Your account was hacked. Then banned for what the hacker posted.
A hacked-then-banned account is two cases in one: ownership recovery and an enforcement appeal. Doing them in the wrong order is the most common way to lose both.
Short answer: recover ownership first, build a dated ownership file, then appeal the ban with a short chronology that separates the hacker's activity from yours. Ask the platform to preserve login logs. No private service can guarantee a restoration.
Two events, one case file
A takeover and an enforcement decision are different events, but the platform may only see the second one. The hacker posts, changes the email or runs an ad; the platform then restricts the account for what appears to be your activity. Your first job is to prove the account is yours. Your second job is to separate the hacker's actions from yours with dates.
This order matters. Arguing "it wasn't me" before ownership is restored usually gets a generic security reply, then a closed case.
Never send passwords, 2FA codes, recovery codes or remote access. A platform's official recovery flow will not ask for them by email or DM, and neither will we.
Build the ownership file first
Create one dated document before you open the next ticket. It should answer, in this order:
- Original identifiersThe first email and phone number on the account, the username, the display name and the creation date if you know it.
- How you used itDevices, locations, apps, business pages or ad accounts connected to it. Keep it factual.
- What the hacker changedNew email, phone, password, profile details, posts, DMs or ad spend — with screenshots and timestamps where you have them.
- Your recovery attemptsDates, case or ticket numbers and what the platform replied. Do not open dozens of duplicate tickets; keep the thread.
- Official proof you already haveReceipts, invoices, domain or page ownership records, previous ID verification results. Send identity documents only when an official process asks.
If you run a business, add a dated loss schedule: ads paused, orders missed, clients who could not reach you. A number with dates is evidence; a paragraph about stress is not.
Not sure this is the right channel for your case? A free diagnosis checks the notice, the account type and your country against the official route — before you send anything. Start here.
What to say in the ban appeal
Assume the reviewer has two minutes and no context. Write four short blocks, in this order:
- Ownership: "This account belongs to me; here is the original email/phone and the recovery case reference."
- The takeover: "On [date] I lost access; the following activity was not mine: [list]."
- The enforcement: "The ban cites [policy/post]. That activity came from the takeover, not from me."
- The ask: "Please preserve the login logs, review the enforcement in light of the takeover, and tell me what evidence you need."
Attach only the evidence the form accepts. Do not paste passwords, one-time codes or a full ID in an open text field. If the platform offers a secure identity-verification step, use that instead.
Ask for log preservation explicitly. Login and device records are time-sensitive. A short, dated request can be more useful later than another emotional appeal now.
Which channel, in which order
For a personal account, the sequence is usually: hacked-account recovery → secure the email → confirm you control the account → appeal the ban from the notice. If the platform offers a dedicated compromised-account form, use it rather than the ordinary disabled-account appeal.
For a business or ad account, add the business tools: page roles, ad account access, payment methods and Admin access. A hacked ad account can spend money while the personal profile looks fine. Pause spending and remove unknown admins only through the official business tools; keep screenshots before changing anything.
If the platform has already marked the ban "final", the ownership file still matters. Read what to do after a final decision before paying for any "recovery" service.
Evidence that helps — and evidence that hurts
Helps
A clear chronology; the recovery case number; screenshots of the changed email, phone or posts; login alerts; business records; a police report where local law makes it relevant; a calm one-page statement.
Hurts
Passwords or one-time codes in an email; a forged or edited screenshot; a second account used to "test" the ban; repeated duplicate tickets; a paid "recovery" service logging in from a new location.
Platforms and regulators may ask for identity documents. Send them only through the official, secure process of that platform or authority — never to a stranger who contacted you first.
Where this page stops and your case begins
This page gives you the general route. Your notice, account type, country and the steps you already tried decide the channel, the evidence and the deadlines. That is the part a general guide cannot do for you — and it is the part that decides whether the appeal is read or lost in the wrong queue.
- Free diagnosisRestriction type, the official channel that applies, and the first three evidence items for your case. Before you pay anything.
- Starter — $9The first appeal text and the first channel, for people who want to send it themselves.
- Self-Help — $29The full channel map (first appeal + escalation), evidence checklist, deadline calendar and two follow-up texts.
- Guided — $49Self-Help plus a human review of your case, a personalised appeal and one round of edits.
One-off, one case. Delivered by email in 1 business day (Guided: up to 3). 7-day refund if the pack is not delivered or started. We never ask for your password or account access, and we make no promise about the outcome. Paid services are 18+.
Frequently asked questions
Should I appeal the ban or recover the account first?
Recover ownership first. A ban appeal assumes the account is yours and that you control the login. If the hacker still controls it, use the platform's hacked-account recovery flow before arguing about the ban.
What proves ownership if the email was changed?
The original email and phone number, the account creation date, earlier recovery methods, purchase receipts, business records and a police report where local law requires one. Send identity documents only through the platform's official process.
Will the platform believe that the hacker posted it?
Sometimes, if the timeline is clear and the activity is consistent with a takeover. A concise chronology, the recovery case reference and a request to preserve login logs are more useful than a long story.
Can I create a new account while this is open?
It is safer not to. A new account on the same phone, email or device can be linked to the old one and treated as circumvention. Finish recovery and the ban appeal on the original account first.
Does a police report help?
In some countries and for some harms (fraud, impersonation, business loss) a police report creates an official record that a platform or regulator may ask for. It does not guarantee a restoration; ask local police or a lawyer whether it fits your case.
What if the ban is already final?
A final ban appeal decision does not erase the takeover. Keep the ownership file and read the routes after a final decision before paying anyone for 'recovery'.
Not sure which route still exists?
Tell us the platform, the exact notice and what you have already tried. The free diagnosis names the restriction type, the channel that can still answer and the evidence worth preparing. No password, no account access, no outcome promise.
Self-help only. We never ask for your password, we never log in to your account, and we make no promise about the outcome.
Official sources used on this page
- Instagram Help Center — compromised accounts (official recovery guidance)
- Facebook — secure a hacked account (official recovery flow)
- TikTok Support — account security (official help center)
- EUR-Lex — Regulation (EU) 2022/2065 (Digital Services Act) (Articles 20–21)
Official platform help pages, law or regulator information. Re-check them before relying on exact wording; every timeline here is an estimate.