Scammed? What now
NLEN
Scammed? What nowUpdated

My account (game, Instagram, e-mail) has been taken over. What now?

Do this now

Short answer

If money has left your bank account or credit card, call your bank first. Then get your e-mail account back, because it unlocks almost everything else. Warn your contacts through another channel not to pay if someone asks for money in your name.

What should I do now?

  1. Call your bank if money has gone

    Do you see payments you did not make, or was your bank card or credit card saved in the hijacked account? Call your bank or card company straight away and have your card blocked. Veilig Bankieren, the Dutch banks' safety site, lists the banks' reporting numbers. Report a payment you did not make without delay, and in any case within 13 months of the debit (art. 7:526 Dutch Civil Code).

    Source: veiligbankieren.nl (opens in a new window)

  2. Warn your contacts through another channel

    Whoever has your account can pose as you in chats and groups. According to the Dutch police, e-mails that criminals send in your name often contain a payment request. Call or text family and friends, or ask someone else to message them: do not pay, and if in doubt, call you on the number they already have. Has someone already paid? Then they call their own bank right away.

    Source: fraudehelpdesk.nl (opens in a new window)

  3. Get your e-mail account back first

    Your e-mail unlocks almost every other account, so start there. If you can still log in, choose a new, strong password you use nowhere else. If you are locked out, use your provider's recovery page: Google's account recovery page for Gmail, Microsoft's sign-in helper for Outlook and Hotmail. Microsoft advises scanning your computer for viruses first and only then changing your password. The Dutch police see criminals set up forwarding rules, for example for e-mails containing the word ‘invoice’. So check your rules and the Deleted Items and Archive folders too. Check your recovery e-mail address and recovery phone number, and remove devices you do not recognise.

    Source: politie.nl (opens in a new window)

  4. Re-register WhatsApp with the SMS code

    Register your phone number in WhatsApp again and enter the 6-digit code you receive by SMS or phone call. Everyone using your account is then logged out automatically. Changing your password alone does not remove the other person. Does WhatsApp ask for a PIN you never set? Then the other person turned on two-step verification: wait 7 days and try again. Do not report your account as hacked before you have recovered it, because WhatsApp may then suspend it. Afterwards, turn on two-step verification yourself and log out of all linked devices.

    Source: faq.whatsapp.com (opens in a new window)

  5. Recover Instagram or your game account through the official form

    Instagram: check your e-mail for a message from security@mail.instagram.com about a changed e-mail address. The option in that message to secure your account may let you undo the change. If that does not work, request a login link through Forgot password?, or ask Instagram for support. Epic Games, for example for Fortnite: secure your e-mail first, try logging in with a linked account such as PlayStation, Xbox or Nintendo Switch, and otherwise submit an account recovery request to Epic. For other games, use the recovery form in that game's official help centre.

    Source: help.instagram.com (opens in a new window)

  6. Secure your other accounts

    Did you use the same password anywhere else? Change it there too and pick a different password for every account, for example with a password manager. Turn on two-step verification wherever you can. Switch off buy-now-pay-later in your webshop accounts and check whether a different phone number or address has been added there. Have your computer or phone checked for viruses and keyloggers.

    Source: fraudehelpdesk.nl (opens in a new window)

  7. Report it to the police

    Breaking into someone's account is computer trespass, a crime under art. 138ab of the Dutch Criminal Code. For a hacked e-mail account or a hijacked WhatsApp account, the police ask you to call 0900-8844 to make an appointment. If your account was used to scam others, you cannot report that online. You can also ask the police to come to you; they can help secure digital traces. Fill in the police preparation form beforehand and bring it to the appointment: there is one for a hacked e-mail account and one for a hijacked WhatsApp account (both in Dutch).

    Source: politie.nl (opens in a new window)

  8. Report it to the Fraudehelpdesk, and to the CMI if your ID was in it

    The Fraudehelpdesk, the Dutch fraud helpline, gives personal advice if you have been hacked, and you can report what happened there (088-786 7372). Was a copy of your passport or ID card on your device or in the account? Then also report it to the Identity Fraud Reporting Centre (CMI) of the National Office for Identity Data (RvIG). The CMI gives advice and, where needed, mediates with partners such as the police, the vehicle authority RDW or the Tax Administration.

