First Identify What Happened on Social Media
The recovery path depends on the event. An account takeover means someone gained unauthorized access to your real account. Impersonation means a separate profile pretends to be you or your business. A marketplace or investment scam may involve a legitimate account, a stolen account, or a newly created identity. Harassment, sextortion, stalking, and threats add safety and evidence-preservation priorities.
Do not pay a stranger who claims to have a private platform contact or who promises to “hack back” the account. Use the platform's official recovery route, reached through its app or a website you navigate to independently. Preserve visible evidence before recovery steps change the profile, messages, sessions, or administrator list.
Recover the Email Account and Platform Access
Secure the primary email account first because it can reset many other accounts. From a trusted device, update security software, change reused passwords, review recovery email and phone details, remove unfamiliar forwarding rules and sessions, and enable multifactor authentication. The FTC's hacked account recovery guide explains these steps and links to major providers.
For Facebook, use the official Facebook hacked-account workflow, preferably from a previously used device. For Instagram, follow Meta's Instagram recovery instructions, which may offer login links, security codes, or identity verification depending on the account. Avoid search ads or messages claiming to be support; start inside the official app or known domain.
Contain Financial and Identity Harm
If money moved or a card was exposed, contact the financial institution or payment provider immediately through independently verified contact information. Ask whether the transaction can be stopped, recalled, disputed, or flagged. If identity data was disclosed, use IdentityTheft.gov to create a recovery plan and consider appropriate credit protections.
Notify contacts through a separate channel that the account was compromised and tell them not to click recent links or send money. Review connected apps, advertising accounts, saved payment methods, marketplace listings, business-page administrators, and account activity. CISA recommends multifactor authentication for social media and other important accounts; see its MFA guidance.
Preserve Evidence Before It Disappears
Record the profile and post URLs, usernames, display names, platform, messages with timestamps, login alerts, recovery emails, sender addresses, payment requests, phone numbers, linked domains, transaction identifiers, and visible account changes. Keep original email headers, message exports, and media where possible. Write a short chronology and note which actions you took.
A licensed investigator can compare aliases, reused usernames, phone and email indicators, domains, images, business claims, and lawful public records. The goal is a source-documented report for counsel, a platform, financial institution, insurer, or law enforcement—not unauthorized access. An investigator cannot compel private platform records, restore an account faster than the provider, or guarantee that the operator will be identified.
Where to Report a Social Media Scam
Use the platform's in-product reporting flow for the compromised, impersonating, or fraudulent account. Report consumer fraud through ReportFraud.ftc.gov and internet-enabled crime through the FBI Internet Crime Complaint Center. Contact local law enforcement for theft, stalking, extortion, intimate-image threats, credible violence, or other criminal conduct; call emergency services for immediate danger.
Keep report and ticket numbers with the evidence timeline. If the account is recovered, do not immediately delete the record of what occurred. Review security, notify affected contacts, and retain the material until payment disputes, platform reviews, insurance claims, or legal matters are resolved. Emerging Investigations can scope a social media scam investigation when attribution or documented loss analysis would change the next decision.