Hacked Instagram or Facebook in Australia: ReportCyber or IDCARE?

Here's the right order in Australia.

Last checked: 29 October 2026 against the sources listed at the end of this guide.

#Where do I report?

Each service does a different job, and none of them replaces the others. Meta is the only party that can give you back control of an Instagram or Facebook account. ReportCyber, run by the Australian Signals Directorate's Australian Cyber Security Centre, records cybercrime and incidents so they can be assessed and passed to police. IDCARE is a not-for-profit identity and cyber support service that helps you work out what personal information is at risk and builds a response plan with you. Your bank is the only one that can stop or chase a payment.

The order matters because the first hour after a takeover is when the attacker is most active. They often change the email, phone number and password, turn on their own two-factor authentication, and then message your followers with fake investment offers or requests for verification codes. Every minute you spend filling in a police form before securing the account is time they can use to lock you out further.

#What should I do first?

1. Recover the account.
2. Call your bank if needed.
3. Report to ReportCyber.
4. Contact IDCARE about identity risks.

Related guides: Instagram or Facebook Hacked in the UK: Should I Report It to Report Fraud?, Social Media Account Hacked in the UAE: Where Do I Report It to the Police?, Instagram or Facebook Hacked in Singapore: Where Do I Report It and Who Can Help Me Recover?.

#How do I recover the account through Meta?

For Instagram, check your email for a message from security@mail.instagram.com saying your email address was changed. Instagram says you may be able to undo the change by selecting the secure my account option in that message. If that does not work, tap Forgot password on the login screen and request a login link to your email or phone. If you no longer control either, follow the on-screen steps to request support, where Instagram may ask for a video selfie of you turning your head if the account has photos of you. Instagram says that video is never shown on the account and is deleted within 30 days.

For Facebook, use the Recover a hacked account flow in the Facebook Help Centre from a device and network you have used before. Facebook asks you to secure the account, review recent changes to your email, phone and password, and log out sessions you do not recognise. Once you are back in, turn on two-factor authentication with an authenticator app rather than SMS where you can.

#What should I put in a ReportCyber report?

• The account name and the profile link.
• The date and time you lost access, in Australian time.
• Every email or text you received from Meta about changes to the account, with screenshots.
• Any messages the attacker sent to you or your followers, including payment requests or threats.
• Bank or card transaction details if money was taken, plus the reference number your bank gave you.
• What you have already done, such as the Meta recovery request and the date you submitted it.

Keep the ReportCyber reference number. Your bank, your employer or IDCARE may ask for it, and it helps if the same attacker targets other people. ReportCyber will not restore your account or contact Meta for you, so do not wait on it before you finish the recovery steps.

#When should I contact IDCARE?

Contact IDCARE when the attacker may have seen or used personal information beyond the social media account itself. Common examples are a copy of your driver licence or passport stored in your messages, your date of birth and address on the profile, or reused passwords that also open your email or online banking. IDCARE can help you work out which documents and accounts to protect next. eSafety also notes that IDCARE can help people recover from scams, identity theft and other cybercrimes.

If someone is threatening to share intimate images or is using your account to bully someone, report that to eSafety as well. eSafety has powers for image-based abuse and cyberbullying that the other services do not have.

#What common mistakes should I avoid?

• Reporting but not recovering.
• Skipping the bank call.
• Ignoring identity risks.
• Paying 'recovery' services that promise results.

The most common avoidable loss we see is a person who reports the crime, waits for a reply, and only tries Meta's recovery flow days later, after the attacker has removed every recovery option. The second is paying someone who contacts you after you post about the hack. Real recovery never starts with a stranger asking for your login code, a fee in cryptocurrency, or remote access to your phone.

#How do I keep the account safe while I sort this out?

• Never share a login code, password or backup code with anyone, including people who say they work for Meta, the police or a recovery service.
• Make sure the email address and phone number on the account are ones you still control, and remove any you do not recognise.
• Turn on two-factor authentication where the platform offers it, ideally with an authenticator app, and keep your backup codes somewhere offline.
• Log in only from the official app or by typing the address yourself, not from links in messages, comments or ads.
• Keep screenshots of every notice, email and step you take, with dates, in case you need them for a review or a report.
• Make one careful attempt at each official step rather than many rushed ones, because repeated failed attempts can trigger extra checks.

#When It Is Safer to Get Expert Help

Ask for help before you appeal if the account matters to your income, your business or your memories, if you have already had one appeal rejected, or if you cannot tell whether the problem is a bug, a restriction or a hack. That is where most avoidable losses happen.

AwareXone is independent and not affiliated with Meta, Instagram, Facebook, WhatsApp or Threads. Recovery work is best-effort and the platform makes the final decision.

• The attacker has already changed the email, phone number and two-factor settings, so the login link goes to them.
• The account runs a business, takes bookings or has ads with a saved payment method.
• Meta has disabled the account because the attacker posted content that breaks the rules.
• You have already submitted a video selfie or appeal that was rejected.