for exactly this reason.
Check your phone. If your SIM suddenly shows no service, call your mobile carrier from another phone and ask whether your number was moved to a new SIM. Login codes sent by SMS go wherever the number is.
Look for the platform's security email. Facebook and Instagram both send a message when the email on the account changes, with a link that can undo the change. Use that link only if it arrived in your own inbox.
Open the official recovery page for the app, using the table below.
Warn your contacts from another account, a phone call or a message on a different app. Ask them to ignore any request for money, codes or votes.
Screenshot the alerts, the changed details and any scam messages sent from your account, with the date and time visible.
Facebook's help centre sends every hacked-account case to www.facebook.com/hacked, and it asks you to use a device you have logged in from before. Facebook recognises that phone or laptop, which helps it trust the request.
If the attacker changed your email, check your old inbox first. Facebook says that when an email is changed, it sends a message to the previous address with a special link that reverses the change and secures the account. Once you are back in, open "Where you're logged in" in your settings and log out any device you do not recognise. If you no longer have the email or phone on the account, the same help hub has a route for that case, and our guide to Facebook account recovery covers it step by step.
#Instagram Kena Hack: Login Links and Identity Checks
Instagram's page on a hacked profile starts with your inbox. If you got an email from security@mail.instagram.com saying your email address was changed, select "secure my account" in that message to try to undo it.
If that fails, tap "Forgot password?" and ask for a login link to your email or phone. If you have lost both, Instagram lets you request support from a mobile device. It may ask for the email or phone you signed up with and the type of device you used then, or, for an account with photos of you, a video selfie turning your head. Instagram says that video is never shown on Instagram and is deleted within 30 days.
Instagram's announcement of instagram.com/hacked says the page lets you choose whether you were hacked, forgot your password, lost two-factor access or had the account disabled, then follow the steps for that case.
Most WhatsApp takeovers in Malaysia start with a message asking you to forward a six-digit code, often from a friend's number that was itself taken. At the time of writing, WhatsApp's help page on recovering a compromised account describes this route:
Open WhatsApp on your own phone and tap "Log back in", then continue.
Enter your full phone number, with the +60 country code.
Enter the 6-digit code that WhatsApp sends to you by SMS or phone call. WhatsApp says this logs out every device that was using your account.
If WhatsApp then asks for a two-step verification PIN you never set, the attacker probably set it. WhatsApp says to wait 7 days and try again, and that the attacker is logged out once you enter the SMS code either way. It also says an account cannot be recovered without a SIM card holding the same number. Our guide to a stolen WhatsApp verification code covers the scam scripts in detail.
On TikTok, try "Forgot password?" first. If the attacker changed the email or phone, TikTok's page on email and phone number problems says to tap "Need more help?" in the app and fill in a form that helps it verify your identity, and that the process may take up to 30 days. Answer with the details you really used on the account. Once you are back in, TikTok's privacy and security guide recommends turning on 2-step verification.
For Google, the same Malay help page sends you to the account recovery page if you cannot sign in, and asks you to answer its questions as well as you can. If you can still sign in, open "Semak peristiwa keselamatan" (Review security events) and choose "Tidak, bukan saya" (No, it wasn't me) for anything you did not do.
#Duit Hilang atau Kod Dikongsi? Where to Report in Malaysia
If money was lost, speed matters more than the account. The government's NSRC 997 page asks victims to call within 24 hours of finding out so banks can block transactions, and then to contact the bank and make a police report.
Malaysian reporting channels after a hack, at the time of writing.
What happened
Who to contact
Money left your bank or e-wallet, or a friend paid the attacker
NSRC on 997 and the bank involved, then a police report
The account was taken and is being used to cheat people
A police report; MCMC lists hacking under the Computer Crimes Act 1997 and cheating by personation as matters for PDRM
You want to report the security incident itself
Cyber999 at CyberSecurity Malaysia
Your SIM stopped working without warning
Your mobile carrier, from another phone
Cyber999 is CyberSecurity Malaysia's national point of contact for reporting computer security incidents. It takes reports by online form, by email to cyber999@cybersecurity.my, by phone on 1-300-88-2999 during office hours, and through its mobile app. MCMC's complaint page is where hacking is mapped to PDRM. A report does not restore the account, but it creates a record. Our guide to reporting a hacked account in Malaysia walks through each channel.
A hack is often step one. Step two uses your name to reach people who trust you, or targets you while you are desperate to get back in. Watch for messages like these:
"Sorry, saya tersalah hantar kod ke nombor you. Boleh forward balik?" This is how many WhatsApp takeovers start. The code is for your account.
"Tolong undi anak saudara saya" with a voting link that asks for your phone number and code.
"Urgent, boleh pinjam duit dulu? Esok bayar" sent from your taken account to your contacts.
A "Meta Support" or "Page Violation" message warning that your account will be deleted unless you log in through a link.
Comments and DMs from "recovery experts" or "hackers for hire" who promise to get the account back for a payment.
Many people recover a hacked account on their own with the steps above. Outside help is worth considering when the account supports your income, when a hack has turned into a disable, or when you have tried the official routes and heard nothing. AwareXone, our recovery service, reviews what happened before anything is agreed, then tells you plainly which official routes are still open. We use the same platform processes described here and never ask for your password or codes. The recovery hub lists every platform we cover, and our Trust Center sets out how we work. Only the platform can restore an account, and some accounts do not come back.
Macam mana nak dapatkan semula akaun Facebook yang kena hack? (How do I get a hacked Facebook back?)
Go to facebook.com/hacked on a phone or computer you have used on that account before, and follow the steps. If the attacker changed your email, look in your old inbox for Facebook's message with a link that reverses the change.
WhatsApp kena hack, tapi saya masih ada SIM. Apa perlu buat? (My WhatsApp was hacked but I still have my SIM.)
Log back in to WhatsApp with your own number and the 6-digit SMS code, which logs out every other device. If it asks for a two-step PIN you never set, WhatsApp says to wait 7 days and try again.
Can I get my account back if the hacker changed the email and phone number?
Often, yes, but it takes longer. Facebook, Instagram and TikTok each have a route for people who lost both, usually an identity check or a form, and the platform decides whether it is enough.
Perlu buat laporan polis ke kalau akaun kena hack? (Do I need a police report?)
If money was lost or the account is being used to cheat people, yes: call 997 first if money moved, then make a police report. A report does not restore the account, but banks and platforms may ask for it.
Can AwareXone recover my hacked account?
No one outside the platform can restore an account, and we do not guarantee any outcome. AwareXone reviews your case, checks which official routes are still open, and helps you prepare accurate requests, without ever asking for your password or codes.
