Hacked WhatsApp or Facebook Account: Recovery and FIA Complaint Process

Account takeovers in Pakistan almost always follow one of two patterns: the victim is tricked into sharing a six-digit verification code, or a weak and reused password is compromised. Neither is exotic, and both are recoverable if you act quickly. The urgent part is rarely the account itself; it is the messages the attacker is sending to your contacts in your name.

Recovering a hijacked WhatsApp account

1. Reinstall and re-register. Install WhatsApp and register your number again. You will receive an SMS verification code. Entering it signs the intruder out, because a number can be active on only one phone.
2. Never share the code. If someone messages claiming they sent it by mistake and asking you to forward it, that is the attack.
3. Enter your two-step PIN if you had one. If the attacker set their own PIN, there is a waiting period before you can reset it - frustrating, but the account does come back.
4. Turn on two-step verification immediately once you are back in, and add your email so a reset is possible.
5. Check linked devices and log out anything you do not recognise.
6. Warn your contacts and groups that messages sent during the period were not from you.

The single most common WhatsApp takeover in Pakistan is the verification code scam: a message from a hacked contact you trust, saying they accidentally sent you a code, asking you to send it back. That code is your own login. Never forward it to anyone for any reason.

Recovering Facebook and Instagram

1. Use the official recovery flow from the login screen, not a link sent to you.
2. Try every registered contact point - old email addresses and phone numbers you may have forgotten are attached.
3. Use identity verification where the recovery flow offers it, which may involve submitting an identity document.
4. If email and password were both changed, use the platform's compromised-account report route, which handles exactly this scenario.
5. Once back in, change the password, enable two-factor authentication, review active sessions, and remove any unfamiliar connected apps, admin roles or recovery contacts the attacker added.

Where the attacker has taken over a business page or removed you as admin, the commercial stakes are higher and the recovery path is different. Document your ownership - business registration, ad account and billing records - before you start, as you will be asked to prove it.

Containing the damage

Do this in the first fifteen minutes, ahead of the recovery if necessary. The attacker's business model is not your account; it is your contact list.

• Post a warning from any channel you still control - another platform, a group, a message from your spouse's phone.
• Tell people the specific scam: "My WhatsApp was hacked. If you got a message from me asking for money or a code, it was not me."
• Change passwords everywhere the same password was reused, starting with your email, which is the master key to everything else.
• Check your bank and wallet accounts for unfamiliar activity, and act on the banking channel immediately if there is any.
• Check password reset emails in your inbox for other services the attacker may have targeted.

When to involve the FIA

Recovery alone is enough for many cases. Report to the FIA where:

• Money was obtained from you or from your contacts using the account.
• Your identity or images are being misused to defraud or harass others.
• You are being blackmailed with material taken from the account - see blackmail and sextortion.
• A business account with commercial value has been taken over.
• The account cannot be recovered and is still being used against you.

Unauthorised access to an information system is itself an offence under PECA, independent of any money lost. File through the portal or on 1991, following our online complaint walkthrough, and attach screenshots of the fraudulent messages, the recovery correspondence and any transaction records.

Making it not happen again

• Two-factor authentication on everything, and a two-step PIN on WhatsApp. This alone defeats most takeovers.
• Never share a verification code. There is no legitimate reason for anyone to ask.
• Unique passwords, particularly for your primary email, which controls every reset.
• Do not log in from links sent by message. Type the address or use the app.
• Review linked devices and connected apps periodically.
• Treat urgency as a warning sign. "Send it quickly" is the oldest lever in the toolkit.

Start with your email, not the social account

People instinctively rush to recover the account they noticed was compromised. That is usually the wrong order. Your primary email address is the master key: it can reset almost every other account you own, including banking apps.

Work outwards in this sequence:

1. Email first. Change the password, enable two-factor authentication, and review forwarding rules and recovery addresses. Attackers frequently add a silent forwarding rule so they keep receiving your reset codes even after you change the password.
2. Then banking and payment apps. Change credentials and check for new registered devices or beneficiaries.
3. Then the compromised social account.
4. Then everything sharing that password. If a password was reused anywhere, treat all of those accounts as compromised.

Check for a hidden email forwarding rule specifically. It is the single most commonly missed step, and it silently defeats every password change you subsequently make.

If a business account or page is taken over

Commercial takeovers are handled differently and the stakes are higher, because the attacker may be running ads on your payment method or messaging your customers.

• Stop the spend. Contact your bank or card issuer to block the card attached to the ad account. This is the immediate financial exposure.
• Gather ownership proof before you start - business registration, NTN, the original email used to create the page, ad billing history and invoices. You will be asked to establish ownership.
• Use the business recovery route, not the personal one.
• Notify customers publicly through another channel, since the attacker may be soliciting payments in your name.
• Report to the FIA, as commercial loss and customer fraud materially strengthen the case for investigation.

Where your brand is being impersonated rather than your account taken over, a registered trademark makes platform enforcement significantly easier - see trademark registration in Pakistan.

Frequently asked questions