    Source: fraudehelpdesk.nl (opens in a new window)

Will I get my money back?

Did someone pay with your bank account or card without your permission, for example with a card saved in your account? Then your bank must refund the amount, at the latest by the end of the next business day after you report it (art. 7:528 Dutch Civil Code). You only bear the loss yourself if you acted fraudulently, intentionally or with gross negligence (art. 7:529), and the bank has to back that up with evidence (art. 7:527). Once you have reported it to your bank, new misuse of your card is no longer at your expense, unless you committed fraud yourself (art. 7:529(4)). On top of that, every bank has its own goodwill policy. If you disagree with your bank, you can complain to Kifid, the Dutch financial services complaints institute.

For a credit card, call the card company. If someone bought something through your Google account, report it to Google as an unauthorised transaction. In-game currency and items do not always come back: Epic Games gives no compensation when an account has been taken over.

If your contacts transferred money themselves, including through iDEAL or a Tikkie payment request, the banks' rule of thumb is that they generally do not get it back; they should call their own bank at once and report it to the police.

If someone ordered through your webshop account, tell the webshop straight away.

Whether you get everything back depends on your situation.

Make your letter

Fill in your details and you get a letter or summary that you check and send yourself. FFCheck sends nothing and files no police report or notification for you.

Read in the Is Dit Veilig? guide how this scam works and how to recognise it next time.

Read the guide

Problem by problem, which organisation to call or e-mail: FFCheck’s Bij Wie? (Who do I contact?).

Open Bij Wie?

Living in another European country? The ffcheck.eu contact finder names the right organisation for each country.

Official help

  • Your own bank

    Blocks your card and refunds a payment you did not make. Veilig Bankieren lists the banks' reporting numbers.

    veiligbankieren.nl

  • Dutch police (Politie)

    Takes your report of computer trespass. Make an appointment or ask the police to come and secure digital traces.

    0900-8844 politie.nl

  • Fraudehelpdesk (Dutch fraud helpline)

    Personal advice if you have been hacked or are not sure. You can also report fraud here.

    088-786 7372 fraudehelpdesk.nl

  • Identity Fraud Reporting Centre (CMI, RvIG)

    Report, advice and mediation if a copy of your ID has ended up in the wrong hands.

    rvig.nl

  • WhatsApp Help Center

    Steps to get your account back with the 6-digit code.

    faq.whatsapp.com

  • Instagram Help Center

    Undo an e-mail change, request a login link and get support for a hacked profile.

    help.instagram.com

Frequently asked questions

Can I report a hacked account to the police?

Yes. Breaking into someone's account is computer trespass (art. 138ab Dutch Criminal Code). For a hacked e-mail account or a hijacked WhatsApp account, the police ask you to call 0900-8844 to make an appointment. If your account was used to scam others, you cannot report that online. Bring the police preparation form, filled in.

My friends got a payment request in my name and paid. What now?

They call their own bank straight away and report it to the Fraudehelpdesk. They can file an online police report themselves for this kind of fraud by someone posing as a friend or relative. If they transferred the money themselves, the banks' rule of thumb is that they generally do not get it back. At the moment that is really only possible if they reported it to the police, the police arrest a suspect and the case goes before a judge.

WhatsApp asks for a PIN I never set. What should I do?

Then someone else turned on two-step verification. Wait 7 days and try again. Even without the PIN, the other person is logged out automatically as soon as you enter the 6-digit SMS code.

Can the intruder read my old WhatsApp chats?

Not according to WhatsApp: your messages are stored on your own phone, so someone who registers your account on a new device cannot see your existing chats. Criminals can sometimes still read along through linked devices, though. So log out of all linked devices.

Will I get my in-game currency and items back?

Not always. Epic Games gives no compensation, such as in-game currency or cosmetics, when an account has been taken over. Recover your account first. If something was bought with your credit card or bank account, report it to your bank. For other games, check that game's help centre.

Instagram is asking for a video selfie. Is that real?

It can be. If you ask for support yourself for an account with photos of you, Instagram may ask for a video selfie in which you turn your head in different directions. You receive the next steps by e-mail from Instagram. According to Instagram, the video is never visible on Instagram and is deleted within 30 days.

Official sources

Last checked: 27 October 2026

Other situations