Google Pay account hacked: recovery, FIR and legal steps

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber crime

If your Google Pay account was hacked, the loss sits in your bank account, not in the app, so the bank is the first institution that can freeze or reverse the debit. Report on 1930 and at cybercrime.gov.in within hours, then give your bank a written complaint and file an FIR under Section 318 of the Bharatiya Nyaya Sanhita 2023 and Section 66C of the Information Technology Act 2000.

Google Pay in India is a payment application that moves money between bank accounts over the Unified Payments Interface. It does not hold your balance. That architecture decides everything about how a hacking complaint should be built, because the account that must be debited back is a bank account, and the institution that can freeze the beneficiary's account is a bank, not an app support team. A victim who spends the first day arguing with an app's help centre has lost the hours in which recovery is realistic.

The legal characterisation is equally specific. Taking money by inducing a payment is cheating under Section 318 of the Bharatiya Nyaya Sanhita 2023. Accessing another person's payment credentials, device or account without consent is a computer-related offence under Section 66 of the Information Technology Act 2000, and using another person's credentials or identity is identity theft under Section 66C. Where the offender impersonated the victim or a bank official through a computer resource, Section 66D applies. Those four provisions, together with the Reserve Bank's directions on customer liability, form the framework within which a Google Pay hacking complaint is investigated and defended.

How a Google Pay account is actually taken over

The phrase covers a range of techniques, and the facts of each determine both the criminal section and the bank's liability decision. In a SIM swap, the offender obtains a duplicate SIM from the telecom operator and receives the one-time passwords that Google and the bank send. In a remote-access fraud, the victim is persuaded to install a screen-sharing application during a call with a person posing as customer care, and the offender reads the OTP and the UPI PIN as they are typed. In a credential compromise, the victim's Google account password is reused from a breach elsewhere and the offender signs in, resets the payment app and registers a new device.

In a collect-request fraud, the offender sends a UPI request that looks like a refund or a payment and the victim approves it with the PIN. In a QR-code fraud, the victim scans a code believing it is a receive request when it is a pay request. In each case the money is transferred to a beneficiary account, and in each case the beneficiary is the point at which funds can still be intercepted. The takeover of the app is the method; the transfer to the beneficiary is the traceable event.

What the law says

Section 318 of the Bharatiya Nyaya Sanhita 2023 defines cheating as deceiving a person to deliver property, and the aggravated form in Section 318(4) applies where the deception caused the delivery. A UPI transfer obtained by a false story, a fake refund or an impersonated official satisfies that description. Section 316 applies where an agent, a family member or a person in a position of trust misappropriated money that had been entrusted to them, which arises in some family and business disputes that are dressed up as hacking.

Section 66 of the Information Technology Act 2000 covers computer-related offences, including unauthorised access. Section 66C covers identity theft, defined as the fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature. Section 66D covers cheating by personation by using a computer resource or a communication device. The distinction matters in a charge sheet: 66C is used where the offender used the victim's credentials, and 66D is used where the offender pretended to be someone else to the victim or to the bank.

Section 63 of the Bharatiya Sakshya Adhiniyam 2023 governs the admissibility of electronic records and requires a certificate in the prescribed form. In a payment fraud case the electronic record is the transaction log, the device registration history, the login alerts and the message thread. Banks and payment providers produce these on requisition; a complainant cannot create them. What a complainant can do is preserve the notification emails and messages that arrived at the time, because those carry timestamps that the provider's records will later confirm.

The Reserve Bank's directions on limiting customer liability in unauthorised electronic banking transactions set the liability framework. In broad terms, a customer who reports a third-party breach within three working days bears zero liability. Where the report is made after three working days but within seven, liability is limited and is determined under the bank's policy. Beyond that period, liability is decided by the bank's policy subject to the directions. The directions also require the bank to resolve the complaint within a defined period and to credit the amount provisionally in certain cases. These are regulatory obligations, not criminal remedies, and they are enforced through the bank's grievance process and, ultimately, the Reserve Bank's Integrated Ombudsman Scheme.

On procedure, Section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023 governs the FIR in a cognizable case. Section 175(3) allows a magistrate to direct investigation where the police refuse to register. Section 187 governs remand where the investigation cannot be completed in twenty-four hours. Section 482 preserves the High Court's inherent jurisdiction, which matters where a victim seeks urgent orders or an accused seeks to quash a proceeding.

The first twenty-four hours, in order

Freeze the payment channel, not just the app. From another device, change the Google account password, revoke sessions, and remove the payment app's device access. Then call the bank's twenty-four-hour number and ask for the debit card, net banking and UPI channels to be blocked until the dispute is resolved. An app-level logout does not stop a linked device from transacting.
Call 1930. Give the amount, the exact time, the UPI reference number, the beneficiary UPI handle or account number, and the phone number that called you. The helpline logs the complaint and can request the beneficiary bank to hold the funds. This is the single highest-value action available in the first hour.
Raise the dispute inside Google Pay. Use the help section to open a dispute on the specific transaction and to report unauthorised access. The app issues a complaint reference. Keep it, but do not treat it as the legal complaint; it is a platform record.
File on cybercrime.gov.in. Choose the financial fraud category and enter the same details. Upload the bank statement page and the transaction screenshot. Note the acknowledgement number and use it consistently in every later communication.
Write to the bank's nodal officer. Send an email that states the transaction was unauthorised, gives the reference numbers, and asks for reversal or for the beneficiary account to be frozen. Ask for a written acknowledgement with a complaint number. This email starts the clock under the RBI directions.
File the FIR. Give a signed written complaint at the cyber crime police station with the portal acknowledgement, the bank statement, the device details and the message records. Under Section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023 the information must be recorded in a cognizable case. In Kolkata the complaint is routed through the police station with cyber jurisdiction and thereafter to the Cyber Crime Police Station.
Escalate if the bank rejects the claim. If the bank refuses to reverse the debit or does not reply within the period set by the RBI directions, file a complaint under the Reserve Bank's Integrated Ombudsman Scheme. That route is free, does not need a lawyer, and runs alongside the criminal case.

