Are account recovery services legit? How to tell a real provider from a scam

If you have lost access to an Instagram or Facebook account, you have probably already seen the offers: comments under your posts, DMs from strangers, ads promising your account back "in 24 hours". Some recovery services are real businesses. Many are not, and the people most likely to be targeted are the ones who just lost an account and are under pressure to get it back.

This guide explains how to tell the difference: the free official steps to try first, the red flags that should end a conversation, how to check a provider properly, and an honest answer to a question we hear a lot, which is whether paying in crypto is itself a warning sign.

Start with Meta's free, official routes

Before paying anyone, use the routes Meta provides. They are free, and for many people they are enough.

• Instagram: go to instagram.com/hacked on a phone or desktop browser. Instagram's help article If you think your Instagram profile has been hacked walks through the login link, security code and identity-check steps. The broader Hacked Instagram Account page collects the related articles.
• Facebook: go to facebook.com/hacked. Facebook's hacked account help page recommends doing this from a device you have used to log in before.
• Email changed? Both platforms send a message to the previous email address when the email is changed. Instagram's article on email changes explains that the message from security@mail.instagram.com contains a link to reverse the change.

If you want a step-by-step version, our guide on how to recover a hacked Instagram account covers the full flow.

What Meta itself says about scams

Meta does not publish a single page titled "recovery scams", but its own material points in the same direction:

• Instagram's Avoid getting scammed page lists people claiming to be from Instagram security and asking for account information, and strangers offering account verification services, as warning signs. It also says no reputable organisation will demand payment on the spot, and that Instagram does not DM you in the app about problems with your account.
• Facebook's page on suspicious emails says Facebook will never ask for your password in an email.
• In February 2026 Meta announced cease-and-desist letters to several companies it had previously worked with, describing their phony "un-ban" or account restoration services as abusive. That is a useful reminder that a claimed relationship with Meta is not proof of anything.

Red flags that should end the conversation

Any one of these is reason to walk away.

Our guide to phishing red flags on Instagram covers the messages hackers use to take accounts in the first place; many recovery scams use the same playbook.

How to verify a provider

If you do decide to get help, check these before you pay anything.

1. A real business identity. A website with a named business, terms of service, a privacy policy and a contact address that is not just a messaging handle.
2. A written scope. Before payment, you should receive in writing what they will do for your specific case: which account, which route, what they need from you, and what they cannot promise.
3. Refund terms in writing. Not a promise in a chat. A published refund policy that defines what "failed" means and how the refund is paid.
4. No password requests, ever. Ask directly: "Will you need my password or login codes?" The only acceptable answer is no.
5. Works through official channels. They should be able to explain which Meta forms or support routes they will use and why. Vague answers about "backend access" or "special methods" are a no.
6. Realistic language. Honest providers tell you when a case is weak, and decline cases they do not think they can win.

"Isn't paying in crypto a red flag?"

It is a fair question, and we would rather answer it head-on. Shilder takes payment in crypto only, and people are right to be cautious: crypto payments are hard to reverse, and scammers like them for exactly that reason. If you send crypto to a stranger's wallet with nothing in writing, there is usually no way to get it back.

So the payment method on its own does not tell you much. What makes a payment safe or unsafe is the arrangement around it:

• Where the money sits. Unsafe: sent straight to the provider's personal wallet. Safer: held in escrow until the outcome, so the provider cannot spend it before the work is done.
• What happens if recovery fails. Unsafe: "no refunds" or a vague promise. Safer: a full refund if recovery fails, with that written into a public policy.
• What they ask for. Unsafe: your password or login codes. Safer: no password collection at all.
• When the scope is agreed. Unsafe: pay first, find out later. Safer: written scope before you pay.

That is how we set up our own payments: the fee is held in escrow, it is returned in full if we accept a case and recovery fails, we never ask for passwords, and you see the scope before you pay. The details are on Protected payment and in our refund policy. Whatever provider you consider, hold them to the same standard. Pricing is on the pricing page.

When professional help makes sense

For most people, the official route is the right place to start and is often all that is needed. If Instagram's login link works, if the email-change message lets you reverse the change, or if the video selfie check goes through, you do not need to pay anyone.

Professional help is worth considering when:

• the official forms have been submitted correctly and nothing has moved for weeks;
• the account is tied to a business, ad accounts or a Business Manager, and downtime is costing money (see Meta Business Manager recovery);
• the hacker changed the email, phone and 2FA, and the self-serve steps keep looping;
• you are unsure which route matches your situation and do not want to burn attempts.

Our guide on when to hire a recovery service goes into this in more detail. If you are dealing with a hacked Instagram account specifically, see Instagram hacked account recovery. And whoever you work with, the rules above still apply: no passwords, nothing guaranteed, refund terms in writing, and official channels only.