My WhatsApp account was hacked — recovery, FIR and legal steps

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber crime

If your WhatsApp account has been taken over, the fastest route back is the in-app recovery flow, a fresh SIM card and re-verification with WhatsApp support. The legal route is a written complaint that can become an FIR under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023, for offences that are usually sections 66, 66C and 66D of the Information Technology Act, 2000, read with section 318 of the Bharatiya Nyaya Sanhita, 2023. Do both at the same time. The account is one problem. The impersonation that follows is a separate and often more serious one.

Most people learn about the takeover in an odd way. Their own number stops receiving one-time passwords. A cousin calls to ask why they are asking for twenty thousand rupees. WhatsApp shows a linked device nobody recognises. By the time that happens the account has usually been in someone else's hands for hours, and the attacker has already copied the contact list. What you do in the next day decides three things: whether the account comes back, whether your contacts lose money, and whether any usable evidence survives.

What has actually happened to your account

There are three mechanisms behind almost every takeover, and they call for slightly different paperwork. The first is the registration code. The attacker asks for the six-digit code that WhatsApp sends by SMS, usually while pretending to be a friend, a delivery agent or a bank official who has "sent it to your number by mistake". Once that code is entered on another handset, your session ends and theirs begins. The second is the SIM itself, replaced at a mobile shop on the strength of forged documents, or read through a port-out the operator should have blocked. The third is a linked device or a cloud backup that was never signed out, which lets someone read your chats without ever touching your SIM.

The distinction matters to the police and to the court. A code-sharing fraud leaves a trail in WhatsApp's own logs. A SIM swap leaves a trail in the operator's activation records, which the investigating officer must requisition in writing. A stale linked device is a failure of account security rather than an intrusion, and it is the easiest to fix and the hardest to prosecute. Say which of the three you think applies in your complaint, and say why, but do not present a guess as a fact.

What the law says

The Information Technology Act, 2000 is the spine of the case. Section 43 makes unauthorised access, downloading, copying or extraction of data from a computer resource actionable, and it is a civil wrong as much as a criminal one, which is why a suit for damages is theoretically possible alongside the FIR. Section 66 turns conduct covered by section 43 into an offence when it is done dishonestly or fraudulently, punishable with imprisonment up to three years or a fine up to five lakh rupees, or both.

Section 66C is the provision that fits a WhatsApp takeover most precisely. It punishes the fraudulent or dishonest use of another person's electronic signature, password or any other unique identification feature, with imprisonment up to three years and a fine up to one lakh rupees. Your phone number and the registration code that authenticates it are a unique identification feature in that sense. Section 66D punishes cheating by personation using a computer resource, again up to three years and a fine up to one lakh rupees, and it is the section to invoke once the attacker starts messaging your contacts as you. Where the messages are obscene or sexually explicit, sections 67, 67A and 67B of the IT Act also enter the picture, and section 66E covers the capture or transmission of images of a private area without consent.

On the criminal side, the Bharatiya Nyaya Sanhita, 2023 replaced the Indian Penal Code for offences committed on or after 1 July 2024. Section 318 is the cheating provision. Sub-section (1) defines cheating, sub-section (2) provides the general punishment, sub-section (3) covers cheating by personation, and sub-section (4) covers cheating and dishonestly inducing the delivery of property, which is the successor to section 420 of the old Code and carries imprisonment up to seven years and a fine. Where the attacker forges a document or an electronic record, section 336 applies; where the forged document is used as genuine, section 340 applies. Criminal breach of trust under section 316 is sometimes added where money was entrusted rather than induced. Threats to publish private chats are criminal intimidation under section 351.

Procedure matters as much as the section numbers. Section 173 of the BNSS governs the recording of information in a cognizable case, and its proviso allows a zero FIR at any police station, whatever the territorial jurisdiction, with the file later transferred to the station that has it. If the officer refuses to register, the remedy is a written complaint to the Superintendent of Police and, failing that, an application to the Magistrate under section 175(3) of the BNSS, which is the successor to the old section 156(3) of the Code of Criminal Procedure. Section 35 of the BNSS governs arrest, and section 187 governs production before a Magistrate and remand, which matters to you only if someone is caught. Section 94 of the BNSS is the power to summon documents, and it is the provision an investigating officer uses to obtain call detail records, SIM activation papers and WhatsApp's account logs.

The recovery sequence, in order

1. Register the number again. Reinstall WhatsApp, enter your number, and request the code. If the attacker has enabled two-step verification, you will be locked out and must wait out the seven-day window WhatsApp imposes before re-verification, or use the "support" route inside the app.
2. Tell your operator, in writing. Email the nodal officer of your mobile operator and ask for (a) a block on SIM replacement and port-out for your number and (b) the activation history of the SIM for the relevant dates. This is the single most useful document in a SIM-swap case, and it is the one the police will otherwise take weeks to obtain.
3. Secure the number, then secure the accounts. Change the password on the email address tied to WhatsApp, sign out all linked devices through WhatsApp's linked-devices screen, and enable two-step verification with a PIN you have never used elsewhere.
4. Collect proof before you tidy up. Screenshot the "this account is on another device" notice, the attacker's messages to your contacts, the calls and the payment requests. Export the chat with the attacker if one exists. Note the exact times, because a screenshot without a timestamp is close to useless.
5. Report on the portal and the helpline. File a complaint at cybercrime.gov.in and dial 1930. The portal issues an acknowledgement number.
6. Give a written complaint at the police station. Take two copies. Ask for the receipt stamp and the FIR number on your copy. If the offence is cognizable, registration is mandatory, and a zero FIR is permissible if the station says it lacks jurisdiction.
7. Tell your bank, if any money moved. A WhatsApp takeover that turns into a payment request to your contacts is not your transaction, but a takeover that drains your own account is. Report it on the same day, because the reporting window drives the liability rules discussed in the bank's circular.
8. Write to WhatsApp's grievance officer. India's intermediary rules require a grievance officer with a published address, acknowledgement within twenty-four hours and disposal within fifteen days. A written request for account logs and preservation of records is more useful than a support ticket.
9. Preserve, do not delete. Keep the handset, the SIM, the screenshots and the emails. Do not factory-reset the phone before the police have imaged it or at least recorded what is on it.

Where each complaint goes, and what it can do

What decides whether the case moves

The first factor is timing. A complaint filed within seventy-two hours of the takeover is treated as urgent; one filed three months later invites the question why. The second is documentation. An investigating officer with a stamped complaint, a portal acknowledgement, screenshots with visible timestamps and an operator's activation log has something to work with. An officer with a verbal account and a phone that has been reset has almost nothing. The third is loss. Cases where money moved attract attention because there is a quantifiable injury and a bank that can be directed to reverse or freeze. Pure account takeover without loss is still an offence, but it competes for scarce investigation time.

The fourth factor is whether the conduct is really impersonation or merely nuisance. Courts and police both distinguish a hacked account used to beg from contacts, which is squarely section 66D, from a hacked account used to send a single offensive message, which may be treated as a smaller offence or as a platform matter. The fifth is jurisdiction. A server in another country, an attacker in another state and a complainant in Kolkata produce a case that can be registered anywhere the offence's effects were felt, but that is easiest to pursue where the complainant, the bank branch and the device records are all located. That is why a Kolkata complainant usually gains nothing by filing in Delhi.

Mistakes that cost people their case

The most common mistake is deleting the account in frustration, or asking WhatsApp to delete it. That destroys the very record you need. The second is paying the attacker. A demand for money to "return" the account is extortion, and paying it both funds the offence and weakens your position, because a voluntary payment is harder to characterise as induced by deception.

The third is filing only with the platform and assuming that is a legal complaint. WhatsApp is an intermediary. It can restore an account and preserve records, but it cannot register an FIR, freeze a bank account or prosecute anyone. The fourth is filing at a police station without a written complaint and without a receipt, and then discovering that no record exists. The fifth is waiting for the platform's fifteen-day grievance cycle before going to the police, which is usually the wrong order: the police reference strengthens the platform request, not the other way round.

A quieter mistake is overstating the loss. An exaggerated figure is easy to disprove from bank statements and it damages the credibility of everything else in the complaint.

When to involve a lawyer

Many takeovers are resolved with a re-verified SIM, a portal complaint and a cooperative police station. A lawyer becomes useful when the police decline to register an FIR, when the account was used to defraud your contacts and you are being blamed for it, when the attacker turns out to be someone you know and the matter is being treated as a family dispute, or when a demand for money has escalated into threats. At that stage the work is procedural rather than dramatic: a properly drafted complaint, an application under section 175(3) of the BNSS, and a clear record of what was reported and when. You can read more about how these matters are handled by a cyber crime lawyer in Kolkata, or check the West Bengal practice page for the local forum details.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• My YouTube account was hacked: recovery, FIR and legal steps
• TeamViewer account hacked: recovery, FIR and legal steps
• My LinkedIn account was hacked — recovery, FIR and legal steps
• My Instagram account was hacked: recovery, FIR and legal steps
• Facebook account hacked: recovery, FIR and legal steps
• Google Pay account hacked: recovery, FIR and legal steps

Cyber crime lawyer in your city · Bank account freeze help · Contact