Who is answerable for what

Party	What it controls	What to ask it for
Your bank	The account that was debited and the dispute process	Transaction reversal, written decision, provisional credit
Beneficiary bank	The account that received the money	Freeze of the balance on police or helpline request
Google Pay	App access, device registration and transaction records	Dispute reference, access logs on requisition
Telecom operator	The SIM linked to your number	SIM swap record, if a duplicate was issued
Police	Investigation and requisitions	FIR, account freeze request, charge sheet
RBI Ombudsman	Bank compliance with the liability directions	Order on the complaint against the bank

What decides the outcome

The first factor is whether the payment was authenticated. If the transaction was completed with your UPI PIN, the bank's starting position is that you authorised it, and the case becomes one of induced consent. That does not make the transfer lawful, but it changes the burden: the criminal case must prove deception, and the bank will rely on the PIN entry as consent unless the complainant shows the PIN was obtained by fraud or by unauthorised access. If the payment was made without any PIN entry by you, the bank's liability position is much stronger.

The second factor is the speed of the report. The RBI directions turn on days, not on the merits. A report on the day of the debit is treated differently from a report three weeks later, and the bank will point to the delay in its reply. The third is whether the beneficiary account still holds funds. Money that has moved through three accounts before the freeze request is rarely recovered in full, which is why the 1930 call matters more than any later document.

The fourth is the quality of the device evidence. Login alerts, the new device registration email, the screen-sharing app installation time and the call record together establish the mechanism. A complaint that says the account was hacked without showing how gives the bank and the police nothing to verify. The fifth is whether the complainant shared credentials. A victim who gave an OTP or installed a remote-access app on instruction has, in law, still been deceived, but the bank will argue contributory negligence, and the outcome then turns on whether the deception was reasonable to fall for. Courts and regulators weigh all of these factors; no outcome can be promised in advance.

Mistakes that turn a fraud into a defence

Do not uninstall the app or factory reset the phone before the device has been examined. Do not delete the OTP messages or the call log. Do not accept a caller who claims to be a recovery agent and asks for an advance fee; the cyber crime police never charge for recovery. Do not file the bank complaint as a general grievance about poor service; label it as an unauthorised electronic transaction, because the two are handled by different teams under different timelines. Do not name a person as the hacker on the strength of a caller ID, which is easily spoofed.

Do not withdraw the complaint because the bank says the matter is being processed. A withdrawal closes the RBI timeline and leaves the criminal case unsupported. And do not assume that changing the Google password ends the exposure; the linked bank account and the UPI registration must be reset at the bank as well.

When to involve a lawyer

Small amounts reported promptly are usually handled through 1930, the bank and the ombudsman without legal assistance. A lawyer becomes useful where the bank has rejected liability and the ombudsman route has been exhausted, where the amount is substantial, where the complainant is being treated as an accused because a mule account was opened in his name, or where the police have not registered an FIR despite a written complaint. At that stage the paperwork exists and the question is which forum and which provision to invoke. A cyber crime lawyer in Kolkata can assess the bank's reply against the RBI directions, and the civil recovery route is described under civil litigation.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

What should I do first if my Google Pay account is hacked?

Call 1930 and your bank before anything else. Ask the bank to block UPI and net banking on the account, then change the Google password and revoke device sessions from another phone. The bank can act on the beneficiary account only if the report reaches it early.

Can Google Pay refund money lost in a hacking fraud?

Google Pay can raise a dispute and provide transaction records, but the money sits in your bank account and the refund decision rests with the bank under the RBI directions. The app is a channel, not the account holder, so the bank complaint is the operative one.

Is a UPI payment authorised if I entered the PIN?

The bank treats PIN entry as authentication, so it starts from the position that you authorised the payment. That does not make a fraudulent transfer lawful. The criminal case must still prove deception, and the bank's liability turns on whether the PIN was obtained by fraud or unauthorised access.

How long do I have to report an unauthorised Google Pay transaction?

Report immediately. Under the RBI directions on customer liability, reporting a third-party breach within three working days gives zero liability, and reporting within seven working days limits liability. Delaying beyond that leaves the decision to the bank's policy, so speed matters more than the amount.

What sections are used in a Google Pay hacking case?

Section 318 of the Bharatiya Nyaya Sanhita 2023 for cheating, and Sections 66, 66C and 66D of the Information Technology Act 2000 for unauthorised access, identity theft and cheating by personation. Section 63 of the Bharatiya Sakshya Adhiniyam 2023 governs the electronic records. The beneficiary account holder can also be proceeded against for receiving the proceeds of the fraud.

Can the police freeze the account that received my money?

Yes. On a complaint to 1930 or the cyber crime police station, the beneficiary bank can be asked to hold the balance in the receiving account. The freeze works only if funds remain there, which is why the request must go out within hours of the transfer.

What if the bank says I was negligent because I shared an OTP?

Sharing an OTP after being deceived is still deception, and the offence is committed against you. The bank may raise contributory negligence, and regulators weigh whether the deception was reasonable. Do not accept a verbal rejection; ask for the decision in writing so it can be challenged.

Do I need an FIR if the bank has already refunded me?

A refund settles your account but does not end the crime. An FIR is still worth filing because the beneficiary account may be part of a larger fraud, and the bank's refund can be reversed if the investigation shows customer collusion. File the complaint and keep the acknowledgement.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact