LinkedIn hacked and money debited: how to recover it legally

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Online fraud

Recovery depends on speed and on one document: your written report to the bank. Call 1930 the same day, tell the bank in writing within three working days, and the RBI's customer protection rules put the burden of proving your negligence on the bank, not on you.

When a LinkedIn takeover turns into a debit on your account, the crime has moved from your profile to your bank, and the rules that decide whether you get the money back are banking rules, not criminal ones. The RBI's direction on customer protection for unauthorised electronic banking transactions limits your liability where the fraud did not result from your own negligence, and it places the burden of proving negligence on the bank. But that protection is conditional on you reporting the transaction to your bank without delay, and the delay thresholds are short.

So the order of operations is not intuitive. Most people spend the first day trying to recover the LinkedIn account. The correct first move is the bank and 1930, because money can be frozen while it is still in the banking system and cannot be frozen once it has been withdrawn across a chain of accounts. The LinkedIn recovery can run in parallel; it cannot run first.

How the money actually leaves

A hacked profile is rarely used to attack your bank directly. It is used to borrow your credibility so that someone else authorises a payment. Four patterns account for most of these cases.

The fake invoice. The attacker, in control of your account, messages a supplier or client you deal with and sends revised bank details for an upcoming payment. The payer remits to the attacker's account believing it is dealing with you. You discover it when the real supplier asks where the money is.
The recruitment deposit. Candidates are told that a role is confirmed and that a refundable deposit or document-verification fee is required. The payments go to the attacker, and the candidates later name you.
The investment introduction. The attacker, as you, introduces a contact to a "wealth manager" and the contact funds a trading account that does not exist.
The credential harvest. The attacker messages you a link from a compromised contact's account, you sign in, and the resulting access is used to empty an account or authorise a UPI mandate.

Only the last one involves your own account being debited. In the first three, the loss falls on third parties and your exposure is reputational and criminal, not financial — but you still need to prove you were not the operator.

What the law and the regulator say

Section 66C of the IT Act 2000 covers the use of another person's password or unique identification feature, and s 66D covers cheating by personation using a computer resource. Section 66 covers unauthorised access. On the penal side, s 318(4) BNS punishes cheating and thereby dishonestly inducing delivery of property, s 319 BNS covers cheating by personation, s 336 BNS covers the forgery of the invoice or instruction, and s 61 BNS covers conspiracy where several people worked together. Where the fraud involves an impersonation of a government officer or a fake investigation, the digital arrest pattern, s 308 BNS (extortion) is frequently added.

On the regulatory side, the RBI's direction on limiting customer liability in unauthorised electronic banking transactions sets out the framework the bank must apply. Its structure is worth understanding because it decides your claim before any court sees it:

Your report to the bank	Indicative liability position	What the bank must do
Within three working days	Zero liability, where the fraud is not attributable to your negligence	Reverse the debit and investigate; no burden on you to prove negligence
Within four to seven working days	Liability capped at the transaction value limit set by the RBI direction	Reverse the excess above the cap after investigation
Beyond seven working days	Liability determined under the bank's policy and the RBI's customer protection framework	Decide the claim on the policy, with reasons
Any time, where the fraud was caused by your own sharing of credentials	Liability ordinarily rests with you	Still investigate, and still report the offence

Two things follow. The written report is not a formality — it is the trigger for the liability rule. And "negligence" is the battleground. The bank must show that you failed to protect your credentials; you are not required to prove that you were careful.

The recovery sequence

Call 1930 and register the fraud. Give the transaction reference, the amount, the time, the beneficiary account if visible, and the fact that your LinkedIn account was compromised. The helpline routes the report into the financial-intelligence chain so that the receiving bank can be asked to hold the funds.
Call your bank's fraud line and then write to it. The phone call starts the freeze; the written complaint, by email to the nodal officer with the transaction details and a request for reversal, starts the liability clock. Send it the same day and keep the acknowledgement.
Block the instrument. Freeze the card, disable net banking on the affected account, revoke UPI mandates you did not create, and remove the device from the trusted list. If the attacker changed your registered mobile number, go to the branch in person with identity proof.
File on cybercrime.gov.in. Register the incident and upload the bank statement pages showing the debit, the complaint to the bank, and the acknowledgement from 1930.
File the FIR under s 173 BNSS. File at the station with jurisdiction, ordinarily where you reside or where the account is held. Attach the printed complaint and the bank's acknowledgement. The FIR is what allows the police to requisition KYC and IP data from the beneficiary bank.
Escalate within the bank if the reversal is refused. Ask for the decision in writing with reasons, then use the bank's internal grievance redressal, and if that fails, the RBI's integrated grievance redressal portal. A refusal without reasons is itself a useful document.
Use s 175(3) BNSS if the police refuse to register. Apply to the Magistrate for a direction to register or investigate. In Kolkata this is ordinarily filed before the Chief Metropolitan Magistrate at Bankshall Court.
Consider a civil suit for the unreversed amount. A suit against the bank for the debit, or against an identified beneficiary where the money is traceable, is the last resort. It is usually run only after the bank's internal and regulatory remedies have produced a written refusal.

Tracing the money before it disappears

Recovery in these cases is a race through the banking chain, and the chain has stages where the money can still be stopped. The first is the beneficiary bank: while the funds sit in the receiving account, a freeze request from the police or from your bank can hold them. The second is the settlement cycle: an interbank transfer that has not yet settled may be recalled. The third is the withdrawal point, and once cash leaves the branch or the ATM there is usually nothing left to freeze.

What you can do is give the system the identifiers it needs to act. That means the beneficiary account number and IFSC, the exact amount and timestamp, the UTR or reference number from your own statement, and the name on the receiving account if your bank displays it. A complaint that lists these in a table takes an officer ten minutes to act on; a narrative complaint takes a day to decipher. It is also worth asking your bank, in writing, whether a chargeback has been raised and on what date, because that date determines how much of the loss the bank can still recover from the other side.

What decides whether you are refunded

The date of your written report. This is the single largest factor. A report on day two with a reference number is a different claim from a report on day twelve. Banks routinely reject claims on this ground alone, and the rejection is difficult to displace.

Whether you shared an OTP, PIN or password. If you did, the bank's position is that the transaction was authorised, and the RBI framework supports it. This is why the account takeover narrative matters: if the debit followed a phishing page that captured your credentials, say so precisely and preserve the page or message that led you there.

Whether the beneficiary account was frozen in time. Money that stays in the banking system can be held. Money withdrawn in cash within the hour usually cannot be recovered from the beneficiary, and the claim becomes a claim against the bank's liability rule instead.

Whether the bank followed its own process. The RBI direction requires the bank to investigate, to communicate its decision, and to credit the amount in cases of zero liability. Where it did not, the internal record becomes evidence in your favour.

None of this requires technical knowledge. It requires that the identifiers reach the right desk while the money is still where it can be held, and that you keep a written record of when each request was made. A complainant who can produce that record on day ten is in a materially stronger position than one who can only describe a phone call.

What not to do

Do not wait for LinkedIn to finish its review before calling the bank. The bank's clock does not pause for the platform's process.
Do not accept a verbal assurance that "the matter is under investigation". Ask for a complaint reference and a written decision.
Do not delete the phishing message or the fake invoice. They prove how the credentials were obtained and rebut an allegation of carelessness.
Do not pay a "recovery agent" who asks for an upfront fee to trace the money. This is a second fraud aimed at people already defrauded, and it is common.
Do not file only a civil suit. Without the FIR and the 1930 record, the criminal trail goes cold and the bank argues that you never reported promptly.

When to involve a lawyer

If the bank has reversed the debit, you probably do not need a lawyer. If it has refused, or if your contacts lost money and are treating you as the person responsible, the work becomes documentary and time-sensitive: a written claim that tracks the RBI framework clause by clause, an FIR that names the right sections, and where necessary an application under s 175(3) BNSS or a suit for the unreversed amount. That is the point at which advice is worth taking, before the bank's rejection hardens into its final position. For the Kolkata and West Bengal position on these filings, see cyber crime law in West Bengal, and for the civil track against a bank or a beneficiary, civil litigation sets out how those claims are pleaded.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Can I get my money back after my LinkedIn account was hacked?

Often, if you act quickly. Call 1930 the same day and report the debit to your bank in writing within three working days. Under the RBI's customer protection direction, a prompt report gives you zero liability where the fraud was not caused by your negligence, and the bank must investigate and decide.

What is the three working day rule for unauthorised transactions?

The RBI's direction on limiting customer liability requires you to notify your bank within three working days of the unauthorised transaction to claim zero liability. Reporting between four and seven working days limits your liability to the cap the direction prescribes. Beyond that, the bank's policy applies.

Who has to prove negligence in a bank fraud claim?

The bank does. Under the RBI framework the burden of establishing that the customer failed to protect their credentials rests with the bank, not the customer. That is why a written report that sets out the facts without admitting to sharing an OTP or password matters so much.

Should I file an FIR or just complain to the bank?

Both. The bank complaint starts the liability and reversal process, while the FIR under s 173 BNSS gives the police power to requisition KYC and IP records from the beneficiary bank. A bank claim without an FIR is weaker, and an FIR without a written bank complaint loses the liability protection.

How long does a bank take to reverse a fraudulent debit?

The RBI direction requires the bank to resolve the complaint within a defined period and to communicate its decision in writing. In practice reversals after a prompt report often take days to a few weeks, while contested claims take longer. Ask for the reference number and the written outcome at each stage.

What if my contacts paid money to a hacker using my LinkedIn profile?

Their loss is their claim, but your risk is being named as the fraudster. Report the compromise to LinkedIn and the police on a fixed date, warn your network in writing, and keep those records. They establish that you were a victim of the takeover and not the person who received the money.

Can I sue my bank for not refunding the money?

Yes, after exhausting the bank's grievance process and the RBI's integrated grievance redressal portal. A civil suit can seek the amount with interest and costs, and the bank's written refusal becomes a key document. Courts look closely at whether you reported within the RBI's timelines.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact