Instagram account recovery complaint: evidence and escalation

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber law

An Instagram account recovery complaint moves through four rungs: Meta's compromised-account flow, its India grievance officer under the IT Rules 2021, the Grievance Appellate Committee, and a police complaint under section 173 BNSS. Each rung needs the same core evidence, but a different form of request.

Recovering a hacked Instagram account in India is a complaint ladder, not a single filing. There are four rungs: the platform's own compromised-account flow, Meta's grievance officer designated under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021, the Grievance Appellate Committee set up under those rules, and the criminal process beginning with a complaint to the police under section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023. Each rung has its own evidence requirement, and most people climb only the first, which is why the account stays lost.

The legal character of the act does not change with the forum. Unauthorised access is an offence under section 66 of the Information Technology Act 2000, use of your credentials is identity theft under section 66C, and using the profile to cheat your contacts is cheating by personation under section 66D. Under the Bharatiya Nyaya Sanhita 2023 the same conduct is charged as cheating under section 318 and forgery under section 336 where records were fabricated. What changes from rung to rung is who can order what: the platform can restore access, the grievance officer can force a decision and a record, the Appellate Committee can review that decision, and only the police can compel production of login and IP data.

Rung one: the compromised-account flow

Meta's recovery tool asks for the identifier you used to sign up — the email address or mobile number — and then for a verification step. If the intruder has changed both, the flow offers a report of a compromised account, which requires a fresh email address for correspondence and, in many cases, a short video selfie that matches photographs on the profile. The video check is not a formality; it is the main reason recoveries succeed or fail, and it is assessed against the account's existing posts.

Before starting, gather the original signup email, the phone number linked at any time, the approximate date the account was created and the last password you remember. These details are what the identity review uses. Do not create a duplicate account to complain from; it confuses the matching and occasionally results in the duplicate being actioned instead. If you have the Instagram app still signed in on any device, do not sign out. An active session is the strongest proof of ownership and can be used to change the password from inside the app.

Rung two: the grievance officer and the 2021 Rules

Every significant social media intermediary must appoint a grievance officer resident in India, and the 2021 Rules require that officer to acknowledge a complaint within twenty-four hours and dispose of it within fifteen days. That timeline is the lever most complainants never pull. A written grievance that quotes the rule, states the handle, the date access was lost, the platform case reference and the harm suffered, and asks for a reasoned response within fifteen days creates an obligation that an in-app report does not.

Send it to the grievance officer's published address for India and keep the delivery record. If the answer is a template denial, or no answer arrives, the file is ready for the next rung. The grievance officer is also the correct recipient for a complaint about content published from the hijacked account, including morphed images, because the rules require expeditious action on complaints about non-consensual intimate imagery.

Rung three: the Grievance Appellate Committee

The 2022 amendment to the 2021 Rules created an appellate body that hears appeals against decisions of a platform's grievance officer. The appeal is made online, in the prescribed form, and it is decided on the record rather than through a hearing in court. It is not a court and cannot award compensation, but a decision from it changes a platform's position quickly, because non-compliance carries its own consequences under the IT Act framework.

An appeal that succeeds usually does so on documentation, not argument. Attach the original grievance, its acknowledgement, the fifteen-day deadline and the response or silence, and a one-page timeline. Do not attach the full chat history; attach an index and offer the full material if asked. The Committee is not the place to litigate who is telling the truth about a private dispute; it is the place to show that the intermediary failed to follow its own process.

Rung four: the criminal complaint

Parallel to all of this, the police complaint should be filed, because the platform cannot investigate the intruder. The first information report is what allows a lawful request for subscriber details, login records and IP logs, and those records are usually the only way to connect the account to a person. File it at cybercrime.gov.in or through the 1930 helpline, then give a written complaint at the police station under section 173 BNSS and take a receipt.

Where the station declines to register, ask for the reason in writing and apply to a magistrate under section 175(3) BNSS, which allows the magistrate to direct an investigation. The application should be short and should attach the written complaint, the receipt, the platform case reference and the grievance correspondence. Delay matters here more than anywhere else: platforms retain login records for limited periods, and an investigation that begins after three months may find nothing left to summon.

Preserve the evidence before recovery: screen-record the profile, the posts, the messages to contacts and the login alerts.
Attempt the platform recovery flow and record the case reference it issues.
Write to the grievance officer within the first week, quoting the twenty-four-hour and fifteen-day requirements.
File the police complaint with the evidence index and both references.
If the station refuses, obtain the refusal in writing and apply under section 175(3) BNSS.
If the grievance officer fails to decide, appeal to the Grievance Appellate Committee.
Follow up every ten days in writing, adding each new development to the file.

Keeping one timeline across all four rungs

None of these forums talk to each other, so the complainant has to be the connective tissue. Keep a single sheet with five columns: date, event, forum, reference number and what was asked for. Every email, portal acknowledgement, station receipt and appeal goes on the same sheet. When a magistrate asks why the investigation should be directed, or when the Appellate Committee asks what the grievance officer decided, the sheet answers the question in a glance instead of a paragraph.

It also protects against the most common failure in these cases, which is inconsistent accounts of the same facts given to different forums. A small discrepancy between the date given to the platform and the date given to the police is enough for a defence lawyer to argue that the complaint was reconstructed later. Write the chronology once, from the login alert emails and your own messages, and use those words in every filing.

