Facebook hacked and money stolen: how to recover it legally

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Online fraud

When a hacked Facebook account is used to take your money, two separate legal tracks open at once: a bank liability claim under RBI's unauthorised transaction rules, and a criminal complaint under the IT Act 2000 and the Bharatiya Nyaya Sanhita 2023. Start with your bank and the 1930 helpline today, then file the FIR.

A hacked Facebook account rarely stays a social media problem for long. The person who takes it over usually wants one of three things: your identity, your contact list, or your money. Sometimes all three arrive together. A card saved in the app is charged, a linked payment app is used, or the intruder messages your friends asking them to transfer money to an account he controls. By the time you notice, the debit has already settled.

The legal position is more structured than most victims expect. Your money claim sits first against your bank, because Indian banking regulation places defined liability on banks for unauthorised electronic transactions. The criminal side is separate: the Information Technology Act 2000 covers the account takeover, and the Bharatiya Nyaya Sanhita 2023 covers the cheating that followed. You do not have to choose between them. What matters in the first seventy-two hours is that you create a written record with both your bank and the police.

What the law says about a hacked Facebook account

The takeover itself is an offence against the computer resource. Section 66 of the IT Act 2000 covers computer-related offences where a person dishonestly or fraudulently does an act referred to in section 43, which includes unauthorised access and disruption of a computer resource. Section 66C deals specifically with identity theft: the fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature. Where someone gains control of your profile using your password or a stolen session, section 66C is usually the most direct fit.

Section 66D covers cheating by personation using a computer resource or communication device. That is the section that applies when the intruder uses your name and photograph to persuade your friends, relatives or business contacts to part with money. It is a distinct offence from the takeover and is routinely added alongside 66C. Section 43A is also worth knowing, though it applies to body corporates handling sensitive personal data rather than to individuals: it creates a compensation obligation where negligence in security practices causes wrongful loss or gain.

On the cheating side, section 318 BNS 2023 replaces the old cheating provisions of the Indian Penal Code. It punishes dishonest or fraudulent inducement to deliver property, and the punishment scales with the value involved. Where the offender personates someone else, section 319 BNS applies. If a forged document, a fake payment screenshot or a fabricated invoice was used, section 336 BNS covers forgery and section 340 BNS covers using a forged document as genuine. Section 316 BNS, criminal breach of trust, fits where the account was entrusted to a social media manager or employee who then diverted money.

Two procedural statutes matter just as much. Section 63 of the Bharatiya Sakshya Adhiniyam 2023 governs the admissibility of electronic records. It replaces the old section 65B certificate regime, but the practical requirement is unchanged: screenshots and printouts of digital material need a certificate in the prescribed form before they are treated as evidence. Section 173 BNSS 2023 is the provision under which information about a cognizable offence is recorded at a police station. If the station refuses, section 175(3) BNSS allows a Magistrate to order investigation.

For the money itself, the operative framework is the Reserve Bank of India's 2017 circular on customer protection and limiting liability for unauthorised electronic banking transactions, read with the Integrated Ombudsman Scheme 2021. That circular divides liability by how quickly you report and by whether the loss came from a third-party breach or from your own credential sharing. It is what your bank's nodal officer actually applies, and it explains why the timing of your first call matters more than the strength of your story.

Two tracks that run in parallel

Victims lose weeks because they treat this as one problem. It is two problems with different forums, evidence and outcomes. The money track is administrative in character: you ask a bank, and if necessary the RBI Ombudsman, to reverse a debit you did not authorise. The criminal track is about punishment, and indirectly about pressure, because an investigating officer can request a hold or freeze on a beneficiary account that a branch will not act on by itself.

The money track moves faster and produces a result more often. The criminal track creates the record you need when the bank disputes your version, and it is the only route to prosecution. Neither guarantees recovery: reversal depends on where the funds went and how quickly they were frozen, while prosecution depends on identifying the accused through platform logs that age quickly.

What to do, in order

Regain the account. Use Facebook's compromised-account flow rather than the ordinary login screen. Change the password, remove unknown email addresses and phone numbers, revoke active sessions, and turn on two-factor authentication. Secure the linked email first if the intruder seems to have reached it, because email is the recovery channel.
Establish what was charged. Check the app's payment history, your card statement and your bank statement. Note the amount, time, merchant and transaction reference, and whether the debit was a saved card, a wallet top-up or a UPI transfer. Export each entry before you dispute anything.
Call the bank's fraud line. Block the card or the payment app link and ask for a complaint reference number with the date and time of the call. A call is not a complaint; follow it with an email the same day.
Report on the national portal. File at cybercrime.gov.in and call 1930. The portal generates an acknowledgement that links your complaint to the financial fraud module. Quote that number in every later letter, including the FIR.
Write to the nodal officer. Send a signed email or letter to the bank's nodal officer, not just customer service, attaching the portal acknowledgement, the transaction list and a one-page chronology. Ask for reversal and for the status of the beneficiary account.
File the FIR. Give information under section 173 BNSS 2023 at the station with jurisdiction, or at any station under the zero-FIR practice. Carry the portal acknowledgement, bank reference, screenshots, your ID and a written complaint. Read the FIR before signing and check that it names both the takeover and the cheating.
If police refuse, go to the Magistrate. File a complaint before the jurisdictional Magistrate, who may direct investigation under section 175(3) BNSS 2023. Keep proof of the refusal.
Escalate to the RBI Ombudsman. If the bank rejects the claim or does not resolve it within the period set by the Integrated Ombudsman Scheme 2021, escalate online. It costs nothing and the award binds the bank.
Keep one chronology. Dates, amounts, reference numbers, officials spoken to, copies of every message. That file becomes the spine of the bank claim and the criminal case.

Which forum does what

Forum	What you ask for	What it can actually do
Bank fraud desk	Block the instrument, reverse the debit	Recall funds still in the banking system; decide liability under RBI rules
1930 and cybercrime.gov.in	A recorded national complaint	Route the case to the financial fraud module and local police
Police station	An FIR under BNS and the IT Act	Investigate, seek platform logs, request freezes
Magistrate	An order to investigate	Compel investigation where police decline
RBI Ombudsman	Compensation for an unresolved claim	Binding award on the bank, within the scheme's limits
Civil court	Recovery and damages	Decree against an identified wrongdoer

What decides the outcome

Speed comes first. An unauthorised transaction reported within three working days falls in the zero-liability band under RBI's framework where the fault lies with a third-party breach and not with you. Report later and liability is shared under the bank's policy. Report after a long delay and the bank will argue you contributed to the loss. Nothing in the framework lets the bank ignore a prompt report, and nothing lets you ignore your own conduct either.

Second is whether you gave the credentials away. If you typed your password into a phishing page, shared an OTP, or approved a UPI collect request, the bank will treat the transaction as authorised by you, or at least as the product of gross negligence. That does not end your options. It shifts the argument to the adequacy of the bank's warnings and systems, and to whether the platform's account security failed, which is where section 43A IT Act can become relevant.

Third is the money trail. If the debit landed in a mule account that is still funded, a prompt request from the investigating officer can freeze it. If it was withdrawn in cash within minutes, recovery becomes practically difficult and the case turns into a prosecution exercise. This is why the bank letter and the portal complaint go out on the same day, not one after the other.

Fourth is proof of takeover. Login alerts, unfamiliar device notices, the IP addresses shown in account security settings, and the pattern of messages the intruder sent all help. A bare assertion made weeks later, with nothing contemporaneous, is weak evidence.

Fifth is naming. Most Facebook takeover frauds run through SIM cards and accounts taken in other people's names. Naming a stranger whose number appears in the trail can damage your case. Describe the accounts and identifiers used and leave identification to the investigation.

Mistakes that cost victims money

Deleting the account in anger. That destroys the logs and message history you need, and does not remove the intruder's copies.
Relying only on the in-app report. It is necessary, but it starts no clock with your bank and is not an FIR.
Waiting for the platform before calling the bank. Liability turns on your reporting time, not the ticket queue.
Paying a recovery agent who approached you online. No genuine recovery needs an advance fee to a private account.
Filing a complaint that mentions the hacking but not the amount. The financial fraud module has nothing to work with.
Sending the bank an emotional narrative without transaction IDs. Nodal officers work from references. Lead with those.

For readers in Kolkata the sequence is identical, but the forums have names. The district cyber crime police station handles the portal-linked complaint, the Bankshall Court or City Sessions Court deal with bail and custody once an accused is arrested, and the Calcutta High Court hears quashing and anticipatory bail matters. A complainant rarely needs to go that far; an accused person often does.

When to involve a lawyer

Most straightforward cases do not need a lawyer on day one. If the amount is modest, the bank has acknowledged the dispute and the portal complaint is registered, you can follow the process yourself. Legal help earns its place when the bank rejects liability on a ground you think is wrong, when the police station will not register the FIR, when the loss is large enough to justify a civil suit, or when you are the person accused of the takeover. In each of those, the value is in knowing which forum will actually act and in getting the record right before it hardens. You can review the approach on the cyber crime lawyer in Kolkata page, or read more practical guides in the blog.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Can I get my money back if my hacked Facebook account was used to steal from me?

Yes, but recovery depends on speed and on where the money went. Report the unauthorised debit to your bank and on cybercrime.gov.in the same day, because RBI's liability framework gives the strongest protection to transactions reported within three working days. If the funds are still in the beneficiary account, a freeze request from the investigating officer can recover them.

Is hacking a Facebook account a criminal offence in India?

Yes. Unauthorised access and use of another person's password or unique identification feature is punishable under sections 66 and 66C of the Information Technology Act 2000. If the intruder then uses your profile to cheat your contacts, section 66D of the IT Act and section 318 of the Bharatiya Nyaya Sanhita 2023 apply as separate offences.

Which police station do I file the Facebook fraud FIR at?

File at the station with jurisdiction over the place where the debit occurred or where you suffered the loss, which is usually your bank branch area or your residence. Under the zero-FIR practice any station should accept the information and forward it. If a station refuses, approach the Magistrate under section 175(3) BNSS 2023.

What evidence should I save before disputing the transaction?

Save the bank statement showing the debit, the transaction reference, screenshots of login alerts and unfamiliar devices, the intruder's messages to your contacts, and the account security page showing unknown email addresses or phone numbers. Export these rather than only screenshotting, and keep the cybercrime portal acknowledgement number with them.

Does reporting to Facebook count as a legal complaint?

No. Reporting through the platform's compromised-account flow is necessary to regain control, but it is not a complaint to your bank and it is not an FIR. The bank's liability clock and the criminal process both run from your written report to the bank and to the police, not from the platform ticket.

What happens if I shared an OTP with the fraudster?

The bank will usually treat the transaction as authorised by you, which weakens a zero-liability claim under RBI's framework. Your argument then shifts to whether the bank's warnings and systems were adequate and whether the platform's security failed. Report anyway and in writing, because a contemporaneous record still supports a negligence claim and a criminal complaint.

Can I sue Facebook or Meta for the loss?

A claim against the platform is possible in principle but difficult in practice. It would rest on negligence in security or on a failure of the obligations that apply to an intermediary, and you would have to show that the platform's failure caused the specific loss. Most victims recover through the bank route, and the criminal case is against the person who took the account.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact