Hacked WhatsApp, Instagram or Email Account in Hyderabad: The Law and What to Do

This guide is for people in Hyderabad and Telangana whose WhatsApp, Instagram, Facebook or email account has been taken over by someone else, through a SIM swap, a shared OTP or code, a phishing link or a malicious file, and for small businesses whose Instagram or WhatsApp Business account has been hijacked. It explains which offences the law describes, where to report, what the IT Rules require of platforms, the rules on SIM swaps, and what is and is not yet in force on data breaches.

First steps · The offences · Reporting to the police · Complaints to the platform · SIM swaps · Compensation · Data breaches · Business accounts · Checklist

First steps, as the agencies and platforms describe them

• Warn your contacts: the Indian Cyber Crime Coordination Centre (I4C) of the Ministry of Home Affairs, in a release of 7 August 2026 on WhatsApp account takeovers, advised that if an account is compromised, users should “immediately log out of all linked devices, alert contacts not to open any file received from the account, and get the computer scanned with an updated anti-virus”. WhatsApp says the person using your account “could impersonate you in chats and groups”.
• WhatsApp: WhatsApp says that when you re-register your account with the 6-digit code, “all devices logged into your WhatsApp account are automatically logged out”, that “Changing your password won’t remove someone else from your account”, and that “It’s not possible to recover an account without a SIM card with the same phone number as your account”. It also says that if you report the compromised account you are trying to recover, “we might ban it”, and recommends “trying to recover your account before reporting it”.
• Instagram, Facebook and Google: Instagram says you may be able to undo an email change from the message sent by security@mail.instagram.com, and may ask for a video selfie, which it says “will be deleted within 30 days”. Facebook recommends visiting www.facebook.com/hacked. Google points users to its account recovery page where “Someone changed your account info, like your password or recovery phone number”.
• Do not try to get into the intruder’s accounts or devices: section 43 of the IT Act makes a person who accesses a computer resource without the permission of its owner or the person in charge liable to pay compensation, and section 66 makes that access an offence where it is done dishonestly or fraudulently.

If money has already been lost, see our guides on the first 48 hours after a cyber fraud and bank fraud refunds.

The offences the law describes

• Unauthorised access (IT Act, 2000, section 43, a compensation provision): lists acts done “without permission of the owner or any other person who is incharge of a computer, computer system or computer network”, including where a person “accesses or secures access”, “downloads, copies or extracts any data”, introduces a computer contaminant or virus, or “denies or causes the denial of access to any person authorised to access”. Section 43 itself provides for compensation, not punishment.
• Section 66: “If any person, dishonestly or fraudulently, does any act referred to in section 43, he shall be punishable with imprisonment for a term which may extend to three years or with fine which may extend to five lakh rupees or with both.”
• Identity theft (section 66C): “Whoever, fraudulently or dishonestly make use of the electronic signature, password or any other unique identification feature of any other person” is punishable with imprisonment up to three years and fine up to one lakh rupees.
• Cheating by personation using a computer resource (section 66D): “Whoever, by means of any communication device or computer resource cheats by personation” is punishable with imprisonment up to three years and fine up to one lakh rupees. The section requires cheating; it may apply where a hijacked account is used to deceive contacts.
• Classification and investigation: under section 77B, “the offence punishable with imprisonment of three years shall be bailable”, and offences with three years and above are cognizable. IT Act offences are investigated by a police officer not below the rank of Inspector (section 78).
• When contacts are asked for money: under the Bharatiya Nyaya Sanhita, 2023, a person “is said to cheat by personation if he cheats by pretending to be some other person”, whether the person personated “is a real or imaginary person”; the punishment is up to five years, or fine, or both (section 319). Cheating that “dishonestly induces the person deceived to deliver any property” carries up to seven years and fine (section 318(4)). Under the First Schedule to the Bharatiya Nagarik Suraksha Sanhita, 2023, section 319(2) is cognizable and bailable, section 318(4) is cognizable and non-bailable, and simple cheating under section 318(2) is non-cognizable.
• Demands for money to return an account: extortion under section 308 of the Bharatiya Nyaya Sanhita covers putting a person “in fear of any injury” and thereby inducing delivery of property; its illustration (e) is a threat sent “through an electronic device”. Whether a particular demand fits is a question for advice. See also our sextortion guide.

Reporting to the police and the national portal

• National Cyber Crime Reporting Portal: cybercrime.gov.in has a “Report Other Cybercrimes” option under which “you can report complaints pertaining to cybercrimes such as mobile crimes, online and social media crimes, online financial frauds, ransomware, hacking”. Registration needs a name and “valid Indian mobile number” with an OTP. The portal says “Any victim of financial cyber fraud can dial helpline number 1930”.
• Hyderabad City Cyber Crimes Police Station: its page says it deals in “Hacking & Unauthorized Access”, “Identity Theft”, “Whatsapp DP Frauds”, “Email Spoofing” and “Phishing”. It lists its location as “Central Crime Station Building, Old Commissioner Office, Baseerbagh, Hyderabad” and the number “8712666346 (24/7)”. The same page says that victims of cyber fraud who have lost more than Rs 1 lakh may contact that number, and those who lost less than Rs 1 lakh the local police station; it states no such rule for a hack without money loss.
• Any police station: information about a cognizable offence “irrespective of the area where the offence is committed, may be given orally or by electronic communication to an officer in charge of a police station”; information given electronically is taken on record “on being signed within three days” (BNSS, section 173(1)). A copy is to be given “free of cost, to the informant or the victim” (section 173(2)).
• FIR or preliminary enquiry: in Lalita Kumari v Government of Uttar Pradesh (12 November 2013), the Supreme Court held that “Registration of FIR is mandatory under Section 154 of the Code, if the information discloses commission of a cognizable offence”. Under section 173(3) of the BNSS, for a cognizable offence punishable “for three years or more but less than seven years”, the officer in charge may, with the prior permission of an officer not below Deputy Superintendent of Police, conduct a preliminary enquiry “within a period of fourteen days” or proceed with investigation. That band includes IT Act sections 66, 66C and 66D and BNS section 319.
• If the police refuse: the substance of the information may be sent “in writing and by post, to the Superintendent of Police concerned”, who, if satisfied that it discloses a cognizable offence, is to investigate or direct an investigation, “failing which such aggrieved person may make an application to the Magistrate” (BNSS, section 173(4)).

Complaints to the platform under the IT Rules

• Grievance Officer: every intermediary must publish “the name of the Grievance Officer and his contact details as well as mechanism by which a user or a victim may make complaint” (IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, rule 3(2)(a)). As amended in February 2026, the Grievance Officer is to “acknowledge the complaint within twenty-four hours and resolve such complaint within a period of seven days”.
• Removal of impersonating content: platforms must make reasonable efforts not to host information that “impersonates another person” or “contains software virus” (rule 3(1)(b)). A complaint seeking removal of such information is to be “resolved within thirty-six hours of such reporting”. On a complaint by an individual or any person on his behalf about content that is prima facie “in the nature of impersonation in an electronic form”, the platform is, as amended in February 2026, to “take all reasonable and practicable measures to remove or disable access to such content” within two hours (rule 3(2)(b)). These are times for handling complaints and removing content; the Rules do not set a time for restoring a hijacked account.
• Appeal: a person aggrieved by the Grievance Officer’s decision, or whose grievance is not resolved within the period, “may prefer an appeal to the Grievance Appellate Committee within a period of thirty days” (rule 3A(3)). The appeal process is conducted “through digital mode”, at www.gac.gov.in.
• Large platforms: a significant social media intermediary must appoint a Chief Compliance Officer, a nodal contact person “for 24×7 coordination with law enforcement agencies” and a Resident Grievance Officer (rule 4(1)), and must let Indian users “voluntarily verify their accounts” (rule 4(7)).
• Evidence kept by the platform: information removed under the Rules is to be preserved “for one hundred and eighty days for investigation purposes”, or longer if required by a court or authorised agencies (rule 3(1)(g)).

Someone else creating a fake profile in your name is covered in our guide on fake profiles and online defamation; repeated monitoring or contact is covered in our cyberstalking guide.

SIM swaps and duplicate SIMs

• Obtaining a SIM by fraud: under section 42(3)(e) of the Telecommunications Act, 2023, whoever “obtains subscriber identity modules or other telecommunication identifiers through fraud, cheating or personation” is punishable with imprisonment up to three years, or fine up to fifty lakh rupees, or both. All offences under section 42 “shall be cognizable and non-bailable” (section 42(7)). The Government has said that section 42 came into force on 26 June 2024.
• After a SIM replacement: the Department of Telecommunications said in August 2023 that “A subscriber has to undertake complete KYC for replacement of his SIM and there will be bar of 24 hours on outgoing & incoming SMS facilities.” Under TRAI’s Mobile Number Portability (Ninth Amendment) Regulations, 2024, in force from 1 July 2024, a number cannot be ported out until “a period of seven days has expired from the date of SIM swap or replacement”.
• Connections in your name: the Sanchar Saathi portal’s “Know Mobile Connections in Your Name” facility lets a subscriber “check the number of mobile connections taken in his/her name” and report those “not required or not taken”. Sanchar Saathi says its Chakshu facility “is not a facility for reporting about financial fraud or cyber-crime cases”, and points victims to 1930 or cybercrime.gov.in.
• Lending a SIM: the Department of Telecommunications has cautioned citizens “not to share or transfer SIM cards issued in their name, as legal liability may extend to the original subscriber if the SIM is found to be misused”.

Compensation

• Section 43 compensation: a person who does any of the acts in section 43 is liable “to pay damages by way of compensation to the person so affected”. The adjudicating officer under section 46 decides claims “in which the claim for damage does not exceed rupees five crore”; above that, jurisdiction lies “with the competent court” (section 46(1A)).
• Before taking this route: the officer, the place of filing and the procedure in Telangana are points to confirm with a lawyer.

If a company’s data breach led to the takeover

• Current law: section 43A of the IT Act (compensation where a body corporate’s negligence with sensitive personal data causes wrongful loss) remains in force until the Digital Personal Data Protection Act’s provision omitting it commences.
• Not yet in force: the Digital Personal Data Protection Act, 2023 requires a Data Fiduciary, in the event of a personal data breach, to “give the Board and each affected Data Principal, intimation of such breach” (section 8(6)), and rule 7 of the DPDP Rules, 2025 sets out what the intimation must contain. Under the commencement notification of 13 November 2025, these provisions come into force eighteen months after publication, that is, in May 2027.
• Platforms’ own reporting: the CERT-In Directions of 28 April 2022 require “Any service provider, intermediary, data centre, body corporate and Government organisation” to report listed incidents, including “Unauthorised access to social media accounts”, to CERT-In within six hours. The duty is theirs, not an individual user’s.

Business accounts

• The offences and reporting routes described above are not limited to personal accounts. Instagram has separate guidance where an account “is a professional account and you’re able to log in, but a hacker is still taking actions on your account”.
• Records of who held the login (staff, agencies), payment pages linked to the account, and messages sent to customers in the business’s name may be relevant to a complaint.

Checklist

• Screenshots of messages sent from the account, with dates, times and the contacts who received them.
• Emails or SMS from the platform about password, email, phone or two-step changes.
• The SIM history: any sudden loss of network, and the telecom operator’s record of a SIM replacement.
• The link, file or call that came before the takeover.
• Platform complaint and ticket numbers, and the dates of each reply.
• The NCRP acknowledgement number, and any FIR or petition number.
• Details of any money paid by contacts, and the bank and UPI references.

Related guides: first 48 hours after a cyber fraud, fake profiles and online defamation, cyberstalking, bank fraud refunds and notices from the cyber police.

For a discussion about a hacked or hijacked account, a complaint to the police or a platform, or a SIM swap with Musab Hashmi & Associates, call +91 89771 24916 or send an enquiry. Do not include passwords, OTPs or identity numbers in the first message.

General legal information, not legal advice. Checked on 31 October 2026 against the Information Technology Act, 2000 as amended in 2008 and by the Jan Vishwas (Amendment of Provisions) Act, 2023, the Bharatiya Nyaya Sanhita, 2023, the Bharatiya Nagarik Suraksha Sanhita, 2023, the IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 as updated on 10 February 2026, the Telecommunications Act, 2023, TRAI’s Mobile Number Portability (Ninth Amendment) Regulations, 2024, the Digital Personal Data Protection Act, 2023 with the commencement notification and the DPDP Rules, 2025 of 13 November 2025, the CERT-In Directions of 28 April 2022, the Supreme Court’s judgment in Lalita Kumari v Government of Uttar Pradesh (2013), releases of the Ministry of Home Affairs and the Department of Telecommunications, the Sanchar Saathi portal, the National Cyber Crime Reporting Portal, the Hyderabad City Police Cyber Crimes Police Station page, and the help pages of WhatsApp, Instagram, Facebook and Google.