Hacker Holding Your Account for Ransom? Don't Pay

Generally, no. Paying a hacker who's holding your account to ransom gives you no promise you'll get it back. It marks you as someone who pays, and it funds the next attack. The safer path is the platform's official recovery route (instagram.com/hacked, facebook.com/hacked, and so on), plus a report to the police or your national fraud reporting service, keeping all of the hacker's messages as evidence. If the threat involves intimate images, treat it as sextortion: stop engaging, don't pay, preserve evidence, and report it.

#Why paying usually doesn't work

• No enforcement. The hacker has no reason to keep their word once paid.
• Repeat demands. Paying shows you'll pay. "Unlock fees" and "final payments" often follow.
• Retained access. Even if they hand the account back, they may keep a session, add a backup email, or know your password patterns.
• Funding crime. Payments support the same networks that hack other people.

Regulators give similar advice about recovery-for-a-fee offers in general. The FTC warns that anyone who contacts you asking for an upfront fee to recover something you lost is a scammer (FTC).

"When someone has already paid a ransom or a 'hacker for hire', they typically still do not have the account, and they may have shared codes that deepened the compromise. Law enforcement and the FTC advise against paying. We pick up from securing email and using official recovery only." - Md Shariar Shanaz Shuvon, Founder, AwareXone

#What should I do instead?

1. Stop replying after you've saved the evidence. Don't argue or negotiate.
2. Screenshot everything: usernames, messages, phone numbers, crypto wallet addresses, payment instructions.
3. Secure your email and any account that shares the same password (NCSC).
4. Start official recovery:

- instagram.com/hacked - facebook.com/hacked - TikTok hacked-account help - WhatsApp compromised-account help

1. Warn your contacts that the hacker may message them as you.
2. Report the extortion (see below).

#Where do I report account ransom or extortion?

#What if they're threatening to leak photos or messages?

That's sextortion or blackmail, and it's a crime. The UK NCSC lists sextortion as one of the situations it gives individuals specific guidance on (NCSC). General steps:

• Don't pay, and stop engaging
• Preserve evidence, but don't share the images further
• Report to the police and to the platform
• Talk to someone you trust

AwareXone has a Malaysia-focused guide: sextortion on social media in Malaysia.

#What if they're selling my username back to me?

Attackers sometimes take over accounts with valuable handles and offer to "sell" them back. Same advice: don't pay. Use the official recovery flow with your original email or phone. See Instagram username stolen after hack.

#What if I already paid?

1. Contact your bank or payment provider right away.
2. Report the payment, with the wallet address or account details, to the authorities above.
3. Change passwords everywhere the hacker might have reached, starting with email.
4. Expect more demands, and don't pay again.
5. Watch out for "recovery agents" who promise to get your ransom back. See lost money to a recovery scammer.

#Can a recovery service negotiate with the hacker?

A legitimate one shouldn't. AwareXone, for example, works only through official platform processes, never negotiates with or pays attackers, never asks for passwords or OTPs, and doesn't promise outcomes.

#How do ransom demands usually arrive?

• A DM from your own hacked account to you, or to your contacts, saying "pay to get it back"
• An email from an address the attacker added to the account
• Messages on WhatsApp or Telegram after the attacker finds your number
• Threats to delete the account, post embarrassing content, or sell the username

Whatever the format, the advice is the same: save the evidence, don't pay, start official recovery, and report.

#What evidence helps police and platforms most?

• Screenshots showing the sender's username or number and the full demand
• Wallet addresses, bank details or payment links
• Dates and times of every message
• Security emails from the platform showing what the hacker changed
• Your report reference numbers

#How do I stop it happening again?

• A unique password for every account, kept in a password manager
• Two-factor authentication, or passkeys where available
• Never share login codes, even with "friends" or "support"
• A secure, separate email for important accounts
• Regular checks of active sessions and connected apps

#What about accounts held by ex-partners or ex-employees?

When the person holding your account is someone you know, like an ex-partner, a former employee or an agency, it's still unauthorised control, and demands for money are still extortion. Gather proof of ownership, use the platform's recovery and business support routes, and report threats to the police. See former employee holds company accounts.

#Bottom line

Don't pay. Save the evidence, recover the account through official routes, report the extortion, and lock down every account the attacker might reach next.

Last checked: 14 October 2026. Platform policies change; always confirm steps on the provider's own help pages before you act.

AwareXone works only through official platform channels, never asks for passwords or one-time codes, and states that platforms make the final decision. See the Trust Center and pricing for how a case review works.