Google Pay recovery after hacking: complaint and evidence

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber law

When someone takes over a Google Pay account, the victim faces three distinct problems at once and usually confuses them. The first is access: the password has been changed, a new device has been registered and the victim cannot sign in. The second is money: a debit has left the linked bank account. The third is proof: the alerts, the call and the transaction details exist only on a device the offender may still control. Recovery on each track is handled by a different institution, on a different timeline, with a different test.

Getting the order right matters. Access must be secured first, because an offender who still holds the account can approve further collect requests, change the linked bank account and delete the very notifications that prove the fraud. Money comes next, because the beneficiary balance is perishable. The criminal record comes next and stays useful for months. A victim who starts with the criminal record and leaves the account open is doing the work in the wrong sequence.

Track one: getting the account back

Google's account recovery flow is the only legitimate route to regaining a hijacked Google account. It works through the recovery options already on the account: a recovery email, a recovery phone number, a signed-in device, or a saved passkey. Where the offender has changed all of them, the flow allows a review request, and Google decides on the evidence of ownership it can verify. Nobody else can reset the account, and anyone who offers to do it for a fee is running a second fraud.

Once access is restored, three actions close the exposure. Change the password to something not used on any other service. Review the security settings and sign out of every session except the current device. Check the payment methods, the linked UPI bank account and the app's device registration, because the offender commonly adds a second bank account to receive future transfers. Then check the Google account's forwarding rules and recovery options, which are used to regain access after the victim resets the password.

There is a hard limit here that victims dislike hearing: if the account was created years ago with a phone number that has since changed, and no recovery email was ever added, Google may not be able to verify ownership. In that case the account may be lost even though the money is recovered. The lesson belongs in prevention, and the practical advice is to add a recovery email and a second factor before an incident rather than after one.

Track two: getting the money back

The debit sits in a bank account. The bank is therefore the institution that decides whether to reverse it, and the Reserve Bank's directions on limiting customer liability in unauthorised electronic banking transactions set the framework it must follow. In broad terms, a third-party breach reported within three working days carries zero liability for the customer; a report within seven working days limits liability; and beyond that period the bank's policy governs, subject to the directions. The directions also require the bank to resolve the complaint within a defined period.

The reversal question and the criminal question are not the same. A bank can reverse a debit because the customer reported it in time and the transaction was not authenticated, without any finding that a crime occurred. A criminal case can establish deception without producing a refund, because the accused may have no assets. A victim needs to pursue both, and the bank complaint is the one with a deadline attached.

Where the bank rejects the claim or does not respond within the period set by the directions, the next step is the Reserve Bank's Integrated Ombudsman Scheme. The complaint is filed online, is free, and is decided on the bank's compliance with the directions rather than on the merits of the underlying fraud. It is not a court and cannot convict anyone, but it can produce a written order requiring the bank to act. If the ombudsman rejects the complaint, the civil suit for recovery of the amount remains available, and it can be filed against the beneficiary where the beneficiary is identifiable.

Track three: the criminal record

The criminal complaint serves purposes that a refund does not. It creates an official record with a date, it allows the police to requisition the transaction logs and device records from the bank, the app provider and the telecom operator, and it allows the beneficiary account to be frozen and investigated. Under Section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023, information about a cognizable offence must be recorded as an FIR. Where the police decline, Section 175(3) allows the magistrate to direct investigation.

The substantive sections are Section 318 of the Bharatiya Nyaya Sanhita 2023 for cheating and Sections 66, 66C and 66D of the Information Technology Act 2000 for unauthorised access, identity theft and cheating by personation. Section 63 of the Bharatiya Sakshya Adhiniyam 2023 governs how the electronic records are proved, and it is the reason the preservation steps in the next section are not optional.

Evidence to gather before anything is deleted

• The bank statement page showing the debit, downloaded as a PDF rather than photographed.
• The UPI transaction reference, the beneficiary name, the beneficiary UPI handle or account number and the exact time.
• Screenshots of the Google security alerts: new sign-in, password change, new device, recovery option change.
• The call log showing the number that claimed to be customer care or bank support, with the duration.
• The message thread, including any OTP received and any instruction given by the caller.
• The names of any remote-access or screen-sharing app installed during the call, with the installation time.
• The Google Pay dispute reference and the bank complaint number.
• The 1930 acknowledgement and the cybercrime.gov.in acknowledgement.

Where the phone itself was compromised, the device should be preserved rather than wiped. A factory reset removes the artefacts that would show when an app was installed and what it accessed. If the device must be used, take a full backup and a screen recording of the relevant screens first, and keep the original device available for examination.

The escalation ladder

What decides whether recovery succeeds

The first factor is authentication. A payment completed with the UPI PIN is treated by the bank as authorised, and the burden shifts to the complainant to show the PIN was obtained by deception or unauthorised access. A payment completed without the victim's PIN, through a compromised session or a re-registered device, is on a stronger footing for reversal. The second factor is the gap between the debit and the report. The RBI directions are drafted in days, and a bank reads the date on the complaint before it reads the facts.

The third factor is whether the beneficiary account still holds funds. A freeze request that reaches the beneficiary bank within hours can preserve the balance; one that arrives after a week usually finds an empty account. The fourth is whether the offender is identifiable. A UPI handle tied to a verified account gives the police a trail; a handle created with a stolen SIM and a rented account gives them a dead end. The fifth is the consistency of the victim's account. Statements to 1930, the bank, the portal and the police should describe the same sequence, because a discrepancy between them is the first thing a defence counsel will use.

The sixth factor is the strength of the device evidence. Login alerts and device registration emails carry timestamps that the provider's logs can confirm. A complaint supported by those records is investigated differently from a complaint that describes a feeling of having been hacked. None of this guarantees an outcome, and any lawyer who promises recovery should be treated with caution.

Mistakes that stall recovery

The commonest mistake is reporting to the app and stopping there. The app is not the account holder and cannot reverse a bank debit. The second is waiting for the bank's call centre to call back instead of sending a written complaint to the nodal officer. The third is filing a general service grievance rather than an unauthorised transaction complaint, which routes the matter to the wrong team. The fourth is deleting the alerts to free up phone storage.

Two more deserve mention. Victims sometimes pay a self-described recovery service that promises to trace the money, which is a known follow-on fraud. And victims sometimes name a random person as the accused because a caller ID or a profile picture suggested an identity; the resulting complaint is easy to discredit and slows the real investigation. Identity is established by requisitioned records, not by what appeared on the screen.

When to involve a lawyer

Recovery of access and a prompt bank complaint do not need legal help. A lawyer becomes relevant when the bank rejects liability in writing, when the ombudsman has decided against the complainant, when the amount justifies a civil suit against an identified beneficiary, when the police refuse to register an FIR, or when the complainant is himself under scrutiny because a mule account was opened in his name. The value at that point is procedural: knowing which forum to approach, what record to place on affidavit, and how to frame the bank's non-compliance with the RBI directions. A cyber crime lawyer in Kolkata can review the escalation history before the next filing, and the wider set of remedies is set out under cyber crime legal services.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• YouTube account recovery complaint: escalation guide
• WhatsApp account recovery complaint: evidence and escalation
• TeamViewer account recovery complaint: steps after a hack
• LinkedIn account recovery: complaint, evidence, escalation
• Instagram account recovery complaint: evidence and escalation
• Google Pay harassment: complaint, evidence and the law

Cyber crime lawyer in your city · Bank account freeze help · Contact