In short. Use only the platform's official recovery page, change passwords starting with your email, turn on two-factor authentication and log out other devices. Warn your contacts. File a complaint on cybercrime.gov.in, and get an FIR if there is financial loss, extortion or misuse. Compensation can be claimed under section 43 of the IT Act before the state adjudicating officer for claims up to ₹5 crore.
This post is for people whose own account has been taken over: Gmail or Outlook, WhatsApp, Instagram, Facebook, X, LinkedIn or a business email account. It covers recovery, the legal remedies and the specific problems that follow a hack, such as messages to your contacts asking for money, a diverted business payment, or offensive posts made in your name. If someone has instead created a new fake account pretending to be you, our post on fake profiles and impersonation online deals with that. If the hacker is threatening to release private images, read sextortion and video blackmail alongside this one.
A hacked account feels like a technical problem, and the first hour is mostly technical. But it quickly becomes a legal one. The hacker may cheat your contacts, defame someone using your name, take money from your clients or demand a ransom. The steps you take early, and the record you create, decide how well you are protected when that happens.
- Main offences
- Sections 43, 66 and 66C of the IT Act 2000; section 66D for cheating
- Punishment
- Up to 3 years under sections 66 and 66C, with fine
- Where to report
- cybercrime.gov.in, 1930 for money loss, district cyber police station
- Compensation
- Section 43 claim before the adjudicating officer, up to ₹5 crore
- Platform route
- Official recovery page, then grievance officer and appeal
- Key evidence
- Security alert emails, login activity, screenshots of misuse
What should you do in the first hour after your account is hacked?
Work in this order: your email account, then the hacked account, then your contacts. Email comes first because it is the recovery address for almost everything else. If the hacker controls your email, they can reset your bank, social media and shopping passwords one by one. If you can still log in to your email, change its password immediately, turn on two-factor authentication using an authenticator app rather than SMS if you can, and use the 'sign out of all other sessions' option.
Then go to the hacked account's official recovery page. Do not search for 'recover hacked Instagram' and click on whatever comes up, and do not reply to anyone on social media who offers to recover your account for a fee. Those offers are almost always another fraud. Use the links inside the app or on the platform's own help centre.
Before you change too much, take screenshots of what the hacker has done: changed name or photo, new posts, messages sent, the email or phone number they added, and any security alert emails you received ('new login from Lagos', 'your recovery email was changed'). These alerts are some of the best evidence you will have, and people often delete them in panic.
Recovering the account through the platform
The details differ between Google, Meta, X and others, but the sequence is much the same. Do everything from a device the hacker has never had access to, if you can.
Try the normal password reset
If the hacker has not yet changed the recovery email or phone, a reset link or code will come to you. Use it at once and then change the recovery details back to yours.
Use the 'account hacked' or 'compromised' flow
Google, Meta and X each have a separate route for accounts taken over by someone else. It may ask for an old password, the original email, a code sent to a previous number, or a video selfie for identity verification. Answer as accurately as you can.
Check the email for change notices
When a recovery email or phone is changed, platforms often send a message to the old address with a link saying 'this wasn't me'. That link can reverse the change if you act quickly.
Lock down after recovery
Change the password, set up two-factor authentication, remove unknown devices and sessions, remove any apps or connected services you do not recognise, and check that the recovery email and phone are yours.
Undo the hacker's changes
Delete posts and messages they sent, remove admins they added to pages or groups, check ad accounts and payment methods linked to the account, and check email forwarding rules, which hackers set up quietly to keep reading your mail.
Escalate if recovery fails
If the automated process fails, write to the platform's grievance officer for India with your identity proof and the details. If that fails, an appeal lies to the Grievance Appellate Committee within 30 days of the platform's decision.
WhatsApp is slightly different: it is tied to your phone number. Re-registering WhatsApp on your own phone with your number logs out the other device. If the hacker set a two-step PIN, you may have to wait out the lock period before you can set it again. Ask your mobile operator to check that no duplicate SIM has been issued, because a SIM swap is a common way in.
Is hacking a crime in India? The offences that apply
Yes. Hacking into someone's account is both a civil wrong, for which compensation can be claimed, and an offence. The sections below are the ones that usually apply.
Section 43, IT Act 2000
Accessing a computer resource without permission, downloading or extracting data, introducing malicious code, damaging data, denying the owner access, and similar acts. The person responsible is liable to pay compensation to the person affected. This is the civil remedy.
Section 66, IT Act
Any act referred to in section 43 done dishonestly or fraudulently is an offence, punishable with imprisonment up to three years, or fine up to ₹5 lakh, or both.
Section 66C, IT Act
Fraudulent or dishonest use of another person's password, electronic signature or other unique identification feature. Imprisonment up to three years and fine up to ₹1 lakh. Logging in with your stolen password falls squarely within this.
Section 66D, IT Act
Cheating by personation using a computer resource, such as using your hacked account to ask your friends for money. Imprisonment up to three years and fine up to ₹1 lakh.
Section 66E, IT Act
Capturing or publishing images of a person's private area without consent. Relevant where private photographs are taken from a hacked account and shared.
BNS offences
Depending on what the hacker does: extortion under section 308 (pay or we leak your data), cheating under section 318, cheating by personation under section 319, criminal intimidation under section 351, and defamation under section 356 if false posts are made about someone.
Should you file a police complaint for a hacked account?
Yes, in almost every case, even if you have recovered the account. The minimum is a complaint on cybercrime.gov.in under the category for hacking or other cyber crime, which gives you an acknowledgement number and a dated record. Where there has been financial loss, call 1930 as well, because only the financial fraud reporting route sets off a freeze on the money.
Push for an FIR where the hacker has taken money from you or your contacts, demanded a ransom, threatened you, leaked private material, or used the account to commit another offence. The hacking offences under sections 66 and 66C are cognizable and bailable. Because they carry up to three years, the police may hold a preliminary enquiry of up to 14 days under section 173(3) BNSS before registering an FIR; a well-documented complaint makes that enquiry short.
The dated complaint matters for your own protection. If the hacker uses your account to post something defamatory or obscene, to cheat someone or to send threats, the first person the police will look at is the account holder. A complaint filed the day the account was taken over, with the security alert emails attached, is the strongest answer to the question 'how do we know it wasn't you?'
What the hacker did and the remedy that fits
| What happened | First step | Legal remedy |
|---|---|---|
| Account taken over, no misuse yet | Recover, secure, keep the alert emails | Portal complaint for the record |
| Messages to contacts asking for money | Warn contacts on every channel; ask payers to call 1930 | FIR under section 66D IT Act and section 319 BNS |
| Ransom demand to return the account or data | Do not pay; preserve the messages | FIR for extortion under section 308 BNS and section 66 IT Act |
| Private photos or chats taken and threatened to be leaked | Preserve threats; report on the portal at once | FIR; platform removal of intimate images within 24 hours |
| Defamatory or offensive posts made in your name | Screenshot, delete, post a short clarification | Complaint showing the hack; defence if accused |
| Business email used to divert a payment | Call the bank and 1930 within hours; tell the payer | FIR for cheating; recall request; civil claim if needed |
| Known person (ex-partner, ex-employee) accessed the account | Change all credentials; note how they had access | FIR and section 43 compensation claim |
The hacker is messaging my contacts for money. What now?
This is the most common misuse. The hacker sends your friends and relatives a message in your name: an emergency, a hospital bill, a payment stuck abroad, 'please send ₹20,000, I will return tonight'. Some contacts pay before they think to call you. Warn people on every channel the hacker does not control: a WhatsApp status from your recovered number, a post from another account, calls to close family, and an email to your contact list if your email is the hacked account.
Anyone who has already paid should report it themselves on 1930 straight away with the transaction details, because the freeze works on their transaction, not yours. They are the victims of the cheating, and they should be named in the FIR along with you. Our post on reporting and recovering money lost in a UPI fraud explains what they should do next.
Keep the messages the hacker sent in your name. Contacts can forward you screenshots. These show the pattern, help the police identify the receiving accounts, and make it obvious that the messages were not yours.
Are you responsible for what was posted from your hacked account?
Not if you can show it was not you, but you may have to show it. Criminal liability needs an act or intention on your part, and a hacked account is a recognised defence. The difficulty is evidence. The police start from the account holder, and a bare claim that 'my account was hacked' after a complaint is filed is treated with scepticism, because it is the first thing everyone says.
What persuades an IO or a court is a record made at the time: security alert emails showing a login from an unknown device or location, a recovery email change you did not make, a portal complaint filed before anyone complained about the posts, messages to friends saying your account had been taken over, and login history showing a different IP address. If the posts were made while you can show you were elsewhere, such as at work or travelling, that helps too.
If you receive a notice from the police or a legal notice over something posted from your account, do not ignore it and do not give a long statement without advice. Our post on bail and defence for the accused in a cyber crime case explains how such cases are defended.
Business email compromise: when a hacked email diverts a payment
In a business email compromise, the hacker gets into a company's or professional's email account, watches the correspondence for days or weeks, and then sends a client or supplier an email with 'updated bank details' for an invoice that is genuinely due. Sometimes the hacker uses a lookalike domain that differs by one letter. The client pays the hacker's account, and each side believes the other is at fault.
Speed is everything. As soon as the diversion is discovered, the payer should ask its own bank to send a recall request to the receiving bank and report the transaction on 1930, and an FIR should be filed. Money that reaches an Indian account can sometimes be frozen if reported within hours. International wire transfers have their own recall processes through the banks, which also depend on speed.
Who bears the loss between the two businesses depends on the contract, on whose email was compromised, and on what each side did to check a change of bank details. Many contracts now require bank details changes to be confirmed by phone, and a payer who ignored that requirement will find it hard to recover from the supplier. These disputes are usually settled commercially; if not, they become civil claims for recovery. Either way, check your email forwarding rules and filters, because hackers often set up a rule that hides the client's replies.
Claiming compensation under section 43 and the adjudicating officer
Section 43 of the IT Act makes a person who accesses your computer resource without permission, or damages, deletes or extracts your data, liable to pay compensation. Under section 46, claims for compensation up to ₹5 crore are decided by an adjudicating officer appointed by the government, usually the Secretary of the state's Information Technology department. In Delhi, that is the IT department of the Government of NCT of Delhi. Claims above ₹5 crore go to the civil court. An appeal against the adjudicating officer's order lies to the Telecom Disputes Settlement and Appellate Tribunal, which took over the work of the Cyber Appellate Tribunal in 2017.
This remedy is useful when you know who did it: an ex-employee who kept accessing the company email, a business partner who took over the shared social media account, or a company whose systems were used to access your data. You need a respondent who can be identified and served, evidence of the unauthorised access, and proof of the loss you suffered. Against an unknown hacker in another country it has little practical value.
The adjudication is quasi-judicial, with notice to the other side, evidence and a reasoned order. It is less formal than a civil suit, and in suitable cases it can be quicker. The order can be executed for recovery of the compensation awarded.
When the hacker is someone you know
A large share of account takeovers are done by people with some earlier access: a spouse or former partner who knew the password or had your phone, a former employee who kept credentials, a relative, or a business partner who set up the account in the first place. Change every password they could know, remove their devices and phone numbers from your accounts, and check for recovery emails or numbers they added.
Note how they had access, without confronting them. A confrontation often leads to deletion of evidence and sometimes to retaliation, such as posting private material. If you suspect the person, give that information to the police with whatever supports it, such as a login from a device you can identify or messages showing knowledge of your private chats.
In matrimonial disputes, both sides sometimes produce chats and emails taken from the other's account. Evidence obtained by accessing someone's account without permission can expose the person who took it to prosecution under the IT Act, whatever use the court makes of the material. If you are in such a dispute, take advice before you log into anyone's account but your own, even one you used to share.
How do you prove who hacked the account?
Platforms keep login records: the date and time of each login, the IP address, the device type and often the approximate location. Some of this you can see yourself under 'where you're logged in', 'recent security activity' or 'login history'. Screenshot it before it ages out. The full records, including registration details of any email or phone number the hacker added, are given by platforms to the police on a lawful request, and in a civil case on a court order. They are not usually given to you directly.
From the IP address, the police can ask the internet service provider who was using it at that time. That identifies a connection, not always a person, and hackers use VPNs and foreign servers, so the trail sometimes ends there. Where the hacker used the account to receive money, the bank account trail is often more productive than the IP trail.
When Advocate B.K. Singh prepares a hacking complaint, his MCA background shapes what he asks the client to collect: the security alert emails with full headers, the exact time of the takeover, the login history screenshot, and a list of every account that used the hacked email for recovery. The complaint is then written so that the IO knows exactly which records to request from which company. Everything you produce in court will need a certificate under section 63 of the BSA; our post on electronic evidence and the section 63 certificate explains it.
A made-up example: the accountant's email and the diverted payment
Here's a made-up example. Mr Bansal runs a small accounting practice in Dwarka. One Monday he notices that clients' replies have stopped reaching his inbox. On checking, he finds a forwarding rule he never set, sending every email containing the word 'invoice' to an unknown Gmail address. A long-standing client in Gurugram then calls to say it paid his quarterly fee of ₹8.6 lakh on Friday, to the 'new account' mentioned in his email.
He changes his email password from a clean laptop, turns on two-factor authentication, deletes the forwarding rule and screenshots it first, and downloads the security log showing logins from an unfamiliar IP address over three weeks. The client's accounts team calls its bank for a recall and reports the transaction on 1930 the same afternoon. ₹5.2 lakh is found still in the receiving account and frozen.
An FIR is registered under section 318 BNS and sections 66, 66C and 66D of the IT Act. Mr Bansal and the client file applications before the magistrate for release of the frozen amount. The remaining loss is discussed between them: the client's contract with him says bank changes will be confirmed by phone, and the client did not call. They agree to share the shortfall rather than litigate. The lesson is the same as in most such cases: the forwarding rule had been there for three weeks, and checking it on day one would have saved everyone.
What if a company's data breach exposed your account?
Sometimes the hack starts not with you but with a company that held your password or personal data and failed to protect it. Under section 43A of the IT Act, a body corporate that handles sensitive personal data and is negligent in maintaining reasonable security practices is liable to pay compensation to the person who suffers loss. Organisations are also required by CERT-In directions issued in 2022 to report certain cyber incidents to CERT-In within six hours of noticing them.
The Digital Personal Data Protection Act 2023 sets up a fuller framework, including duties on businesses to protect personal data, to notify breaches to the Data Protection Board and affected individuals, and penalties for failures. The DPDP Rules were notified in November 2025 with a phased start, and section 43A is to be replaced once the relevant provisions take effect, so check the current position before relying on either. Our post on what businesses must do under the DPDP Act covers the business side.
The platform will not restore my account. Is there a legal route?
Sometimes. If the automated recovery fails, write to the platform's grievance officer for India with your identity proof, the original email or phone number used to open the account, screenshots showing the account was yours, and the portal complaint number. Significant social media platforms must acknowledge such a complaint within 24 hours and dispose of it within 7 days (15 days before the February 2026 amendment). If they reject it or do not respond, you can appeal to the Grievance Appellate Committee within 30 days.
Courts have occasionally directed platforms to restore accounts, usually where the account was of real commercial value or the platform acted arbitrarily, but a suit or writ for this is a step to take only where the account matters greatly, such as a business page with a large following or an email account tied to years of records. For most personal accounts, persistence with the grievance process works better than litigation.
Documents and evidence to keep
Proof the account is yours
- Account name, username and profile URL
- Original email and phone number used to open it
- Old screenshots, invoices or ads linked to the account
- Identity proof in the same name
Proof of the hack
- Security alert emails, with full headers if possible
- Login history and active sessions screenshots
- Notices of changed recovery email or phone
- Forwarding rules or connected apps you did not add
- Exact time you lost access
Proof of misuse and loss
- Messages and posts made by the hacker
- Screenshots from contacts who received messages
- Transaction details of any money paid
- Ransom or threat messages
- Portal acknowledgement and FIR copy
Mistakes people make after a hack
- Paying a 'recovery hacker'. People who offer on social media to recover accounts for a fee take the money and disappear, or take over the account themselves.
- Recovering the social account but not the email. If the hacker still controls your email, they will take the account back within hours.
- Deleting the alert emails. 'New login' and 'recovery email changed' messages are your best evidence that the account was taken over at a particular time.
- Not checking forwarding rules and connected apps. Hackers leave quiet ways back in. Changing the password alone does not remove them.
- Waiting to report until something goes wrong. A complaint filed after the account is used to cheat someone looks defensive. File it on the day.
- Logging into someone else's account to gather proof. Even if you suspect them, doing this can make you an accused under the same sections.
What to do today
- Secure your email account first: new password, two-factor authentication, sign out of all sessions.
- Recover the hacked account only through the platform's official recovery route.
- Screenshot the hacker's changes, posts, messages and the security alerts before deleting anything.
- Warn your contacts not to send money, and ask anyone who paid to call 1930.
- Check email forwarding rules, connected apps and recovery details on every important account.
- Ask your mobile operator whether a duplicate SIM was issued on your number.
- File a complaint on cybercrime.gov.in and keep the acknowledgement number.
- If money was lost, a ransom was demanded or private material is at risk, go for an FIR.
How we help when an account is hacked
We help clients put together a complaint the police can act on, get an FIR registered where the misuse justifies it, apply for release of money frozen after a diverted payment, file compensation claims under section 43 against identifiable wrongdoers, and defend clients who face complaints over posts made from their hacked accounts. Advocate Sadhna Singh usually takes the first call and the timeline of events.
Our pages on cyber crime cases and cyber laws set out the wider work, and you can read about Advocate B.K. Singh's background in computer applications and law. If you want an advocate to look at what happened and tell you which remedy fits, you can send the details through our online enquiry page.
Frequently asked questions
What is the punishment for hacking in India?
Under section 66 of the IT Act, dishonest or fraudulent hacking is punishable with up to three years' imprisonment, or a fine up to ₹5 lakh, or both. Using someone's password or identity under section 66C carries up to three years and a fine up to ₹1 lakh.
Can I file an FIR if my Instagram account is hacked?
Yes. Hacking and misuse of your password are cognizable offences under sections 66 and 66C of the IT Act. The police may hold a short preliminary enquiry first, so file a clear written complaint with screenshots and the security alert emails.
How do I report a hacked account online?
File a complaint on cybercrime.gov.in under the hacking or other cyber crime category and note the acknowledgement number. If any money was lost, also call 1930, because only the financial fraud route can set off a freeze on the money.
My hacked WhatsApp is asking friends for money. What should I do?
Re-register WhatsApp on your phone to log out the other device, warn contacts through other channels, and ask anyone who paid to report on 1930 immediately. Keep screenshots of the messages and file a complaint for cheating by personation.
Am I liable if a hacker posts something illegal from my account?
Not if it was not you, but you may need to prove it. A complaint filed on the day of the hack, security alert emails and login records showing an unknown device are the evidence that protects you.
Can I claim compensation from a hacker?
Yes. Section 43 of the IT Act makes the person liable to pay compensation. Claims up to ₹5 crore go to the state adjudicating officer, usually the IT Secretary; larger claims go to the civil court. This works only if the hacker can be identified.
Will the platform tell me who hacked my account?
Usually not directly. Platforms give login records and account details to the police on a lawful request, or under a court order. Screenshot the login history you can see yourself before it disappears.
What is business email compromise?
It is a fraud in which a hacker takes over a business email account and sends clients fake bank details for genuine invoices. The payer should ask its bank for a recall and call 1930 within hours, and an FIR should follow.
Is it hacking if my spouse logs into my account?
Accessing your account without your permission can be an offence under the IT Act even if they once knew the password. Change your credentials and keep a record; take advice before using such conduct in a matrimonial case.
Should I pay a hacker who demands money to return my account?
No. Payment rarely gets the account back and marks you as someone who pays. Preserve the messages and report extortion to the police under section 308 BNS and the IT Act.
What if the platform will not restore my hacked account?
Write to the platform's grievance officer for India with identity proof and evidence of ownership; it must respond within 15 days. If refused, appeal to the Grievance Appellate Committee within 30 days.
Can a company be held responsible if its data breach led to my account being hacked?
Possibly. Section 43A of the IT Act makes a negligent body corporate handling sensitive personal data liable to compensate. The DPDP Act 2023 adds breach duties as its provisions come into force in phases.
Written and reviewed at B.K. Singh & Associates
Advocate B.K. Singh
Founder of B.K. Singh & Associates. MCA, LL.B., LL.M., with more than twenty years of practice before the Supreme Court, the Delhi High Court, district courts and tribunals across Delhi NCR. This article explains the general law as of 24 October 2026; it is not legal advice on your facts.