Gmail account recovery complaint: a practical legal guide

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Cyber crime

A Gmail account recovery complaint starts with Google's own recovery flow, not with the police. Reclaim the account, secure every service it unlocks, then build the legal record: cybercrime.gov.in, 1930 where money moved, and an FIR under section 173 BNSS 2023 for the takeover itself.

Gmail is rarely just an email address. It is the recovery channel for your bank, your income tax portal, your insurance, your business accounts and often your social media. When someone takes it over, the damage is not confined to lost mail. The intruder can reset passwords across every service that sends a verification link to that inbox, and can quietly change recovery settings so that your own attempts to get back in fail.

That is why a Gmail account recovery complaint has an unusual order. The technical recovery comes first, because every hour the intruder holds the inbox is an hour in which more accounts are taken. The legal complaint comes next and is built on evidence you capture while the account is still compromised or freshly recovered. If you reverse that order and spend the first day at a police station, you may return to find the recovery options have been rewritten and the account is gone for good.

Why Gmail cases need their own approach

Most platform takeovers involve one account. A Gmail takeover is a key that opens a set of locks. The practical risks fall into four groups: financial accounts linked to the email, identity documents stored in the inbox or in Drive, professional correspondence that reveals clients or contracts, and the recovery settings of other services that trust the Google account. A victim who recovers the password but does not audit those four areas is still exposed.

The evidence is also different. Google exposes login history, device sessions and security alerts that show when and from where the account was accessed. Those records are more probative than a screenshot of an odd email, because they establish unauthorised access rather than merely suggesting it. Capture them before you clean up the account, because some session data disappears once you sign out all devices.

What the law says

The takeover is an offence against a computer resource. Section 66 of the Information Technology Act 2000 covers acts referred to in section 43 done dishonestly or fraudulently, which includes unauthorised access and unauthorised downloading or copying of data. Section 66C covers identity theft: the fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature. Where the intruder used your Gmail identity to obtain money or property from third parties, section 66D covers cheating by personation.

On the penal side, section 318 of the Bharatiya Nyaya Sanhita 2023 covers cheating, section 319 covers cheating by personation, section 336 covers forgery and section 340 covers using a forged document as genuine. Section 316 BNS, criminal breach of trust, can apply where the account was managed by an employee or a vendor who abused that access. Where the intruder reads private correspondence and uses it to threaten you, section 351 BNS on criminal intimidation may also be relevant, and section 308 BNS covers extortion where money is demanded.

Evidence rules matter more here than in most cases. Section 63 of the Bharatiya Sakshya Adhiniyam 2023 requires a certificate in the prescribed form for electronic records produced in court. Your login history, security alerts and email headers are electronic records. Without the certificate, a court may refuse to rely on them even where nobody disputes their authenticity.

There is a data protection angle too. The Digital Personal Data Protection Act 2023 creates obligations on data fiduciaries regarding the security of personal data and requires notification of a personal data breach. Its framework is still being implemented through rules, and how far it helps an individual victim of account takeover is unsettled. It is worth knowing about, but it is not the primary route for recovery, and no one should present it as a guaranteed remedy.

For money losses that followed the takeover, the operative rules are the Reserve Bank of India's 2017 circular on customer protection and limiting liability for unauthorised electronic banking transactions, read with the Integrated Ombudsman Scheme 2021. Liability turns on how quickly you notified the bank and on whether you shared credentials. That is why the bank call belongs in the first hour, alongside the Google recovery attempt.

The first hour, the first day and the first week

Window	What to do	Why it cannot wait
First hour	Start Google's account recovery, change the password if you still have access, sign out other sessions, check recovery email and phone	The intruder may be changing recovery options while you read this
First day	Call the bank if money moved, block cards and UPI mandates, file on cybercrime.gov.in, call 1930	RBI's liability framework gives the strongest protection to reports within three working days
First week	Written complaint to the bank's nodal officer, FIR at the police station, review of every account that uses the Gmail address	Platform logs age, and the FIR needs a contemporaneous record

Step by step

Try Google's recovery flow before anything else. Use the account recovery form and answer what it asks. If the intruder changed the recovery phone or email, use the option to report the account as compromised rather than repeatedly guessing. Google's process, not a third party, is the only route back into the account.
Capture the security history. If you regain access, open the security settings and export or photograph the recent devices, the login history, the recovery options and any alerts. Note unfamiliar locations and times. If you cannot get in, screenshot the alerts Google sent to your alternate contact.
Secure the accounts the inbox controls. List every service that sends password resets to that address: bank, card, demat, insurance, income tax, business email, social media. Change those passwords from a different device and enable two-factor authentication everywhere it is offered.
Tell your contacts. Send a short message from an alternate channel warning that the account was compromised and that any payment request from it is fraudulent. This limits the secondary fraud and creates witnesses who can later describe the messages they received.
Report to Google's grievance channel. Beyond the recovery flow, use the grievance officer route published under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 for a significant intermediary. Keep the ticket reference. Ask specifically for preservation of account access logs.
Call the bank and block instruments. Do this before writing the police complaint if money has moved. Ask for the complaint reference, the time of the call and the name of the person you spoke to.
File on cybercrime.gov.in and call 1930. Choose the financial fraud category where money was taken and the social media or other category for the takeover. Attach the login history, the alerts and the transaction proof.
Write to the bank's nodal officer. Attach the portal acknowledgement and ask for a recall or chargeback. Send it the same day as the call, not a week later.
Give the police a written complaint. Information about a cognizable offence is recorded under section 173 BNSS 2023. Carry the portal reference, the bank reference, the login history and your ID. Read the FIR before signing and check that it describes the takeover and any cheating separately.
Escalate where the response stalls. If the station refuses to register, apply to the jurisdictional Magistrate under section 175(3) BNSS 2023. If the bank does not decide the claim within the period set by the Integrated Ombudsman Scheme 2021, escalate to the RBI Ombudsman.

