My LinkedIn account was hacked — recovery, FIR and legal steps

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber crime

If your LinkedIn account has been taken over, treat it as two separate problems running at the same time. One is access: you need the profile back before the attacker uses your name to approach your connections. The other is legal: a takeover is unauthorised access to a computer resource under s 66 of the Information Technology Act, 2000, and where the attacker used your password, profile or identity, it is identity theft under s 66C of the same Act. Where the account was then used to induce your contacts to part with money, s 66D (cheating by personation using a computer resource) and s 318 of the Bharatiya Nyaya Sanhita, 2023 also come into play.

In practice the legal route only works if the technical route is done in the right order. A complaint filed after the attacker has deleted your sent mail, changed the recovery number and removed your sessions is a complaint with no evidence behind it. So the sequence that matters is: regain control, lock the account down, export what you can still see, and then put the platform and the police on notice in writing.

How LinkedIn accounts actually get taken over

Most people expect to find a dramatic breach. What they usually find is a password that was reused on a site that leaked years earlier, or a message that looked like a recruiter sharing a document. The common entry points are worth knowing because they decide what evidence exists afterwards.

• Credential reuse. The attacker has your email and an old password from a breach elsewhere and simply tries it. No malware is involved and nothing on your device looks wrong.
• Phishing that mimics a job offer. A document or a "candidate profile" link asks you to sign in again. The page captures the session, not just the password, so changing the password afterwards does not always evict the attacker.
• Session cookie theft. Infostealer malware on a laptop lifts the authenticated session, which lets the attacker stay logged in even after a password reset until sessions are explicitly revoked.
• Recovery-channel takeover. A compromised email inbox or a SIM swap on the registered mobile number lets the attacker reset the password themselves and receive the verification code.

Two consequences follow. First, revoking active sessions matters as much as changing the password. Second, if your email inbox was the way in, the LinkedIn takeover is a symptom and the inbox is the actual crime scene.

What the law says

Section 43 of the IT Act 2000 makes unauthorised access, downloading, copying or extraction of data from a computer resource actionable, and s 66 makes the same conduct criminal where it is done dishonestly or fraudulently, punishable with imprisonment up to three years or a fine up to five lakh rupees, or both. Section 66C covers the dishonest or fraudulent use of another person's electronic signature, password or other unique identification feature, which is the provision that fits a stolen login most directly. Section 66B applies to a person who dishonestly receives or retains a stolen computer resource or communication device, and is relevant where an account is bought rather than hacked.

On the penal side, s 318(4) BNS punishes cheating and thereby dishonestly inducing delivery of property with imprisonment up to seven years and a fine, and s 319 BNS deals with cheating by personation. If a forged document or electronic record was created to support the impersonation, s 336 BNS (forgery) is the provision to cite. Conspiracy, where more than one person is involved, is s 61 BNS.

Two procedural provisions decide whether the case survives contact with a court. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 governs the admissibility of electronic records and requires a certificate in the prescribed form, signed by the person in charge of the device or the management of the relevant activity, describing the manner of production. Without that certificate, screenshots are extraordinarily weak. And s 79 of the IT Act gives LinkedIn safe harbour as an intermediary only if it observes due diligence, which is why the platform's grievance officer is a statutory figure and not just a support desk. Under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, a grievance must be acknowledged within twenty-four hours and disposed of within fifteen days.

The steps, in order

1. Recover access through LinkedIn's own hacked-account flow. Use the Help Centre route for a compromised account rather than the ordinary password reset. If the email on the account was changed, the recovery form allows you to submit identity proof and a new email address.
2. Secure the email inbox first if it was compromised. Change that password, enable two-factor authentication with an authenticator app rather than SMS, and check for forwarding rules and connected applications you did not add.
3. Revoke every active session. In LinkedIn, sign out of all devices, then change the password again from the clean device. This is the step people skip, and it is the one that ends a cookie-based intrusion.
4. Export and photograph what remains. Download your data archive, screenshot the login and security history, and capture any message the attacker sent from your profile. Note dates and times with the time zone visible.
5. Warn your network in one post and by email to your closest contacts. This is not reputation management, it is loss mitigation: it cuts off the fraud before your contacts become complainants against your name.
6. Write to LinkedIn's grievance officer. Ask for preservation of access logs for the relevant period, and for the IP addresses and device details associated with the unauthorised sessions. Ask in writing and keep the acknowledgement, because the twenty-four hour and fifteen-day timelines are your leverage later.
7. If any money moved, call 1930 immediately. The national cyber crime helpline feeds the same financial-intelligence chain as the portal, and a report in the first hours is what allows a bank to freeze funds at the receiving end.
8. File on cybercrime.gov.in. Register the incident, attach the screenshots and the acknowledgement from the platform, and download the acknowledgement number. This is a record, not a substitute for an FIR.
9. File an FIR under s 173 BNSS at the police station with jurisdiction. Jurisdiction for a cyber offence is generally where the complainant resides or where the offence's effects were felt, so your local station in Kolkata or elsewhere in West Bengal is the correct starting point. Carry a printed complaint, the evidence on a pen drive and a signed s 63 BSA certificate for the screenshots.
10. If the station refuses, move the magistrate. Section 175(3) BNSS allows you to apply to the Magistrate when the police decline to register an FIR, and the Magistrate can direct an investigation. In Kolkata such applications are ordinarily filed before the Chief Metropolitan Magistrate at Bankshall Court.

Which forum does what

What decides the outcome

The single most important variable is how quickly access logs were preserved. Platform logs are the only reliable proof of who logged in from where, and they are retained for a limited period. A written preservation request sent within days is worth more than an FIR filed a month later.

The second is whether your own conduct looks careless. If the attacker obtained the password because you entered it on a lookalike page, the criminal case is unaffected but a civil claim against the platform becomes much harder, and the platform will say so. If the takeover happened despite two-factor authentication, the case is straightforward.

The third is whether the account was used to harm third parties. Once the attacker has messaged your connections as you, you are exposed to complaints from people who trusted your name. Documentary proof that you reported the compromise on a specific date, and that you warned your network, is what separates a victim from a suspect in those complaints.

The fourth is technical quality of the evidence. A screenshot without metadata, a certificate under s 63 BSA that does not match the device that took the screenshot, or a pen drive with files renamed by hand all invite challenge. Courts have become stricter about this, not looser.

Mistakes that cost people the case

• Deleting the attacker's messages. They are evidence of the fraud, and of the fact that the account was not under your control.
• Paying a "recovery" service that promises to hack the account back. This is itself an offence, and it is the single most common second victimisation in account takeover cases.
• Filing only on the portal. The portal record is useful, but an FIR gives the police power to seize devices and issue notices to the platform.
• Waiting for the platform to finish its review before going to the police. The two tracks are independent; run them in parallel.
• Assuming the email is safe because LinkedIn was recovered. If the inbox was compromised, the attacker still has every password reset email.

When a lawyer helps

Most straightforward takeovers resolve at steps one to eight without legal involvement. A lawyer becomes useful when the police refuse to register the FIR, when the account was used to defraud your contacts and you are being treated as the accused, when the platform's logs need to be obtained through a court rather than a support ticket, or when the same attacker returns. In those situations the work is documentary — a properly drafted complaint, a s 63 BSA certificate that will survive cross-examination, and an application that gets a judicial order instead of another automated reply. If that is where you are, a cyber crime lawyer in Kolkata can review the evidence before it is filed rather than after it is rejected, and the West Bengal-specific court practice is set out under cyber crime law in West Bengal.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• My YouTube account was hacked: recovery, FIR and legal steps
• My WhatsApp account was hacked — recovery, FIR and legal steps
• TeamViewer account hacked: recovery, FIR and legal steps
• My Instagram account was hacked: recovery, FIR and legal steps
• Facebook account hacked: recovery, FIR and legal steps
• Google Pay account hacked: recovery, FIR and legal steps

Cyber crime lawyer in your city · Bank account freeze help · Contact