Instagram hacked and money stolen: how to recover it

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Online fraud

Money lost after an Instagram hack is recovered through the bank, not the platform. Call 1930 immediately, notify the bank in writing the same day, and invoke the RBI's customer protection directions on unauthorised electronic transactions, which turn on how fast you report. The criminal side is cheating under BNS 318 and IT Act 66D.

Money lost after an Instagram account is hacked is recoverable through three parallel routes, and confusing them is the main reason victims lose time. The first is the bank: the RBI's customer protection directions on unauthorised electronic transactions decide how much of the loss the bank must bear, and they turn on how quickly you report. The second is the criminal process: the theft is cheating under section 318 of the Bharatiya Nyaya Sanhita 2023, and the takeover itself is an offence under sections 66, 66C and 66D of the Information Technology Act 2000. The third is compensation, which in practice comes from a chargeback, from the bank under the RBI framework, or from a civil suit against an identified wrongdoer.

Two fact patterns get described by the same phrase and need different handling. In the first, the intruder uses a payment method already linked to your account, or tricks you into approving a collect request, and money leaves your own bank account. In the second, the intruder uses your profile to persuade your followers to pay for goods, investments or a favour, and their money is lost. Your own loss is a banking dispute with a statutory framework. Your followers' loss is their banking dispute, and your role is that of a witness whose account was compromised.

Two frauds, two sets of rights

Where money left your account, you are a customer of a bank and the RBI's directions on unauthorised electronic banking transactions apply to you directly. Those directions require the bank to provide a channel for reporting unauthorised transactions, to register the complaint, and to resolve it within a defined period, with a provisional credit pending investigation where the amount is disputed. They also create a graded liability structure, so that a customer who reports promptly is treated differently from one who reports after weeks.

Where your followers paid the intruder, you are not the bank's customer in respect of that transaction and the RBI framework does not give you a claim. Your remedy is to help them report, to preserve the messages that show the fraud was committed from your compromised account, and to ensure the police complaint records their losses with transaction references so that the investigation covers the receiving accounts. Without that, each follower is left with an isolated complaint and no link between them.

What the RBI directions actually require

The customer protection directions issued by the Reserve Bank in 2017, which remain the reference point for unauthorised electronic transactions, rest on two ideas: the bank must make reporting easy and must not stall, and the customer's liability depends on speed and on whether the customer contributed to the loss. Reporting within three working days is the benchmark that matters most. A customer who reports within that window and has not shared credentials bears no liability, and the bank is expected to reverse the transaction. Report later, and liability is apportioned under the graded framework in the directions.

Where the loss results from the customer's own negligence — sharing an OTP, approving a collect request, or installing a remote-access app at a stranger's request — the bank's obligation is reduced, and this is where most Instagram-linked losses run into difficulty. The intruder typically obtains a one-time password or a UPI approval from the victim during the takeover. The bank's first response will be that the transaction was authenticated. The answer is not to argue that authentication never happened, but to show that the authentication was procured by impersonation of the account, that the bank was notified on the same day, and that the beneficiary account was flagged in time for a lien.

The Integrated Ombudsman Scheme, 2021 gives a customer a free route of complaint to the RBI ombudsman if the bank does not resolve the matter within the period set out in the directions or rejects it without reasons. The ombudsman is not a court and does not award damages in the way a civil suit can, but it is inexpensive, it is decided on documents, and an adverse award is enforceable against the bank.

The first twenty-four hours

Call 1930 immediately. The national cyber crime helpline registers financial cyber fraud and can trigger a request to the bank and to the payment system to freeze the beneficiary account. Speed here decides whether the money is still available to be frozen.
File on cybercrime.gov.in. Enter the transaction reference, the amount, the date, the receiving UPI handle or account number and the platform details. Keep the acknowledgement number; it is required by the bank and by the ombudsman.
Inform the bank in writing, not only by phone. Use the bank's official email or app-based dispute form, state that the transaction was unauthorised, give the 1930 acknowledgement, and ask for a provisional credit and for the complaint number. A phone call without a written record is difficult to prove later.
Ask for the beneficiary account to be lien-marked. The bank can place a lien on funds in the receiving account on the strength of the police complaint. This is time-sensitive and worth a specific written request rather than a general complaint.
Secure the Instagram account. Change the password, revoke unknown sessions, remove unfamiliar linked emails and enable two-factor authentication. If the account is still inaccessible, use the platform's compromised-account flow and keep the case reference.
Preserve the messages. Screen-record the conversations that led to the payment, from the first contact to the transfer confirmation, with the handle and timestamps visible. These are the messages that prove impersonation rather than a commercial dispute.
File the police complaint. Under section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023, give a written complaint at the police station with the evidence index and both reference numbers.

Documents that decide the bank's response

Document	Who needs it	What it establishes
1930 acknowledgement	Bank, police, ombudsman	Date and time of first report
Bank dispute reference	Ombudsman	That the bank was put on notice
Transaction statement	Bank, police	The exact debit, beneficiary and reference
Chat with the intruder	Police	Impersonation and inducement
FIR or complaint copy	Bank, court	That a criminal case exists
Section 63 BSA certificate	Court	Authenticity of the electronic record

The recovery routes, ranked by what they actually deliver

The fastest route is a freeze before the money is layered out of the beneficiary account. That depends entirely on the first call, which is why the helpline matters more than any letter written afterwards. The second is the bank's own reversal under the RBI framework, which is a documentary exercise: the bank examines whether the customer reported in time and whether the customer's own act enabled the fraud. The third is a chargeback where a card was used, subject to the card network's rules and the issuing bank's timelines.

The fourth is the criminal case, which can end in restitution if the accused is traced and convicted, or in a settlement during trial, but which is not a reliable route to getting money back quickly. The fifth is a civil suit for recovery against an identified person, which is useful where the fraud was committed by someone known — a former partner, an employee, a person with access to the account — and where the criminal case may take years. A suit can be filed alongside the criminal complaint, and the two do not contradict each other, though the civil court may stay proceedings while the criminal matter is pending.

What decides the outcome

Timing is the first factor, and in practice the only one that the victim fully controls. A report within hours gives the system a chance to freeze funds. A report after a week usually finds the beneficiary account emptied. The second factor is whether the customer's own act enabled the transaction: an OTP shared with a caller who claimed to be from the bank is treated differently from a transaction executed from a device the customer never used.

The third factor is documentation. Banks respond to files, not narratives. A complainant who produces the helpline acknowledgement, the written dispute, the statement and the chat in one bundle gets a decision; one who calls repeatedly gets call notes. The fourth factor is the identity of the wrongdoer. Where the intruder can be traced, restitution is possible; where the account was opened on a rented identity document, the case usually ends with the mule account holder and a small recovery.

The fifth factor is consistency across forums. The amount and the sequence given to the bank, the police and the ombudsman must match. Any variation is treated as a sign that the account was reconstructed, and it weakens every forum at once.

Mistakes that cost the recovery

Waiting for the platform to restore the account before calling 1930. The account and the money are separate problems, and the money has a shorter clock.
Reporting only to Instagram and assuming the bank will be informed.
Approving a collect request to check whether the account is active, which authorises the debit.
Sharing OTPs with anyone who calls claiming to be platform support or a bank officer.
Accepting a verbal assurance from the branch and not obtaining a written complaint number.
Deleting the chat with the intruder after blocking the profile.

One more point is worth stating plainly: an offer to recover the lost money for a fee, made by someone who contacts you after the fraud, is almost always a second fraud aimed at the same victim. Legitimate recovery runs through the bank, the helpline and the courts, and none of them requires a payment to an intermediary.

When to involve a lawyer

Small losses that the bank reverses are usually handled without legal help. A lawyer is useful when the bank refuses a reversal and an ombudsman complaint has to be drafted, when a large amount is involved and a civil suit for recovery is worth the cost, when the police treat you as a suspect because your account was the one used, or when the intruder turns out to be someone known and the criminal and civil tracks need to be run together without undermining each other. For a Kolkata complainant, the forums are the local police station, the cyber crime cell, the City Civil Court for a recovery suit, and the City Sessions Court or Calcutta High Court on a bail or quashing application.

Bring the helpline acknowledgement, the bank reference, the statement and the chat to the first meeting; those four documents usually determine whether there is a case worth pursuing. If the loss arose from a takeover rather than a payment, the recovery steps for the account itself are covered on the cyber crime lawyer in Kolkata page, and for a broader view of how these complaints are sequenced you can read the cyber crime blog or contact the office with the facts.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Can I get my money back after my Instagram account was hacked?

Sometimes, and speed decides most of it. Call 1930 at once so the beneficiary account can be frozen, then give the bank a written dispute the same day with the helpline reference. The RBI's directions on unauthorised electronic transactions govern how the loss is shared, and reporting within three working days is the key benchmark.

What is the RBI rule for unauthorised transactions?

The Reserve Bank's customer protection directions require banks to provide a reporting channel and resolve disputes within a defined period, with a provisional credit in appropriate cases. Liability is graded: a customer who reports within three working days and did not share credentials bears no loss, while delay or negligence shifts part of the loss to the customer.

Should I call 1930 or the bank first?

Call 1930 first, because the helpline can trigger a freeze request while the money is still in the beneficiary account. Then notify the bank in writing the same day, quoting the helpline acknowledgement. A phone call to the branch alone leaves no record, and the bank's timeline runs from the written complaint.

The bank says I shared an OTP. What now?

Do not argue that no authentication occurred. Show instead that the authentication was procured by impersonation of your hacked account, that you reported the same day, and that the beneficiary account was flagged in time. Put the grievance in writing and, if it is rejected without reasons, take it to the RBI ombudsman under the Integrated Ombudsman Scheme, 2021.

Can I file a police complaint for money lost to an Instagram hack?

Yes. Give a written complaint under section 173 of the Bharatiya Nagarik Suraksha Sanhita 2023, attaching the transaction statement, the helpline reference and the chat with the intruder. The offences are cheating under section 318 of the Bharatiya Nyaya Sanhita 2023 and cheating by personation under section 66D of the IT Act 2000.

What if my followers paid the hacker, not me?

Each follower has their own claim against their own bank, and each should call 1930 and file a complaint. Your role is to provide the evidence that your account was compromised, so their losses are linked in one investigation. Without that link, each complaint looks like an isolated payment and is harder to pursue.

Is Instagram or Meta liable for the money I lost?

A direct claim against the platform is difficult. Intermediaries have a safe harbour under section 79 of the Information Technology Act 2000 where they comply with the IT Rules 2021, and the loss usually flows from a payment authorised through a bank or UPI. The practical defendants are the beneficiary account holder and, on a failed reversal, the bank.

How long do I have to report the fraud?

Report within hours, not weeks. The RBI framework grades liability from the date of the transaction, and beneficiary accounts are emptied quickly. For the criminal complaint there is no short limitation period, but login and transaction records have retention limits, so a late complaint often has nothing left to investigate.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact