TeamViewer account recovery complaint: steps after a hack

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 1 Nov 2026 · Cyber crime

Regain control first, then report. Reset the TeamViewer password from a clean device, revoke every trusted device and session, then call 1930 and file on cybercrime.gov.in the same day. An account takeover is unauthorised access under section 66 of the IT Act, 2000, and cheating under section 318 of the BNS 2023 when money moved.

If your TeamViewer account has been taken over, the clock matters more than the paperwork. Change the password from a device that was never connected to the compromised session, revoke every active session and trusted device, then report the unauthorised access to 1930 and cybercrime.gov.in the same day. An account takeover is unauthorised access to a computer resource under section 66 of the Information Technology Act, 2000, and where the intruder used your identity or your licence to cheat someone, sections 66C and 66D apply as well. If money moved, section 318 of the Bharatiya Nyaya Sanhita, 2023 covers the cheating, and your first information is recorded under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023.

Most people who write to a lawyer after a TeamViewer compromise have already lost a day to the wrong sequence. They email the vendor first, wait for a reply, then call the bank, then discover the police station wants a written complaint they have not drafted. The order below is deliberately different. It starts with containment you can do in ten minutes, moves to the money trail while it is still traceable, and only then deals with the account itself. Nothing in that order requires a lawyer to begin, and nothing in it is reversible if you skip it.

What account recovery actually means after a hack

TeamViewer is remote-access software, so three different things get called "my account" in the same conversation. The first is the TeamViewer account itself: the email address, password and two-factor method that control your licence, your address book and your company profile in the Management Console. The second is the device: the computer or phone that had the TeamViewer client installed and was reachable through it. The third is a remote session: a one-time connection in which someone else controlled your screen while you watched, or while you thought you were watching.

The distinction decides both the remedy and the forum. A stolen account is a credential compromise and is dealt with by the vendor's account security team plus a police complaint. A compromised device may also be a data breach if it held customer records, which brings the DPDP Act, 2023 into play. A fraudulent remote session is usually the entry point for a financial fraud, and the money trail, not the software, becomes the centre of the investigation. Treating all three as one problem is the most common reason victims lose the recovery window.

Layer	What was taken	Who acts first	Legal hook
Account	Login, licence, address book, company profile	You, then the vendor's support	IT Act 2000 s 66, s 66C
Device	Files, saved passwords, stored data	You, then a forensic examiner	IT Act 2000 s 66; DPDP Act 2023
Session	Bank access, OTPs, payments	Bank nodal officer and 1930	IT Act 2000 s 66D; BNS 2023 s 318

What the law says, section by section

Section 66 of the IT Act, 2000 punishes dishonestly or fraudulently doing any act referred to in section 43, which covers unauthorised access, downloading, disruption and denial of access to a computer resource. Section 66C covers identity theft, meaning the fraudulent or dishonest use of another person's electronic signature, password or other unique identification feature. Section 66D covers cheating by personation using a computer resource or communication device. Section 66B deals with dishonestly receiving or retaining a stolen computer resource, which matters when a compromised licence or device is resold.

Because the Sanhita replaced the Penal Code for offences committed on or after 1 July 2024, the corresponding cheating provision is section 318 of the BNS 2023, with section 316 for criminal breach of trust where a person was entrusted with your system or credentials, section 336 for forgery of electronic records, section 340 for using a forged document, and section 351 for criminal intimidation if the intruder threatens to publish what they found. Extortionate demands that follow a takeover fall within section 308.

Procedure runs through the BNSS 2023. Section 173 requires an officer in charge of a police station to record information disclosing a cognizable offence and to register a first information report. Section 35 governs arrest and the notice of appearance that normally precedes it. Section 187 requires the investigating officer to forward a report to the magistrate. If a police station refuses to register your complaint, section 175(3) lets you approach the magistrate, who may direct an investigation. Section 480 allows compounding only for offences the statute lists as compoundable, so do not assume a cheating case can be bought out.

Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 governs the admissibility of electronic records. It requires the record to be accompanied by a certificate identifying the electronic record, describing the manner of its production, and dealing with the integrity of the device and the hash value. A screenshot pasted into a complaint is not that. A session log exported with its metadata, a hash computed at the time of export, and a certificate signed by the person who made the export is. Courts were strict about this under the earlier section 65B of the Evidence Act, and the Sanhita kept the discipline.

Step by step: the first 72 hours

Contain the session. Disconnect the machine from the network, close TeamViewer, and uninstall the client if you did not install it. If someone is still on the screen, do not chat with them and do not let them fix anything.
Change credentials from a clean device. Use a different phone or computer. Change the TeamViewer password, the email password, and the password of any account the machine was signed into. Turn on two-factor authentication.
Revoke access. In the TeamViewer Management Console, remove unknown users, delete unknown devices from the trusted list, and invalidate existing sessions. Regenerate any access tokens or API credentials.
Call 1930. The national cybercrime helpline logs the incident and can start a transaction freeze request with the bank. Have the transaction IDs, amounts and timestamps ready. This call is faster than any email.
File on cybercrime.gov.in. Register the complaint, upload the evidence bundle, and note the acknowledgement number. The portal routes it to the appropriate police unit.
Write to the bank's nodal officer. Use the grievance email published by your bank, not a number from a search result. State the exact debits, the date and time, that the transaction was unauthorised, and that you are reporting within the RBI timelines. Ask for the freeze and for the chargeback process in writing.
Preserve, do not clean. Do not factory reset the device, do not delete the TeamViewer logs, do not uninstall the browser. Take a full disk image if you can, or at least copy the TeamViewer log folder and the browser history database to external media.
Give a written complaint at the police station. Carry the portal acknowledgement, the bank correspondence and the evidence index. Ask for a receipt with the FIR or CSR number on it.

The evidence bundle that actually gets read

Investigators are drowning in screenshots. A bundle that gets acted on is short, indexed and timestamped. Put a one-page cover sheet first: your name, contact, the loss amount, the bank, the transaction IDs and the period. Then the TeamViewer session logs, exported rather than photographed. Then the bank statement page showing the debit, with the entry highlighted. Then the email or SMS notifications, in full, including headers. Then a short chronology in your own words, one line per event, in Indian Standard Time.

Item	Why it matters	How to keep it
TeamViewer connection logs	Shows the incoming session ID, time and duration	Export from the client, hash the export
Bank statement entry	Establishes the loss and the beneficiary	Download the official PDF, not a screenshot
Email and SMS alerts	Fixes the time you knew, which affects liability	Save raw messages with headers
Device disk image	May contain the intruder's tooling and IP traces	Forensic image, chain-of-custody note
Your written chronology	Gives the investigating officer a spine	Signed, dated, one page

What decides the outcome

Three things move a TeamViewer case: how fast you reported, whether the access was genuinely unauthorised, and whether the money is still sitting somewhere reachable. Speed affects both the investigation and your liability to the bank. Under the RBI framework for unauthorised electronic transactions, a customer who reports within three working days and has not shared credentials carries zero liability; the liability shifts in stages as the reporting delay grows, within caps that depend on the channel and the type of account. That is why the 1930 call and the nodal officer email matter more than a perfect narrative later.

Whether the access was unauthorised is where most disputes turn. If you gave a support agent remote access after a phone call, the bank will say you authorised the session. The legal answer is that consent obtained by deception is not consent, and section 318 of the BNS 2023 is built on dishonest inducement. But you have to prove the deception, which means the call recording, the caller ID, the chat transcript and the sequence of events. Preserve them before the phone's call log rolls over.

Recoverability depends on where the money went. A transfer into another bank account can be frozen if the request reaches the receiving bank before withdrawal. A transfer converted to cash or crypto usually cannot. This is why the first 24 hours are worth more than the next 24 weeks, and why a lawyer's involvement is often about the pace of escalation rather than the drafting.

Mistakes that cost people the case

Deleting TeamViewer and reinstalling it to be safe. The logs are the evidence.
Paying a recovery agent who found you through an advertisement or a chat group. Advance-fee recovery fraud is a second offence against you.
Emailing only the vendor and treating that as a police complaint. The vendor cannot freeze funds or register an FIR.
Reporting to the bank by phone without a written follow-up. Without a ticket number, the date of reporting is disputed later.
Naming a suspect in the complaint. Describe the session, the number and the account, and let the investigation identify the person.

When to involve a lawyer

You can complete every step above without counsel. A lawyer becomes useful when the bank rejects the liability claim, when the police station will not register the FIR, when the loss is large enough that a freezing application has to move quickly, or when you are the person accused of the takeover rather than the victim. In those situations the work is procedural: a representation to the nodal officer, an application under section 175(3) of the BNSS 2023, a bail application, or a petition for return of seized devices. For the broader map of how these cases move through the Calcutta High Court and the city courts, see the cyber crime lawyer in Kolkata page and the cyber crime legal services overview.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Can I recover a hacked TeamViewer account without the police?

You can regain control of the account yourself by resetting the password from a clean device and revoking sessions in the Management Console. Police involvement is separate and is what enables a transaction freeze and an FIR. If money moved, both tracks are needed and the police track should start first.

Is a TeamViewer account takeover a criminal offence in India?

Yes. Unauthorised access to a computer resource is punishable under section 66 of the Information Technology Act, 2000. If the intruder used your credentials or identity, section 66C applies, and section 66D covers cheating by personation. Where money was induced, section 318 of the BNS 2023 also applies.

What should I do in the first hour after I notice the hack?

Disconnect the device from the network and close the TeamViewer session. Then change the TeamViewer and email passwords from a different phone or computer and revoke unknown devices. Call 1930 with the transaction details before you start writing emails, because the freeze request is time-sensitive.

Does the bank have to refund money taken through a remote session?

Not automatically. Under the RBI framework, zero liability applies where the fraud was not caused by the customer and was reported within three working days. If you handed over access after a deceptive call, the bank will dispute authorisation, and the outcome turns on the evidence of deception you preserved.

Which police station do I complain to for a TeamViewer fraud?

You can file at the cyber crime police station for your area, or online through cybercrime.gov.in, which routes the complaint. For a loss in Kolkata, the Cyber Crime Police Station of Kolkata Police handles it. The portal complaint can be filed from anywhere and later linked to the local station.

Should I uninstall TeamViewer after a fraud?

Remove it only after you have exported and hashed the connection logs and copied the log folder to external media. Uninstalling destroys the session records that show when and how the intruder connected. If the software was installed without your knowledge, photograph the installation screen before removal.

How long does a TeamViewer fraud investigation take?

There is no statutory completion deadline. A freezing request moves in days, a charge sheet in months, and a trial can run for years. The pace depends mainly on whether the beneficiary account was frozen early and whether the device evidence was preserved in a form a court will accept under section 63 of the BSA 2023.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact