LinkedIn account recovery: complaint, evidence, escalation

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber crime

Recovery complaints fail for boring reasons: the wrong channel, an incomplete evidence pack, and no written record of the request. This is the escalation sequence — grievance officer, Grievance Appellate Committee, 1930 and the cyber crime portal, FIR under s 173 BNSS, and the Magistrate under s 175(3).

If you have already lost access to your LinkedIn account and the ordinary password reset has failed, you are past the point of clicking around the login screen. What follows is a complaint process with its own rules, its own evidence standard and its own escalation ladder. Handled properly it usually ends with the account restored and a documented record that protects you if the attacker used your name to cheat people. Handled casually it ends with three automated emails and no proof that you ever reported anything.

This guide is for the person who has decided to complain and wants to do it in an order that a police officer and, if necessary, a Magistrate will accept.

Why the ordinary support ticket is the wrong instrument

LinkedIn's general help flow is designed to answer questions. A recovery complaint is designed to create a legal record. The difference matters because under s 79 of the Information Technology Act, 2000 an intermediary gets safe harbour only if it observes due diligence, and the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 translate that into specific obligations: publish a grievance officer, acknowledge a complaint within twenty-four hours, and dispose of it within fifteen days. As a significant social media intermediary LinkedIn also maintains a nodal contact person and a chief compliance officer.

Those are statutory functions. A complaint addressed to the grievance officer in the prescribed manner starts a clock. A message to a generic support address does not. So the first practical step in any recovery complaint is to find the grievance officer's published details on the platform and write to that address, copying your own email so you keep a copy.

What goes into the complaint

A good complaint is short, factual and complete. It should identify the account by its public profile URL and the email address registered at the time of the takeover, state the date and time you last had access and the date you discovered the loss of access, describe how you believe access was obtained if you know, and list what you want.

The list of what you want should be explicit, because a general request for help gets a general answer:

Restoration of access to the account, or assistance in recovering it through the identity verification route.
Preservation of access logs, login history, IP addresses and device identifiers for the relevant period, pending a request from an investigating agency.
Removal of any content, connection requests or messages sent during the unauthorised period.
Written confirmation of the date on which the account was compromised and the date on which control was restored, if the platform can determine those.
A copy of the acknowledgement with a complaint reference number.

Ask for the preservation in the same message rather than in a later one. Platforms retain logs for limited periods and the retention clock does not pause while your ticket sits in a queue.

The evidence pack, built once and reused

You will send the same evidence to the platform, the portal and the police. Build it once, in a form that satisfies s 63 of the Bharatiya Sakshya Adhiniyam, 2023, and reuse it everywhere.

Section 63 replaced the old s 65B of the Indian Evidence Act and deals with the admissibility of electronic records. It requires a certificate in the prescribed form, signed by the person occupying a responsible official position in relation to the operation of the relevant device or the management of the relevant activities, identifying the electronic record, describing the manner of its production, and dealing with the integrity of the device and the conditions of its operation. In plain terms: a screenshot on its own is an allegation; a screenshot with a signed certificate is evidence.

Item	Why it matters	How to prepare it
Login and security history	Shows sessions you did not start, with device and location	Export or screenshot with time zone visible, before you revoke sessions
Messages sent by the attacker	Proves the account was used against your contacts	Capture the thread, the sender profile, and the timestamp in one frame
Notification emails	Independent corroboration of password and email changes	Preserve the original emails, do not forward them as new mail
Your complaint to the platform	Fixes the date you reported the compromise	Keep the sent copy and the acknowledgement reference
Section 63 BSA certificate	Makes the screenshots admissible	Signed by the person who took the screenshots on the device used
Hash values	Shows the files have not changed since capture	Compute SHA-256 at the time of copying and record it in the certificate

Two details are commonly got wrong. The certificate must be signed by a person who can speak to the device and the process, which is usually you and not a third-party service that took the screenshots for you. And the device described in the certificate must be the device that actually produced the copy, not your laptop if the capture was made on a phone.

The escalation ladder

Escalation is not about being louder. It is about moving to a forum that has a power the previous one lacked.

In-product report. Report the account as compromised through LinkedIn's security flow. This triggers the platform's internal recovery process and creates an internal ticket.
Grievance officer, in writing. Send the complaint described above. Expect acknowledgement within twenty-four hours and a decision within fifteen days. If the decision is a template refusal, ask for the specific reason and the logs you requested.
Appeal to the Grievance Appellate Committee. The IT Rules provide an appeal against a grievance officer's decision. This is a statutory review and it is free; it is also the step almost everyone skips.
1930, if money moved. The helpline is not a general complaint line. It exists to freeze funds, so use it the same day if the attacker induced a payment from your connections or from you.
cybercrime.gov.in. Register the incident and attach the evidence pack. The acknowledgement number is a national record that later supports the FIR and any insurance or bank claim.
FIR under s 173 BNSS. File at the station with jurisdiction, ordinarily where you reside or where the effects were felt. Attach the printed complaint, the evidence pack and the certificate. Ask for the FIR number and a copy of the FIR, which you are entitled to receive.
Section 175(3) BNSS application to the Magistrate. If the station refuses to register, apply to the Magistrate, who can direct registration or investigation. In Kolkata this is ordinarily filed before the Chief Metropolitan Magistrate at Bankshall Court.
Civil or writ proceedings. A suit for damages and an injunction, or in an exceptional case a writ, is the last rung. It is appropriate where the platform has ignored a lawful order rather than where it has simply been slow.

