WhatsApp account recovery complaint: evidence and escalation

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Digital evidence

WhatsApp account recovery after hacking runs on an escalation ladder, not a single complaint. You start with the in-app re-verification, then the intermediary's grievance officer, then 1930 and cybercrime.gov.in, then the police station under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023, and finally the Magistrate under section 175(3) of the BNSS if the police sit on the file. Each rung produces a document that the next rung treats as proof you did the earlier one.

The reason order matters is that the platform and the State keep different records. WhatsApp can see which device registered your number and when. It cannot see that your SIM was replaced at a shop in Salt Lake on forged papers, and it cannot order your operator to produce the activation log. The police can requisition both, but only once there is a case number. A complainant who goes straight to the police without platform evidence slows the investigation; one who stays on the platform forever never starts it.

The four records that decide a recovery case

Before the law, there is the file. Four records carry almost every WhatsApp takeover complaint, and you either have them or you do not. The first is the registration event: which number was verified, on which handset, at what time. The second is the SIM activation record held by your mobile operator, which shows whether a replacement or port-out happened and on what documents. The third is the message trail produced by the attacker while inside your account, which shows the purpose of the intrusion. The fourth is your own report trail, meaning the timestamps at which you told the platform, the helpline, the bank and the police.

Most complainants have fragments of all four and a complete copy of none. A screenshot of an OTP that arrived unexpectedly is a fragment. A screenshot of the attacker asking your uncle for money is a fragment. An operator's written confirmation that no SIM replacement was requested is a fragment that helps more than it sounds, because it rules out the SIM-swap defence and points the case towards code sharing or a linked device.

Rung one: the in-app recovery, and its limit

Reinstall WhatsApp, enter your number and request the verification code. If the attacker set a two-step verification PIN, the app will not simply let you back in. WhatsApp builds in a waiting period of about seven days before the number can be re-verified without that PIN, and there is a support route inside the app to request help. That wait is the reason you should not spend the first day only on the app. Use the waiting period to do everything below.

When you do get back in, do three things immediately. Open the linked-devices screen and sign out every device you do not recognise. Turn on two-step verification with a PIN that is not reused anywhere. Then export the chat with the attacker and with anyone who was asked for money, because the attacker's session may still be able to delete messages remotely until it is signed out.

Rung two: the grievance officer, with the twenty-four hour rule

India's intermediary rules require a significant social media intermediary to publish a grievance officer, acknowledge a complaint within twenty-four hours and dispose of it within fifteen days. WhatsApp publishes that address in its help centre. Write to it as you would to a court, not as you would to a chatbot: your full name, the number in question, the date and time you lost access, what you believe happened, the specific relief you want, and a list of the records you are asking the company to preserve.

Ask for three things in that letter. Restore or secure the account. Preserve account registration logs, IP-level access data and linked-device history for the relevant period. Confirm in writing whether a data request from an investigating officer has been received. A company will not hand over logs to a private individual, and it does not have to, but it must preserve them once on notice. Preservation is the point. A log that has been deleted by the time the police ask for it cannot be recovered.

Rung three: 1930 and the portal

Dial 1930 and file at cybercrime.gov.in on the same day. The helpline exists to stop money from leaving the banking system, so it matters most when a payment request has already been paid. Even in a pure account takeover, the portal complaint creates a national reference number that police stations, banks and the platform all recognise. Enter the details exactly as they appear in your screenshots: the exact handle, the exact number that messaged your contacts, the exact times.

Where the attacker is using your account to collect money, add each victim's transaction details to the portal complaint as they come in. A single consolidated complaint with three transactions is easier to investigate than three separate complaints with one each, and it prevents the investigating officer from treating them as unrelated matters.

Rung four: the police station, under BNSS section 173

Carry a written complaint, signed and dated, in two copies. Attach the portal acknowledgement, the grievance officer email and the screenshot printouts. Section 173 of the BNSS requires the officer in charge to record information relating to a cognizable offence, and the proviso allows registration at a station that lacks territorial jurisdiction, with the case later transferred. Ask for the FIR number and the receipt stamp on your copy before you leave. If the officer says the matter is civil or that it belongs to another station, ask for that refusal in writing.

The refusal is not the end. A written complaint to the Superintendent of Police is the next step, and an application to the Magistrate under section 175(3) of the BNSS follows if that produces nothing. In Kolkata, the criminal courts that handle these applications sit at Bankshall Court for the metropolitan area and in the district courts for the rest of the state; the City Sessions Court and the Calcutta High Court deal with the higher end of the same ladder.

Rung five: the Magistrate, and when the High Court enters

An application under section 175(3) asks the Magistrate to direct investigation. It is not a trial and it does not require you to prove the offence; it requires you to show that you gave the information to the police and that the police did not act. Attach the complaint, the receipt or the refusal, the portal acknowledgement and a short chronology. The Magistrate may direct investigation, may treat your application as a private complaint, or may decline with reasons.

The High Court's inherent power under section 528 of the BNSS is a different instrument. It is used to quash a frivolous FIR against an accused person, to transfer an investigation, or to correct a procedural refusal. It is not a shortcut for a complainant who simply wants faster action.

The ladder at a glance

Making the evidence survive a courtroom

Screenshots are where most cyber crime cases quietly weaken. A printout with no visible timestamp, no handle and no device context proves very little. Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 governs the admissibility of electronic records and, like the provision it replaced, requires a certificate where the record is produced from a device or storage outside the ordinary course. In practice this means the person producing the record signs a certificate identifying the device, the account, the period and the manner in which the copy was made.

Keep three things alongside the images: the original handset, the exported chat file with its metadata intact, and a written note of when each screenshot was taken and by whom. If the account has already been restored, do not "clean up" the phone. If the phone must be handed over, take a full backup first and record the handover in writing. Where the attacker's number is visible, put it in the complaint in full, because a partial number cannot be requisitioned from a telecom operator.

An investigating officer will typically seek call detail records and IP logs under section 94 of the BNSS, the power to summon documents. Those records are held for limited periods. A complainant who supplies the exact number and the exact date range shortens the process by weeks.

What decides the outcome

Speed is the largest single variable. Account restoration is technically easier within days, and the platform's own logs are more complete. Investigation is easier while the attacker's accounts are still active. Bank reversal is possible only while the money is still in the chain. Every one of these decays.

The second variable is the quality of the first written complaint. An officer reads a complaint to decide whether it discloses a cognizable offence. If it recites the facts in order, names the sections, identifies the loss and attaches the platform reference, it moves. If it narrates three months of distress without dates, it is filed and forgotten. The third is whether there is a financial loss, because money creates a complainant with a measurable injury and a bank that can be directed to act.

The fourth is the attacker's identity. A takeover by a known person, such as an estranged partner or a former employee, is investigated faster because there is someone to investigate. An unknown overseas actor produces a case that depends on platform data and is often closed for want of identification. That is not a reason to avoid complaining, but it is a reason to be realistic about what the criminal case can achieve, and to consider a civil claim for damages under section 43 of the IT Act where the wrongdoer is identifiable and solvent.

What not to do

• Do not delete the WhatsApp account. Deletion destroys the record and does not stop the attacker from using screenshots already taken.
• Do not pay to get the account back. That is extortion, and payment marks you as a willing participant in a transaction you later describe as fraudulent.
• Do not file only online. A portal reference is not an FIR and does not by itself start an investigation.
• Do not send the same complaint to five police stations. One station, one reference, and a copy to the Superintendent of Police if it stalls.
• Do not edit or crop screenshots. A cropped image invites the argument that it was manipulated.

When to involve a lawyer

The ladder above is walkable without a lawyer in a straightforward case. A lawyer earns the fee when the police refuse to register, when the account was used to defraud third parties and you are being treated as the suspect, when the attacker is known and the police are framing it as a matrimonial or employment dispute, or when the loss is large enough that a bank is disputing liability. The work at that point is drafting, procedure and a documented chronology. If your matter is in Kolkata, the cyber crime law practice in Kolkata page sets out the forums, and the contact page explains how to send the papers for a first review.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• YouTube account recovery complaint: escalation guide
• TeamViewer account recovery complaint: steps after a hack
• LinkedIn account recovery: complaint, evidence, escalation
• Instagram account recovery complaint: evidence and escalation
• Gmail account recovery complaint: a practical legal guide
• Facebook account recovery: complaint, evidence, escalation

Cyber crime lawyer in your city · Bank account freeze help · Contact