Hacking of email: what it is and how the fraud actually runs

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber crime

When people say an email account was hacked, they usually mean one of two things: the password was captured from the owner through a fake login page or a convincing message, or a device that was already signed in was used by someone else. Genuine defeat of mail encryption is rare and expensive, and the ordinary method is deception. That is why the law describes the attacker as a person who obtains access dishonestly rather than one who breaks a technical safeguard, and the distinction decides which sections apply to the conduct and what the victim must ultimately prove.

Section 43 of the Information Technology Act, 2000 makes a person liable for accessing, downloading, copying or introducing a contaminant into a computer resource without the permission of the owner. Section 66 turns that conduct into a punishable offence where it is done dishonestly or fraudulently, and sections 66C and 66D add identity theft and cheating by personation. A mailbox is a computer resource, so an unauthorised login falls squarely inside these provisions, whether or not any technical protection was defeated.

What hacking of an email account actually means

Three elements separate a hack from an ordinary mistake. The first is absence of permission: the owner did not knowingly allow the access. The second is dishonest intent: the person who gained entry meant to read, copy, send or delete, not merely to look. The third is use of a computer resource, which a mailbox plainly is. Where all three are present the conduct is both a civil wrong and a criminal offence, and the same facts can support a complaint to the police as well as a claim by the owner for the loss that followed.

An often misunderstood point is that the attacker need not have broken anything. Obtaining a password through a phishing page, a lookalike login screen, a keylogger or a social ploy is still unauthorised access, because the entry is without the owner's effective consent. Consent given because of a deception is not consent in law, and this is why the ordinary phishing case is prosecuted with the same sections as a technical intrusion rather than being dismissed as the victim's own fault.

How the fraud actually runs, stage by stage

Stage one: the way in

The attacker sends a message that mimics a known service, a colleague, a bank or a courier, and leads the recipient to enter credentials on a page the attacker controls. Alternatively the attacker uses a device that is already unlocked and signed in, or reuses a password leaked from an unrelated breach, which is exactly why reusing a single password across services is dangerous. Occasionally the route is a malicious attachment or a malicious browser extension that reads what should be private.

Stage two: staying in

Once inside, the attacker rarely relies on the password alone. Malicious mail rules, hidden forwarding addresses and app passwords are added so that a later password change does not evict the intruder, and copies of incoming mail are quietly redirected to an address the owner never sees. This is why a victim who changes the password and believes the problem is solved often loses a second time, and why every unknown rule, forwarding entry and app password must be removed deliberately.

Stage three: converting access into money

Holding the mailbox, the attacker reads the correspondence, learns the language of the owner's business, and interposes. A supplier's invoice is intercepted and the bank details are swapped. A customer is told, from the genuine address, that the company's account has changed. Password-reset links for other services are triggered and captured. Contact lists become the next set of targets, so a single compromised mailbox can produce many spoofed messages and turn one victim into a chain of victims.

Stage four: covering the trail

Sent items, rules and login history are cleaned, and the mailbox may be used only from unfamiliar locations at odd hours. By the time the loss is noticed, the victim's own mailbox often retains the least evidence, which is why the mail provider's access logs and the bank's transaction trail, not the victim's inbox, usually carry the case. This is also why demanding those logs in writing early is more useful than searching the inbox again.

What the law says

Under the Information Technology Act, 2000 the entry point is section 43, and section 66 makes the dishonest or fraudulent version punishable. Section 66C covers identity theft through the fraudulent use of another person's password or unique identification feature, which fits the reuse of a stolen mailbox password to reach other accounts. Section 66D covers cheating by personation using a computer resource or communication device, which fits the messages sent from the hacked address. Where stored records are deleted or altered, section 65 and section 66 are the relevant provisions to consider.

Under the Bharatiya Nyaya Sanhita, 2023 the money fraud is charged as cheating under section 318, or cheating by personation under section 319 where the attacker poses as the owner, with forgery under section 336 where documents are fabricated and criminal breach of trust under section 316 where the attacker was in a position of trust. Where several persons act together, the common intention and abetment provisions are applied alongside the substantive offences.

The attacker's entry is an offence under the IT Act; the money taken as a result is a cheating offence; the two are investigated together but proved separately, each with its own evidence.

Why email is such a productive target

A mailbox is the master key to a modern life. It receives password-reset links for banking, social media, government portals and cloud storage, and it holds the thread of almost every financial conversation a person or a business conducts. An attacker who controls the mailbox can therefore trigger a reset on almost any other account, and can mimic the owner convincingly because the owner's own writing, signatures, letterheads and contacts are all present. That is why a hack rarely ends at the mailbox: the mailbox is the staging point for everything that follows, and the owner's other accounts are the real prize.

What decides the outcome

Whether a complaint succeeds turns on the record of access. The provider's login history, the mail rules that were added, the IP addresses and the timestamps are what place the intruder at the account, and they must be preserved through the prescribed certificate for electronic records under section 63 of the Bharatiya Sakshya Adhiniyam, 2023. Whether the money comes back turns on traceability and on how quickly the transfer was reported. And whether the owner's position is strong or weak against the bank turns on whether any one-time password or password was shared, because that is the point the bank will press hardest.

It also matters whether the owner acted once the hack was discovered. A mailbox left compromised after the owner had notice gives the attacker a longer window and weakens the owner's account of the loss, while prompt reporting strengthens both the criminal case and the position against the bank.

Telling a hack from a spoof

Not every forged message means the account was hacked. In a spoof, the sender line is forged but the mailbox itself is untouched and the owner's sign-in history shows nothing unusual, so the fix is chiefly reputational and criminal rather than a password reset. In a genuine hack someone has actually entered the account, and the sign-in history, the mail rules and the sent items will show it. The distinction decides whether there is an account to secure at all, and it changes what the provider's logs will show the police.

What the police investigate first

Investigating officers usually start with the money rather than the mailbox, because money leaves a trail that can still be frozen. They ask the provider for access logs, ask the banks and payment intermediaries for the chain of the transfer, and look for the account that received the funds. The mailbox is what proves identity and intent, and the money trail is what proves the loss, so a complainant should be ready to supply both without being asked twice.

Warning signs that a mailbox is compromised

• Contacts receive mail you did not send, often asking for money or a favour.
• Sent items contain messages you do not recognise, or the sent folder has been emptied.
• Password-reset emails arrive for accounts you did not touch.
• Mail is missing, delayed or arriving in folders you did not create.
• Unfamiliar devices appear in the account's session or security settings, and new forwarding rules or app passwords exist that you did not add.

What not to do

Do not simply change one password and stop, because hidden rules and app passwords survive that change. Do not delete the mailbox to be safe, because the evidence goes with it. Do not confront the attacker or reply from a normal device, because that reveals your next move and invites a fresh attempt. And do not delay the bank report while you work out the full picture, because the liability position hardens with each passing day even as the facts are still being assembled.

Securing the account after a hack

Recovering the mailbox and recovering the money are separate projects on separate clocks. Secure the account first: sign out all sessions, remove every unknown rule, forwarding address and app password, change the password from a trusted device, and enable two-factor authentication. Then document what the attacker did while inside, and only afterwards turn to the bank and the police. A victim who secures the account and preserves the record leaves the attacker with neither a way back in nor an argument that the owner was careless.

When to involve a lawyer

A single compromised personal mailbox with a small loss can often be managed through the provider's recovery process and the national cyber channels. A lawyer becomes necessary when money has moved, when a business relationship is at stake, when the intruder keeps returning, or when the provider and the bank each point at the other. A cyber crime lawyer in Kolkata can map the facts onto the IT Act and BNS sections, draft the complaint so that the technical and money parts are not confused, and pursue the recovery. For a West Bengal complainant the cyber crime lawyer in West Bengal page sets out local practice, and contact the office if you want the account history reviewed before you file.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• Email spoofing: what it is and how it works in India
• Business email compromise what it is and how it works
• Matrimonial fraud: what it is and how it actually runs
• Trading app scam: what it is and how the fraud runs
• Stock market scam: how the fraud actually runs in India
• Sextortion: What It Is and How the Fraud Actually Runs

Cyber crime lawyer in your city · Bank account freeze help · Contact