Overview

Never send Support your password, verification code or reset link. If personal financial accounts are affected, contact the relevant provider directly.

Before You Submit a Report

This article focuses specifically on what to do if your account looks compromised. Start by completing “Secure the connected email or Google account first” and finish by checking “Contact Support from the registered email” against the result shown in the current Official.my interface. Treat a specific product message as more authoritative than a general explanation in this guide.

Continue with Report a fake profile for the next relevant part of this workflow.

Reporting Process

  1. Step 1: Secure the connected email or Google account first. Confirm it is complete before moving to “Reset an email-password credential when applicable”. Note any exact error shown.
  2. Step 2: Reset an email-password credential when applicable. Confirm it is complete before moving to “Sign out of shared devices”. Note any exact error shown.
  3. Step 3: Sign out of shared devices. Confirm it is complete before moving to “Record unexpected profile changes”. Note any exact error shown.
  4. Step 4: Record unexpected profile changes. Confirm it is complete before moving to “Contact Support from the registered email”. Note any exact error shown.
  5. Step 5: Contact Support from the registered email. Check the final what to do if your account looks compromised result from the user's perspective. Note any exact error shown.

Evidence and Safety Tips

  • Before you secure the connected email or Google account first, confirm that you are working with the intended account, profile or public URL.
  • When handling compromised account, change one relevant item at a time and note the visible result before continuing.
  • After you contact Support from the registered email, test the outcome independently rather than relying only on the editor, preview or previous browser tab.

Common Reporting Mistakes

  • Skipping the check to reset an email-password credential when applicable and assuming the next screen or public page will correct incomplete information automatically.
  • Repeating contact Support from the registered email rapidly when the first attempt is still processing, cached or waiting for a provider response.
  • Treating account recovery as proof of ownership, verification, delivery or commercial outcome when it is only one part of this workflow.

Need More Help?

Contact Official.my Support about “What to do if your account looks compromised” when you have completed the steps above and the same problem still occurs. Include the affected username or profile URL when relevant, the exact action that failed—especially contact Support from the registered email—the full on-screen message, and the approximate time. For this Security & Abuse topic, a safe screenshot showing the compromised account issue can help. Remove passwords, verification codes, reset links, private keys and unrelated personal information before sending anything.