What decides the outcome

Whether you get the account back depends mostly on the recovery information the intruder has changed. If two-factor authentication was enabled and the second factor is still yours, recovery is usually quick. If the intruder added a recovery phone and removed yours, Google's automated checks may fail and the manual review takes longer. Nothing in the legal process speeds up Google's review, which is why the technical attempt should not wait for a police reference.

Whether money comes back depends on speed and on the money trail. A debit reported within three working days sits in the strongest band of RBI's liability framework where the loss resulted from a third-party breach. A debit reported after the funds were withdrawn in cash is practically unrecoverable, whatever the merits.

Whether the criminal case progresses depends on attribution. Google holds access logs and subscriber data, but it releases them in response to lawful requests, not to a complainant's email. An investigating officer who sends a proper request early gets data that is unavailable six months later. This is the single strongest reason to convert the portal complaint into an FIR quickly.

Whether you face secondary losses depends on what you did in the first day. Victims who change passwords only on the compromised account, and not on the services it unlocks, often discover a second wave of fraud weeks later. The inbox is the master key; treat every lock it opens as compromised.

Mistakes that make recovery harder

Creating a new Google account and abandoning the old one. The old address remains the recovery route for your other services, and abandoning it hands the intruder a permanent foothold.
Deleting the suspicious emails. They are evidence of the phishing or the reset request, and their headers carry technical details.
Signing out all sessions before capturing the device list. The record you need is in that list.
Paying a service that promises to recover a Gmail account. No outside agency has access that Google's own flow does not.
Reporting the takeover to the police but not to the bank. The two systems do not talk to each other automatically.
Assuming the account is safe once the password changes. Check forwarding rules, filters, app passwords and linked devices, which are the usual places an intruder leaves a way back in.

In Kolkata, a Gmail takeover that has been used for fraud is typically routed through the district cyber crime unit after the portal filing. If an arrest follows, bail is heard before the Bankshall Court or the City Sessions Court. The Calcutta High Court deals with anticipatory bail and quashing. For a complainant the practical relevance is timing: the sections named in the FIR determine which court hears the bail application and how quickly the accused can return to the same conduct.

When to involve a lawyer

If you have recovered the account, no money moved and the intruder appears to have moved on, the platform report and a police complaint may be sufficient. Legal help matters when money was taken and the bank is resisting liability, when the account was used to commit fraud against your clients or employer and you need to show that you were not the person operating it, when the police will not register the FIR, or when you are accused of the takeover. The firm's cyber crime work is described on the cyber crime lawyer in Kolkata page, and the general framework is set out under cyber law.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

How do I start a Gmail account recovery complaint after hacking?

Begin with Google's account recovery form, not with the police. Use the option to report the account as compromised if the recovery phone or email has been changed. Once you have access, capture the login history and device list. Then file the legal complaint on cybercrime.gov.in and, where money moved, call 1930 the same day.

Is hacking a Gmail account a punishable offence in India?

Yes. Unauthorised access and use of another person's password or unique identification feature is punishable under sections 66 and 66C of the Information Technology Act 2000. If the intruder used the inbox to cheat your contacts, section 66D of the IT Act and section 318 of the Bharatiya Nyaya Sanhita 2023 apply as separate offences.

What should I secure first if my Gmail was hacked?

Secure the email account itself, then every service that sends password resets to that address: bank, cards, demat, insurance, tax portal, business mail and social media. Change those passwords from a different device and enable two-factor authentication. Also check forwarding rules, filters and app passwords, which are common ways an intruder keeps access.

Can the police force Google to give the hacker's details?

Only through lawful process. Google releases account and access logs in response to valid legal requests from investigating agencies, not to a victim's email. That is why the portal complaint should be converted into an FIR quickly, since the investigating officer's request is what preserves and obtains the data before retention periods expire.

What evidence should I save from a hacked Gmail account?

Save the login history and device list, security alerts, recovery settings, suspicious emails with full headers, and any messages the intruder sent from your address. If money moved, keep the bank statement and transaction reference. Electronic records produced in court need a certificate under section 63 of the Bharatiya Sakshya Adhiniyam 2023.

Can I recover money taken after my Gmail was hacked?

It depends on speed and on where the funds went. Report the unauthorised debit to your bank and on cybercrime.gov.in immediately, because RBI's framework gives the strongest protection to transactions reported within three working days. If the money is still in the beneficiary account, a freeze request from the investigating officer can recover it.

Does Google compensate users whose accounts are taken over?

Google does not ordinarily compensate for losses caused by account takeover, and there is no Indian statutory scheme that makes it liable to an individual victim as a matter of course. Your financial remedy normally lies against the bank under RBI's unauthorised transaction rules, and your criminal remedy lies against the person who took the account.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact