Accounts are usually lost through a shared OTP, a phishing link, a reused password, or a malicious app. This guide covers what to do in the first hours and where to report in India. It is general information, not advice on your case.
Act in this order
- Secure your email first. Your email is the key to every other account. Change its password and sign out of all devices.
- Use the platform’s recovery option. Each platform has its own “hacked account” or “forgot password” flow. For WhatsApp, re-register your number to get a fresh code and turn on two-step verification. For Instagram and Facebook, use the account recovery page and follow the steps shown.
- Change passwords on every account that used the same or a similar password, starting with banking, UPI and email.
- Turn on two-step verification everywhere it is offered.
- Check linked devices and apps. Remove any you do not recognise.
- Check your bank and UPI apps. If you see transactions you did not make, call the bank and 1930 immediately.
- Warn your contacts from another account or phone, so they do not send money to anyone using your name.
- Save evidence before it disappears: screenshots of messages sent in your name, login alerts, emails from the platform, and the phone number or profile of the person involved.
- Report on cybercrime.gov.in and keep the acknowledgement number.
If money was taken or your contacts were asked for money
Call 1930 and follow the steps in what to do after a UPI fraud. Tell your bank in writing as well.
If private photos or chats were taken
If the hacker is threatening to share them, do not pay. Save the threats and read what to do when someone threatens to leak photos or videos.
Law that applies
| What happened | Provision commonly used |
|---|---|
| Unauthorised access or damage to a computer or account | Sections 43 and 66, Information Technology Act, 2000 |
| Using your password, photo or identity dishonestly | Section 66C, IT Act, 2000 (identity theft) |
| Cheating by pretending to be you | Section 66D, IT Act, 2000, and Sections 318 and 319, Bharatiya Nyaya Sanhita, 2023 |
The police and the court decide which sections finally apply.
Staying safer afterwards
- Use a different password for each important account, and a password manager if you can.
- Never share an OTP or a verification code, even with someone you know. Ask them to confirm by calling you.
- Do not click links in unexpected messages, even from contacts. Their account may be hacked.
- Install apps only from official stores, and keep your phone updated.
Common questions
Do I need a lawyer to report a hacked account?
No. You can file online yourself. A lawyer helps if the matter escalates, for example with a threat, a large loss or a platform that does not respond.
The platform has not replied. What now?
Keep the report reference and file on cybercrime.gov.in. Mention the platform complaint number in your report.
Can the police find the hacker?
Often only partly. Reporting early with full details improves the chances, and it protects you if the account is used for fraud.
Sources
- National Cyber Crime Reporting Portal (cybercrime.gov.in) and helpline 1930
- Information Technology Act, 2000, Sections 43, 66, 66C and 66D (India Code)
- Bharatiya Nyaya Sanhita, 2023, Sections 318 and 319
Related: deepfake and AI scams · digital arrest scam
This guide is general information and does not replace advice on your own situation.