TeamViewer account hacked: recovery, FIR and legal steps

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Cyber crime

TeamViewer is a remote access tool, which means a compromised account is a compromised set of computers. The moment someone else can sign in, they inherit every device you have authorised, often without needing a password on those devices at all. The first hour should be spent cutting access, not investigating, because an active session can be used to install persistence that survives a password change.

There are two very different cases here. The first is a personal or small-office compromise, usually the tail end of a telephone scam in which someone persuaded the user to install the software and read out a code. The second is a takeover of a business account, where the intruder has reached client machines and the legal exposure includes notification duties that run on a six-hour clock. Identify which one you are in first, because the reporting obligations differ sharply.

What unauthorised remote access is, in law

The core offence is straightforward. Section 66 of the Information Technology Act, 2000 punishes computer-related offences committed dishonestly or fraudulently, with imprisonment up to three years and a fine up to five lakh rupees. Where the intruder obtained your credentials and used them to pose as you, Section 66C (identity theft) applies. Where the access was obtained by deceiving you into installing the software or disclosing a session code, Section 66D (cheating by personation using a computer resource) is the more accurate charge, usually alongside Section 318(4) of the Bharatiya Nyaya Sanhita, 2023 for cheating.

Section 43 of the IT Act creates civil liability for unauthorised access, download, damage or disruption, and is the provision under which compensation is claimed. Section 43A applies to a body corporate that fails to protect sensitive personal data, and it is the provision an affected client is most likely to invoke against your business. Section 72 covers breach of confidentiality by persons who have accessed data under a statutory power, and Section 72A covers disclosure of personal information obtained under a contract of service — relevant where the intruder was, or was assisted by, an insider.

Where the intruder used the access to create or alter records — a forged invoice, an amended bank mandate, a fabricated email trail — Section 336 of the BNS covers making a false electronic record and Section 340 covers using a forged electronic record as genuine. Where the access came from an employee or a contractor with legitimate credentials, Section 316 of the BNS (criminal breach of trust) is often the more realistic charge, because unauthorised access by someone authorised to be there is harder to prove than trust betrayed.

Credential theft is not the interesting part of these cases. The interesting part is the connection log, which records who connected, from which address, to which machine, and for how long. Preserve that before you reset anything.

The first hour, in order

1. Terminate the sessions. In the TeamViewer account, close all active connections and end the session on each device. If you cannot reach the console, disconnect the affected machines from the network — physically, if that is faster.
2. Revoke, do not just change. Remove every trusted device, delete every saved connection and disable unattended access until you have rebuilt it deliberately. A password change alone leaves existing authorisations intact.
3. Change credentials from a clean device. Use a machine that was never connected, change the TeamViewer password, the linked email password and the recovery email. Enable two-factor authentication.
4. Check the email account first. Most takeovers begin with the mailbox, not the remote access tool. If the intruder controls your email, password resets issued to that address go to them.
5. Preserve the logs before wiping. Export the connection history, the list of devices, and the account's activity and alert emails. Screenshot the session records with the date visible.
6. Scan and rebuild. Assume persistence. Run a full scan, review startup items and scheduled tasks, and rebuild any machine that held credentials if the intrusion was more than a few minutes long.
7. Report, and keep the reference. For a business, report to CERT-In. For everyone, file on cybercrime.gov.in and give the police a written complaint.

If the intrusion reached your bank account

Remote access scams usually end in a transfer. If money moved, the analysis is the same as any other UPI or net banking fraud, and it runs on the RBI's circular of 6 July 2017 on limiting customer liability in unauthorised electronic banking transactions. Report to the bank within three working days for zero liability where you had no role in the breach, and inside seven working days for a liability capped at twenty-five thousand rupees.

There is an honest difficulty here. If you installed the software and read out a code because someone claimed to be from your bank, the bank will argue you authorised the session, even though you were deceived. The criminal case is unaffected — deception is still cheating — but the liability argument becomes contested, and recovery then depends on freezing the beneficiary account rather than on the liability framework. Report on 1930 the same day and treat the freeze as the priority.

If it is a business account: the six-hour duty

Businesses carry obligations that individuals do not, and they are time-bound.

CERT-In. The Directions issued by CERT-In on 28 April 2022 under Section 70B(6) of the IT Act require specified cyber security incidents to be reported to CERT-In within six hours of noticing. Unauthorised access to systems and data breaches fall within the specified categories. The six hours run from the moment of notice, not from full understanding.

DPDP Act 2023. Where personal data of individuals is involved, Section 8(6) of the Digital Personal Data Protection Act, 2023 requires the data fiduciary to intimate a personal data breach to the Data Protection Board and to each affected data principal. The Act's obligations are being brought into force in phases, so the precise procedure depends on the rules then in force, but a business that waits to see how the incident develops is accumulating exposure.

