WhatsApp hacked and money debited: how to recover it legally

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber law

If money left your account after a WhatsApp takeover, three tracks run at once: 1930 and cybercrime.gov.in for a freeze and FIR under IT Act s 66D and BNS s 318(4), your bank's nodal officer for reversal under the RBI liability rules, and a recovery claim against the beneficiary. Report within three working days for zero liability.

When a WhatsApp takeover turns into a debit from your account, you are running three cases at once. The criminal case is a complaint that can be registered under section 66D of the Information Technology Act, 2000 and section 318(4) of the Bharatiya Nyaya Sanhita, 2023. The regulatory case is against your bank under the Reserve Bank of India's customer protection directions on unauthorised electronic banking transactions. The recovery case is against the person who received the money, and it is the one that most often produces an actual refund.

The order in which you act decides which of the three survives. A call to 1930 within the first hour can freeze funds before they leave the beneficiary account. A written report to the bank within three working days preserves your zero-liability position under the RBI directions. A police complaint within seventy-two hours gives the investigating officer something to work with while the money trail is still traceable. Miss those windows and the criminal case may still be registered, but the money is usually gone.

Three tracks, three different jobs

Complainants tend to conflate these tracks, and then feel betrayed when an FIR does not produce a refund. The criminal track punishes. The regulatory track allocates the loss between you and your bank. The recovery track pursues the beneficiary. A bank will not refund because a police case exists, and a court will not convict because a bank refunded. Understanding which forum does what keeps you from spending a month in the wrong one.

Track	Forum	What it can deliver	What it cannot
Criminal	Police station under BNSS s 173; cybercrime.gov.in	FIR, investigation, freezing and attachment of proceeds under BNSS s 105	Automatic refund to you
Regulatory	Bank's nodal officer; RBI Ombudsman under the 2021 integrated scheme	Reversal or provisional credit under the RBI liability rules	Punishment of the fraudster
Recovery	Civil suit, or restitution ordered in the criminal case	Money from an identified beneficiary	Speed, if the beneficiary is a mule with no assets

The criminal case: what was actually done

Two patterns dominate. In the first, the attacker takes over your WhatsApp and then uses your identity to ask your contacts for money, so the loss falls on them and you are the apparent author of the fraud. In the second, the takeover is only the entry point, and the attacker uses the access to your phone, your email or your messages to reset banking credentials and move money from your own accounts.

The first pattern is cheating by personation under section 66D of the IT Act and section 318(4) of the BNS. The second adds section 66C of the IT Act, for the dishonest use of your authentication features, and often section 66, which turns conduct under section 43 into an offence. Where a forged document or electronic record is used to open a mule account in your name, sections 336 and 340 of the BNS become relevant.

Section 105 of the BNSS, 2023 is the provision that matters most to recovery. It deals with attachment, forfeiture and restoration of property, including proceeds of crime, and it allows a court to order that property be returned to the person entitled to it. An investigating officer who moves quickly can ask a court to attach the balance in the beneficiary account before it is withdrawn. That is why the 1930 complaint and the portal complaint should be filed before you sit down to write a detailed narrative. Speed freezes money; narrative does not.

Where the transaction was executed through the Unified Payments Interface, the beneficiary bank is also part of the chain. The National Payments Corporation of India's dispute resolution framework allows a chargeback request to be raised through your bank, and the beneficiary bank can place a lien on the funds while the dispute is examined. This is an administrative process, not a legal one, and it is time-bound. Ask your bank, in writing, for the chargeback reference.

The regulatory case: how the RBI allocates the loss

The RBI's direction on customer protection, issued in 2017 and still the governing framework for unauthorised electronic banking transactions, limits a customer's liability by reference to how quickly the unauthorised transaction is reported. The logic is that a customer who reports promptly cannot have contributed to the loss after the event, and a customer who stays silent gives the fraudster time to move the money.

When you report	Your liability, where the fraud is not due to your own negligence
Within three working days	Zero liability; the bank bears the loss
Within four to seven working days	Limited liability, capped by the bank's policy as approved by its board
Beyond seven working days	Liability determined by the bank's policy, subject to the requirement that the customer not have been negligent

Two features of the framework are routinely missed. First, liability is decided with reference to the date of the unauthorised transaction and the date of your report, not the date on which you discovered every detail, so a report that says "I have been debited and I do not yet know how" starts the clock in your favour. Second, the bank must credit the amount provisionally within ten working days of your notification in cases where the loss is to be borne by the bank, and must resolve the complaint within ninety days.

The direction also requires the bank to provide you with a channel to report unauthorised transactions, to acknowledge the report immediately with a reference number, and to refrain from charging you for the complaint. If your bank insists that you must visit the branch and fill a form while the money moves, that insistence is itself worth recording in writing.

Where the bank refuses to apply the framework, the escalation is to the RBI Ombudsman under the Reserve Bank – Integrated Ombudsman Scheme, 2021. The complaint must first be made to the bank, and you must have the bank's reference number and its reply or its silence. The Ombudsman's process is free and does not require a lawyer, but a well-drafted complaint with the transaction trail attached produces a different result from a one-line grievance.

The recovery case: following the money

Money debited from your account lands somewhere. If it landed in a mule account opened with stolen documents, the account holder may be a victim too, and a suit against that person recovers nothing. If it landed in an account controlled by the fraudster or by someone who knowingly lent their account, the position is different. Section 66B of the IT Act punishes the dishonest receipt of a stolen computer resource, and a charge under that section can accompany the cheating charge where devices or credentials were passed on.

In practice, recovery happens in three ways. The first is a bank reversal under the RBI framework. The second is a restitution order in the criminal case, using section 105 of the BNSS. The third is a civil suit for recovery of money had and received, filed where the beneficiary is identifiable and has assets. The third is the slowest and the most certain, and it is usually worth considering only when the amount justifies the cost.

What to do, in order

Call 1930 immediately. Report the transaction, the amount, the time, the UPI reference or the account number credited, and the fact that your WhatsApp was compromised. Ask for the complaint number.
Call your bank's fraud line and email the nodal officer. Report the transaction as unauthorised, ask for a provisional credit under the RBI framework, and ask for the chargeback to be raised. Get a reference number in writing, not a call-centre assurance.
Freeze the outflow. Ask the bank to block the channel used, whether that is UPI, net banking, debit card or an auto-debit mandate, and to disable any beneficiary registered in the last few days.
Secure the phone and the accounts. Re-verify WhatsApp, sign out linked devices, change the email password, enable two-step verification, and check for a call-forwarding or SMS-forwarding setting on the handset.
File on cybercrime.gov.in with the transaction reference, the bank complaint number and the screenshots. Add the beneficiary account number, because that is the field that lets the portal route the case to the right state.
File a written police complaint at the station with jurisdiction, or a zero FIR elsewhere under the proviso to section 173 of the BNSS. Attach the bank statement showing the debit, the portal acknowledgement and the screenshots.
Write to the platform's grievance officer for preservation of the account's registration and access logs, since the takeover is the entry point the investigation must prove.
Escalate to the RBI Ombudsman if the bank has not credited or resolved within its timelines.

What decides the outcome

The first factor is whether the money is still there. A freeze within the first few hours regularly recovers funds; a complaint filed after a week regularly does not, because mule accounts are emptied in layers. The second is whether you shared a credential. If you read out an OTP, approved a "collect request" or installed a screen-sharing app at the fraudster's request, the bank will argue contributory negligence, and the zero-liability protection becomes contestable. Say what happened accurately, because the bank will obtain the call and app logs.

The third is the quality of the bank complaint. The RBI framework turns on the date of reporting, so a written, timestamped complaint is the strongest document you will produce. The fourth is whether the beneficiary is identifiable. A domestic account with a name and a branch is traceable; a chain of accounts in another state is slower; a foreign wallet is effectively out of reach.

The fifth is the court's view of your conduct. Where a complainant changed the narrative between the bank complaint, the portal complaint and the FIR, the inconsistency is used to argue that the transaction was authorised. Consistency across three documents is worth more than any amount of indignation.

What not to do

Do not wait for the platform to finish its review before calling 1930. The platform cannot freeze a bank account.
Do not pay a "recovery agent" who promises to retrieve the money for an upfront fee. This is a second fraud aimed at the same victim.
Do not file a police complaint that omits the bank reference. The officer needs the transaction trail, not only the story.
Do not accept a verbal "we are looking into it" from the bank. Ask for the reference number and the date of provisional credit.
Do not delete the fraudulent messages or the call log. They establish how the account was taken over.

When to involve a lawyer

Small losses are often resolved through the bank and the portal without legal help. A lawyer becomes useful when the bank denies liability on a contributory-negligence ground, when the amount is large enough that a civil recovery suit is worth filing, when the beneficiary is identified and the police are slow to move under section 105 of the BNSS, or when you are being treated as a suspect because the mule account was opened in your name. If your bank branch or the police station is in Kolkata, the West Bengal cyber crime practice page sets out the forums, and the contact page explains how to send the transaction record for a first review.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Can I get my money back after my WhatsApp was hacked?

It depends on how fast you report. If you notify your bank within three working days of the unauthorised transaction, the RBI directions give you zero liability where the fraud is not due to your own negligence. A 1930 complaint filed within hours also lets the beneficiary account be frozen before the money is withdrawn.

What does the RBI say about liability for unauthorised transactions?

The RBI's 2017 customer protection direction limits liability by reporting speed. Report within three working days and your liability is zero. Report within four to seven working days and liability is capped by the bank's board-approved policy. Beyond seven working days, liability follows that policy, subject to the bank proving negligence.

Is a WhatsApp hack that leads to a bank debit a cognizable offence?

Yes. Cheating by personation using a computer resource is punishable under section 66D of the IT Act 2000, and cheating and dishonestly inducing delivery of property falls under section 318(4) of the BNS 2023, which carries up to seven years. Both are investigated by the police once an FIR is registered under BNSS section 173.

How long does a bank take to credit money after a fraud report?

Under the RBI directions the bank must credit the amount provisionally within ten working days of your notification in cases where the loss is to be borne by the bank, and must resolve the complaint within ninety days. In practice, cases where funds were frozen quickly are credited sooner than cases involving a chain of accounts.

What if my bank says I was negligent because I shared an OTP?

The bank will investigate and may deny zero liability, because the protection assumes the customer did not share credentials. You can contest the finding before the bank's nodal officer and then before the RBI Ombudsman under the 2021 integrated scheme. Give an accurate account of what you were told, since call and app logs will be examined.

Does a police complaint alone get my money refunded?

No. An FIR authorises investigation, freezing and attachment of proceeds under section 105 of the BNSS 2023, and a court can order restitution, but the police cannot debit a refund into your account. Refunds come from the bank's reversal process or from a court order, which is why the bank complaint must run in parallel.

Can I recover money sent to a mule account in another state?

Often yes, if the account is frozen early. The portal complaint routes the request to the beneficiary's state police, and the beneficiary bank can place a lien on the balance. Recovery becomes unlikely once the funds have been withdrawn and moved through further layers, which is why the first hours matter more than the first week.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact