Losing access to WhatsApp or Instagram is unsettling on its own — but it becomes a genuine legal problem the moment someone else starts using your identity, whether that’s posting on your behalf, messaging your contacts, or asking your friends and family for money. This guide covers both sides of the problem: getting the account back, and knowing exactly what legal options exist if it’s already been misused.
Is Hacking a Social Media Account Actually a Crime?
Yes. Unauthorised access to someone’s account is a punishable offence under India’s Information Technology Act, regardless of which platform is involved. If the hacker impersonates you, sends messages as you, or uses your account to defraud your contacts, additional and more serious provisions apply.
The First 30 Minutes: Recovering the Account
Speed matters. Most platforms give a limited window to reclaim a compromised account before it’s harder to recover.
- Try the platform’s official recovery flow first — “Forgot Password” and, where available, “Report Compromised Account” on Instagram, or the WhatsApp re-registration process using your phone number.
- Change your linked email password immediately, since a hacker often controls the recovery email as well.
- Post publicly on another platform (or ask a trusted contact to do so) that your account has been compromised and shouldn’t be trusted for now — this matters legally, not just practically, since it demonstrates you acted promptly to limit harm.
- Screenshot everything before it disappears — messages sent from the hacked account, changed profile details, and any suspicious posts. These will matter as evidence.
- Enable two-factor authentication the moment you regain access, so this doesn’t happen again.
What the Law Actually Says: The Relevant Sections
A few provisions of the Information Technology Act cover most hacking scenarios:
- Section 43 — unauthorised access to a computer resource (this covers the account itself being accessed without permission)
- Section 66 — hacking with dishonest or fraudulent intent, punishable with imprisonment up to three years and/or a fine up to ₹5 lakh
- Section 66C — identity theft, specifically covering fraudulent use of someone’s password, digital signature, or other unique identifying feature
- Section 66D — cheating by personation using a computer resource, which applies directly when a hacked account is used to impersonate you and deceive others
- Section 67 / 67A — if the hacker publishes or transmits obscene or sexually explicit material through the account
Depending on what the hacker did with the account, provisions of the Bharatiya Nyaya Sanhita covering cheating and criminal intimidation can also apply alongside the IT Act.
If the Hacked Account Was Used to Scam Your Contacts
This is one of the most common and distressing versions of this problem: a hacker gains access to WhatsApp or Instagram and messages your close contacts asking for urgent money, using your name and photo to make the request believable.
Two things are worth knowing clearly. First, you are generally not held liable for money your contacts lose to a scammer after your account was compromised — provided you can show you acted promptly, reported the hack, and warned people once you realised what happened. Second, anyone who did send money should treat it as a fraud case in its own right — reportable separately through 1930 or the national cyber crime portal, since the bank transfer itself may still be traceable in the golden hours after it happens.
Filing a Complaint: Cyber Crime Portal and Platform Grievance Officer
There are two parallel routes, and it’s worth using both rather than choosing one:
The legal route — file a complaint on the National Cyber Crime Reporting Portal (cybercrime.gov.in) or at your nearest cyber crime police station. This creates an official record and is the route that leads to an FIR if the case is serious. Social media and hacking cases both fall under the categories our Cyber Grievance practice handles regularly, and we’ve covered the filing mechanics in detail in our guide on how to file a cyber crime complaint in Hyderabad.
The platform route — every social media intermediary operating in India is legally required to appoint a Grievance Officer under the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, who must acknowledge a complaint within 24 hours and resolve it within 15 days. If Instagram or WhatsApp’s automated recovery tools fail you, the Grievance Officer complaint is the formal escalation path — and a lawyer’s letter citing the specific rule tends to move faster than a support ticket.
If you’re in Hyderabad, the same jurisdiction rules that apply to other cyber crime complaints apply here too — cases fall under whichever of the Hyderabad City, Cyberabad, or Rachakonda commissionerates covers where you live or where the incident occurred, and residents under Hyderabad City Police can also use C-Mitra to file the FIR from home once the initial 1930/portal report is made, the same process covered in our filing guide.
When Private Photos or Videos Are Involved
If a hacker has accessed and threatens to share, or has already shared, private or intimate images or videos, this moves into more serious territory. Content involving nudity, sexual material, impersonation, or morphed images is subject to a stricter takedown obligation — platforms are required to act on such complaints within 24 hours of receiving them, not the standard 15-day window. This is treated with the same seriousness as any other case of cyber blackmail, and time-sensitive evidence preservation matters enormously here — don’t wait to consult a lawyer if this applies to your situation.
When You Need a Lawyer, Not Just the Portal
- The platform’s automated recovery and Grievance Officer route have both failed to restore your account or remove harmful content
- The hacked account was used to defraud your contacts and there’s a real financial loss to recover
- Private or intimate images are involved
- You need your screenshots and digital evidence properly certified under Section 65B of the Indian Evidence Act for a case to hold up
- The matter needs to escalate to a formal legal notice or a writ petition to compel platform action
Frequently Asked Questions
Yes. It’s an offence under Sections 43 and 66 of the IT Act, with additional charges under Section 66C (identity theft) or 66D (cheating by personation) applying if the hacker impersonates you or defrauds someone using your account.
Yes, and it’s worth doing. If the account was misused while compromised — messages sent, money solicited, content posted — filing a complaint creates a formal record, which matters if the case needs to be pursued later or if someone else lost money because of it.
Generally no, provided you acted promptly once you learned of the hack — recovering the account, reporting it, and warning your contacts. Each affected contact should also file their own complaint for the money they lost, since that’s a separate, traceable transaction.
Screenshots of unauthorised messages or posts, any communication from the hacker, login alert emails, and a timeline of when you noticed and acted. If the matter proceeds to a formal complaint or court, this evidence typically needs to be certified under Section 65B of the Indian Evidence Act.
Sources
- Information Technology Act, 2000 (as amended) — Sections 43, 66, 66C, 66D, 67, 67A
- Ministry of Electronics and Information Technology, Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, Rule 3(2)
- Indian Evidence Act, 1872 — Section 65B (admissibility of electronic evidence)
This article is intended for general informational purposes and does not constitute legal advice. Platform policies and enforcement practices can change, and individual cases vary. If your account has been hacked and misused in Hyderabad, it’s worth getting a specific opinion from a cyber law advocate.