Posted on

Account-recovery impersonation that targets users already locked out

A person who cannot get into an account is unusually easy to sell a shortcut to.

The problem is immediate. The account may contain years of photos, messages, customers, contacts, saved work, or access to other services. Normal help pages suddenly feel slow, repetitive, and useless.

That is exactly when an unsolicited “recovery expert” sounds most believable.

The Federal Trade Commission’s guidance for hacked email and social-media accounts says that if you cannot log in, use the provider’s own account-recovery instructions. Its recovery guidance links directly to the official processes for major services rather than to third-party helpers.

See the FTC’s guidance for hacked email and social-media accounts.

Meta similarly directs hacked Facebook users to its own recovery flow at facebook.com/hacked, preferably from a device previously used with the account.

See Facebook’s official hacked-account recovery page.

The impostor sells certainty during uncertainty

A fake recovery helper may claim to have an internal contact, special tool, administrator access, or guaranteed method the public does not know about.

The requests that follow are the important part.

A scammer may ask for an upfront fee, a password, a login code, a backup code, personal identity information, or access to the victim’s email. Those are not proof that recovery is underway. They may simply create a second compromise on top of the first one.

The FTC warns broadly about recovery scams in which people claiming they can fix an earlier loss demand advance fees or personal and financial information.

See the FTC’s guidance on refund and recovery scams.

Start recovery from a place you already trust

The safest recovery path begins with the service itself: its app, a bookmarked help center, or a domain you independently type or verify.

Do not use a phone number, link, username, or “specialist” supplied by a stranger who found your public complaint. Do not hand over one-time codes. A recovery code is often equivalent to a key.

Account-recovery scams are unusually cruel because they arrive after the victim already has a real problem.

The scammer does not need to invent the emergency.

The lockout is real.

The scam is the stranger claiming to be the only person who can make it disappear.