Contractual notification. Client contracts and vendor agreements frequently require notification within twenty-four or seventy-two hours, independent of any statute. Breaching a notification clause is often the largest single liability in a small breach, because it gives the client a clean claim unrelated to whether the intruder was stopped.

Insurance. Notify the cyber insurer within the window the policy specifies. Late notification is a common reason claims are declined.

Matching the incident to the provision and the authority

Filing the FIR, and making it useful

Under Section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023, information about a cognizable offence must be recorded, and electronic intimation is permitted with a signed copy to follow within three days. The complaint should do three things that most complainants omit: identify the offence by section, state the loss in figures, and ask specifically for preservation of records from the remote access provider and the bank.

Two provisions matter. Section 105 of the BNSS allows police to attach proceeds of crime, which is how a beneficiary account is frozen. Section 187 of the BNSS governs further investigation when the first report names only a mule. If police decline to register, Section 175(3) of the BNSS allows a complaint to the jurisdictional magistrate.

For a business, commission a private forensic report early. It names the entry point, the duration of access and the exfiltration path, and it is the document insurers, clients and courts ask for. Preserve the raw logs first, or the examination will destroy the evidence it is meant to analyse.

Evidence, and Section 63 of the BSA

Electronic records are proved under Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 by producing the device or medium with a certificate that identifies the record, describes the device and addresses the integrity of the manner of production. The certificate is signed by the person in charge of the device or the management of the relevant activity, and it is a statement with consequences, not a formality.

What to preserve, concretely: the account's connection history and alert emails, the affected machines' security logs showing remote interactive logons, the network records of outbound connections, and the bank statements covering the loss. Capture all of it before rebuilding anything. Once a machine is wiped, the certificate can describe what was done but cannot authenticate what no longer exists.

Corporate records raise a point individuals miss. If an employee discovered the intrusion, the company's internal messages about it become disclosable in litigation. Write the timeline once, factually, and circulate it as the record rather than letting inconsistent versions travel by email.

What decides the outcome

How long the access lasted. A two-minute session is a data exposure. A two-week session is a full compromise of every credential the machine held, and the response has to be a rebuild rather than a cleanup.

Whether the entry point was the mailbox. If the intruder controlled email first, everything sent from that mailbox — invoices, instructions, password resets — is suspect, and the civil and criminal case expands well beyond the remote access tool.

Whether records were altered. Altered invoices and amended bank mandates turn a data breach into forgery, and forgery is prosecuted more readily because the loss is concrete.

Whether notification was timely. For a business, the six-hour CERT-In duty and the contractual notice clause are usually decided on the timeline rather than on the technical facts, and a late notification is difficult to defend.

Whether the money was frozen. Recovery is a race, and the legal framework does not substitute for speed.

Mistakes that make it worse

• Changing only the password. Existing authorised devices keep working. Revoke them.
• Wiping the machine to 'clean' it. That destroys the logs and leaves you with a certificate that cannot authenticate anything.
• Leaving unattended access enabled 'for now'. It is the intruder's way back in after the reset.
• Notifying clients late because the facts were unclear. Notify on the timeline you have, then update. Silence reads as concealment.
• Assuming the tool was at fault. Takeovers are overwhelmingly credential-based, and a public attribution of blame to the vendor is a defamation risk with no upside.
• Handling it internally to avoid embarrassment. The decision to keep quiet is the one that turns an incident into a dispute with insurers and clients.

Where the intrusion touched client systems, the exposure is contractual as much as criminal, and the two tracks need to be run together. A civil litigation view of the notification clauses is worth taking in the first week, while the criminal complaint is being registered, because the remedies and the timelines are different. For the Kolkata forum and the practical sequence of a cyber crime case, see the material for a cyber crime lawyer in Kolkata.

When to involve a lawyer

An individual whose machine was accessed and whose bank account was emptied needs a lawyer when the bank rejects the claim or the police close the file. A business needs one far earlier — ideally within the first twenty-four hours — because the notification decisions, the wording of the client communication and the preservation steps all have legal consequences that cannot be undone later. The most expensive mistake in a corporate incident is not the breach itself. It is the letter that was sent, or not sent, in the first two days.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• My YouTube account was hacked: recovery, FIR and legal steps
• My WhatsApp account was hacked — recovery, FIR and legal steps
• My LinkedIn account was hacked — recovery, FIR and legal steps
• My Instagram account was hacked: recovery, FIR and legal steps
• Facebook account hacked: recovery, FIR and legal steps
• Google Pay account hacked: recovery, FIR and legal steps

Cyber crime lawyer in your city · Bank account freeze help · Contact