What the evidence pack should contain

Item	Why it is needed
Proof of original ownership	Signup email, old login alerts, linked number; establishes the account is yours
Record of the intrusion	Security alert naming an unknown device, with date and location
Content published by the intruder	Establishes impersonation, cheating or obscenity, as the case may be
Harm caused to third parties	Messages to contacts, payment requests, complaints from followers
Section 63 BSA certificate	Makes the electronic record admissible without a separate authenticity fight
Grievance correspondence	Shows the intermediary had actual knowledge and how it responded

What decides whether access is restored

The first factor is the age and consistency of the account. An account with years of posts, a stable email and a linked phone is easier to verify than one created recently with no profile photograph. The second is whether the intruder removed your recovery options. If the email and phone were both changed and two-factor authentication was switched on by the intruder, automated recovery usually fails and the case depends on the manual review queue.

The third factor is what the intruder did with the account. An account used to run advertisements may be suspended for policy violations, and recovery then requires an appeal against the suspension as well as the takeover. An account used to post obscene material may be restricted while the review is pending. Understanding which action the platform has taken, and why, determines which form to file next; filing a takeover appeal against a policy suspension wastes the review slot.

The fourth factor is persistence with a paper trail. Complaints that are re-filed identically are treated as duplicates. Complaints that add a new element — the grievance officer's non-response, the police crime number, the identity review failure — move forward. A complainant who keeps a single timeline document and updates it is in a much stronger position than one who starts a fresh narrative each time.

Mistakes that stall a recovery complaint

Deleting the account's emails and login alerts in the belief that the account is gone for good.
Filing the police complaint only after the platform has already refused, losing weeks of record retention.
Using a lawyer's letter as a substitute for the platform's own grievance route. Both are needed; neither replaces the other.
Paying a third party to recover the account. Legitimate recovery never requires payment to an individual.
Sending screenshots without the handle or URL visible, which cannot be tied to the account.
Threatening the suspected intruder in writing, which can be turned into a counter-complaint of intimidation.

Two smaller points are worth knowing. A request to download your information from the platform is separate from a recovery request and can be made even while the account is locked, which is useful because it preserves a copy of posts and messages from before the takeover. And if the intruder linked a business portfolio or an advertising account, the recovery is not complete until those assets are secured, since a restored personal profile with an exposed ad account is still an open door.

When to involve a lawyer

If the account is personal and the platform restores it within a fortnight, the legal process may never be needed. A lawyer becomes useful when the account was used to defraud others, when the intruder is known or suspected and the police are treating the matter as a dispute between acquaintances, when private images were published and time is critical, or when a suspension appeal and a takeover appeal have to be run together. In Kolkata, filings go to the local police station and cyber crime cell, with bail or quashing applications before the City Sessions Court and the Calcutta High Court.

The order of filings is the part that most people get wrong, and it is the part that a short review can fix before anything is sent. If you are drafting the grievance and the police complaint yourself, keep them factual and short. If you would rather have the escalation mapped first, contact the office with the handle, the date access was lost and the platform case reference. For background on how these matters are handled in the city, see the page on the cyber crime lawyer in West Bengal.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

How do I file an Instagram account recovery complaint in India?

Start with Meta's compromised-account flow, which issues a case reference. Then write to the platform's India grievance officer quoting that reference, and file a police complaint under section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023. Keep every acknowledgement; the sequence of references is what shows the intermediary was notified and when.

How long does Instagram have to answer a grievance in India?

The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules 2021 require a significant social media intermediary to acknowledge a complaint within twenty-four hours and dispose of it within fifteen days. Those timelines apply to the grievance officer, not to the ordinary in-app report, which is why a written grievance to the officer is worth sending.

What is the Grievance Appellate Committee?

It is a body created by the 2022 amendment to the IT Rules 2021 to hear appeals against decisions of a platform's grievance officer. Appeals are filed online and decided on the record. It is not a court and cannot award compensation, but its decisions change a platform's position quickly because non-compliance carries consequences under the IT Act framework.

Can I appeal if Instagram rejects my recovery complaint?

Yes, in two directions. Against the platform, an appeal lies to the Grievance Appellate Committee once the grievance officer has decided or failed to decide within fifteen days. Against police inaction, an application under section 175(3) of the Bharatiya Nagarik Suraksha Sanhita 2023 asks a magistrate to direct investigation. The two routes are independent.

Does filing an FIR help recover a hacked Instagram account?

Indirectly. The FIR does not restore access, but it lets the police request subscriber, login and IP records from Meta, which a private person cannot obtain. Those records identify the device and network used, and they are often the only evidence that survives after the platform closes its ticket.

What documents does Instagram ask for in an identity review?

Usually the email or phone number used to create the account, the last password you remember, and a short video selfie. For an impersonation report, a government photograph identity document with a matching name may be requested. Send only what is asked, and redact numbers that are not needed for the match.

What evidence should I collect before complaining?

Login alert emails showing the unknown device and location, screenshots of the profile as the intruder left it, messages sent from your account to contacts, and the platform case reference. Keep the originals on the device, and prepare a section 63 Bharatiya Sakshya Adhiniyam 2023 certificate identifying the device, account and hash value.

Is a police complaint necessary if the account is restored?

Not always, but consider it. Restoring access closes the platform ticket, not the offence. If the intruder defrauded your followers or published private material, the criminal record protects you from being treated as the person responsible, and it preserves the login data before the retention period ends.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact