Act fast

My social media or email account was hacked.

Simple answer

Act fast to take it back. Use the platform's official recovery page, change your passwords and turn on two-step verification. Getting into someone's account without permission is an offence under the IT Act. If the hacker is misusing it or asking your friends for money, report it on cybercrime.gov.in.

Real-life examples

Tenzin's Instagram was hacked, and the hacker messaged his friends asking for ₹10,000 by UPI. He used Instagram's hacked-account recovery, posted a warning from another account and filed a complaint. Two friends who had paid called 1930.

Sunita's ex-husband still knew her email password and kept reading her mail. Knowing a password is not permission. Opening her account without her consent can be an offence, and she can also claim compensation.

What should you do?

1Use only the platform's official 'forgot password' or 'hacked account' page. Never pay anyone who offers to recover it.
2Once back in, change the password (and anywhere you reused it), turn on two-step verification and log out of all other devices.
3Remove unknown phone numbers, emails and linked apps, and check for email forwarding rules you didn't set.
4Warn your contacts not to click links or send money. If your bank or UPI is linked to the account, tell your bank.
5Report on cybercrime.gov.in with screenshots and the platform's 'password changed' emails. Call 1930 if anyone lost money.
6To claim compensation for your loss, ask a lawyer about a claim under IT Act Section 43 before your state's Adjudicating Officer.

Exceptions & limits

If the platform locked or suspended your account for breaking its rules, that is not hacking. Appeal through the platform, and then to the Grievance Appellate Committee.

Official legal reference

Information Technology Act, 2000 — Section 43
Accessing someone's computer, phone or account without permission, or copying or damaging their data: the person must pay compensation.
Read the official text
Information Technology Act, 2000 — Section 66
Doing any Section 43 act dishonestly or fraudulently: up to 3 years' jail, fine up to ₹5 lakh, or both.
Read the official text
Information Technology Act, 2000 — Section 66C
Fraudulently or dishonestly using someone else's password, electronic signature or other unique identification feature: up to 3 years' jail and fine up to ₹1 lakh.
Read the official text
Information Technology Act, 2000 — Section 46
Adjudicating Officers appointed under the Act decide claims for compensation under Section 43.
Read the official text

Where to get help

National Cyber Crime Helpline

Report online financial fraud immediately so the money trail can be frozen.

Call 1930 cybercrime.gov.in

Source & status

Applies to: All of India
Law in force since: 27 Oct 2009
Legal review: Draft — awaiting lawyer review

Educational information, not legal advice for your case. Exact facts and the law that applies matter — speak to a lawyer before acting.