I sent a passport photo or financial details to someone claiming to restore Instagram or Facebook. What now?
The short answer
Stop sending information or money. A copied ID creates a risk beyond your social account, but exposure alone does not prove someone has already used your identity. Work with the actual document issuer and any affected bank. Changing your Instagram password does not retrieve a passport image.
What this answer is based onWhat to do
If the first contact cannot help, request the issuer’s or bank’s specialist fraud/identity team and a written next step. Keep dates and references. Handle shared passwords, installed recovery software and social-account access in the linked guides in parallel. Never pay the scammer to “erase” your documents.
- Prepare a private incident record: when you sent the material, the profile or website address, what types of documents or numbers were visible, and whether you still hold the originals. Save relevant messages and payment references securely. Separate a document copy, a physically missing document, bank/card details and a password or login code. Do not post scans or complete numbers in comments, public reports or recovery forums; do not delay an urgent bank call to finish the record.
- Contact the institution responsible for each exposed item through its own app, the number on your card or an independently found official website. Tell the document issuer that a copy or number was disclosed and ask what applies to that exact document; do not report the physical passport lost if you still have it. Ask an affected bank about protective action and disputed activity. Request a case reference, a safe evidence-submission route and any deadlines. Do not accept a contact number supplied by the suspected scammer.
- Choose a local identity-protection route, not a universal “Meta identity recovery” service. US: use IdentityTheft.gov/databreach for exposure guidance and IdentityTheft.gov for actual misuse; the linked FTC credit-freeze guide explains the US process. Australia: consult the Australian Passport Office source for passport exposure and its contact route. Elsewhere, ask your issuing authority and bank for the applicable national reporting and credit-file options. Keep checking relevant statements and notices. If an unfamiliar account or debt appears, contact that institution’s fraud team with your record and follow the local identity-theft procedure; do not wait for a social-platform reply.
The situation
A supposed support agent requests a passport photo, a selfie holding it and a bank statement to “verify” an account restoration. You later discover that the recipient was not the service you intended to contact.
The situation and an improvement
You focus only on changing the social password and assume the document is safe.
You record the exposure and follow up with the institutions that can address the affected documents and accounts.
More examples
Only a passport image was sent
The original is still in your possession, and you have not noticed misuse.
What to do
Describe this as disclosure of a copy to the issuer. Ask about your document’s options without making a false lost-passport declaration.
An unfamiliar loan notice arrives
Weeks later, a lender contacts you about an application you did not make.
What to do
Find the lender’s official fraud contact independently. Dispute the application, preserve its reference and use your country’s identity-theft reporting route.
What this answer is based on
FTC · What To Do if You Were Scammed (United States)consumer.ftc.govFTC · Credit freezes and fraud alerts (United States)Australian Passport Office · Data breaches and scams (Australia)FTC · Exposed-information guidance (United States; linked by FTC) · Full source review pendingFTC · Identity-theft reporting and recovery (United States; linked by FTC) · Full source review pendingPrimary source readReview details
Source reviewed:
We read the official source listed for this topic. Other Meta rules are reviewed separately.
Checked 11 November 2026: FTC scam-response and credit-freeze pages and the Australian Passport Office data-breach/scam page were read. US and Australian routes are jurisdiction-specific; no worldwide replacement rule is claimed. IdentityTheft.gov destinations are linked by the FTC, but their interactive forms were not readable or tested. The preparation, ordering and examples are ClearRules advice, not tested bank or Meta workflows.
Include the guide link, language and wording that needs checking. Add an official source link if you have one. Do not send passwords, login codes or photos of identity documents.
Examples are made up to explain the guidance. Meta decides individual account and content cases.
Sources and related topicsPolicy Graph · Demo in development