Note that steps two to seven are not alternatives. Each creates a document that the next forum expects to see. A Magistrate asked to direct an investigation into an account takeover will want to know what the platform said, and when.

What the police can do that the platform cannot

An intermediary can restore your account. It cannot compel the production of records from a third party, it cannot search a premises, and it cannot freeze a beneficiary account. The police can. Under the BNSS they can register an FIR, issue notices for the production of documents and electronic records, seize devices, and seek preservation orders from a court. Where the takeover fed a financial fraud, the proceeds can be attached under the proceeds-of-crime provisions of the BNSS, and courts have power to order the return of seized property at the conclusion of proceedings.

This is the practical argument for filing the FIR even when the platform has already restored access. Restoration fixes your access; it does not identify the person who took the account, and it does not create a record that protects you when your contacts complain that they were cheated by a message sent from your profile.

Timelines that matter

Three clocks run at once. The platform's fifteen-day disposal window under the IT Rules determines how long you wait for an answer. The bank's response window, where money moved, is measured in days and not weeks. And the evidentiary clock is the shortest of the three: access logs expire, the attacker deletes traces, and your own memory of the sequence of events fades within a fortnight.

The most common failure we see is a complainant who spent three weeks in the platform's review queue and then went to the police with screenshots taken after access was restored, by which time the login history had been wiped. Write to the platform and file the portal complaint on the same day. The two processes are independent and neither waits for the other.

Common reasons a recovery complaint is rejected

Identity could not be verified. The platform cannot restore an account to someone it cannot match to the registered identity. Use the verification route with a government photo identity document and a fresh email address.
The complaint was sent from the compromised email. The attacker may be reading it. Send from a different address and say so in the message.
No reference number was retained. Without it, neither the appellate committee nor the police can tie your account to a specific complaint.
The evidence was edited. Cropped screenshots with the timestamp removed are worse than useless, because they invite the argument that you fabricated the sequence.
The request was for "action" without specifying it. Preservation, restoration and removal are three different requests with three different internal processes.

When to bring in a lawyer

A lawyer is not needed to send a grievance complaint. A lawyer is needed when the platform's answer is a refusal, when the police decline to register the FIR, when your contacts have lost money and are looking at you, or when the logs have to be obtained through a court order because the platform will not act on a request from the victim directly. At that point the work is the drafting of an application that a Magistrate can act on, supported by a certificate that will survive cross-examination. If your matter is in West Bengal, the forum-by-forum position is set out under cyber crime law in West Bengal, and you can have the evidence pack reviewed before filing through the cyber crime lawyer in Kolkata page.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

How do I complain to LinkedIn's grievance officer in India?

Use the grievance officer's details published on LinkedIn's India grievance page, and write from an email address the attacker does not control. State the profile URL, the date access was lost, what you want preserved and restored, and keep the acknowledgement reference. The IT Rules 2021 require acknowledgement within 24 hours and disposal within 15 days.

What is a section 63 BSA certificate and do I need one?

It is the certificate required under s 63 of the Bharatiya Sakshya Adhiniyam, 2023 to make an electronic record admissible. It identifies the record, the device and the manner of production, and is signed by the person responsible for the device. Without it, screenshots of a hacked account are easily challenged in court.

Can the Grievance Appellate Committee review LinkedIn's decision?

Yes. The IT Rules 2021 provide an appeal to the Grievance Appellate Committee against a grievance officer's decision. It is a statutory, free remedy that most complainants never use. Keep the grievance officer's order and acknowledgement, because the appeal is decided on that record.

How long does LinkedIn keep login history and IP logs?

LinkedIn does not publish a fixed retention period for security logs, which is why you should request preservation immediately rather than relying on availability later. Investigating agencies can requisition the records, but only while they still exist, so the preservation request should go out in the first message.

Do I need an FIR if LinkedIn restores my account?

It is still worth filing one. Restoration gives you back access, but it does not identify the attacker or create a record that protects you if your connections were cheated from your profile. An FIR also gives the police power to requisition logs and to attach proceeds where money moved.

What if the police station refuses to register my LinkedIn hack complaint?

Ask for the refusal in writing, then apply to the Magistrate under s 175(3) of the BNSS. The Magistrate can direct registration of the FIR or order an investigation. Attach your complaint to the platform, the portal acknowledgement and the evidence pack so the application rests on documents rather than assertion.

Can I claim damages for a hacked LinkedIn account?

Yes, in principle. Section 43 of the IT Act 2000 makes unauthorised access actionable, and a civil suit can seek compensation and an injunction. Damages are realistically recoverable only where the person behind the takeover can be identified or where the platform ignored a lawful order, so the criminal track usually comes first.

Is it legal to pay someone to recover my hacked LinkedIn account?

Paying a third party to break into the account is itself unauthorised access under s 66 of the IT Act 2000 and can make you a participant in the offence. Legitimate help means the platform's own recovery flow, the police, or a lawyer acting through lawful channels. Treat any guarantee of recovery as a fraud signal.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact