Online Safety · URGENCY: HIGH
Account Hacked or Taken Over — Recovery & Reporting
Act fast: recover the account through the platform’s official recovery page, then secure it (new password, two-factor authentication, sign out other sessions). Warn your contacts about impersonation, check any linked email/bank/UPI, and report on cybercrime.gov.in — call 1930 if money is involved.
A hijacked email or social account is often used to reset your other accounts and to scam your contacts, so speed and sequence matter. This guide walks through regaining access, locking the account down, containing the damage and reporting the offence.
What to do now
- Use the platform’s official recovery flow to regain access (links below).
- If you still have access, change the password, turn on two-factor authentication and sign out all other sessions.
- If any money moved or a payment app is linked, call 1930 and inform your bank.
Recover and secure the account
- 01
Recover access
Use the platform’s official “hacked / account recovery” page (see the resources below). Follow the identity-verification steps; do not use third-party “recovery services”.
- 02
Reset credentials
Set a strong, unique password. Change it on any other account that used the same password.
- 03
Turn on two-factor authentication
Enable 2FA (authenticator app or OTP) so a stolen password alone can’t get back in.
- 04
Kick out the intruder
In security settings, sign out / remove all other active sessions and devices, and revoke unknown connected apps.
- 05
Contain the damage
Check the recovery email and phone number are yours, review mail filters/forwarding rules, and secure your primary email first — it controls password resets everywhere.
- 06
Warn your contacts
Tell friends/family the account was compromised so they ignore any money requests or links sent from it while it was hijacked.
- 07
Report it
File on cybercrime.gov.in (identity theft / impersonation), and use the platform’s India grievance channel if needed.
National Cyber Crime Reporting Portal
Signs your account was compromised
- Password no longer works, or you were signed out unexpectedly
- Recovery email / phone number was changed without you
- Posts, messages or money requests you did not send
- Login alerts from unfamiliar devices or locations
Documents to keep available
- The account’s username / registered email or phone number
- Any login-alert emails or SMS you received
- Screenshots of unauthorised activity or the changed settings
- A government ID, if the platform’s recovery asks to verify identity
Requirements may vary by case and authority.
What not to do
- Do not pay “hackers” or “recovery agents” who promise to restore the account.
- Do not reuse the old or a shared password.
- Do not click links in messages sent from the compromised account or in “your account is suspended” phishing mails.
Frequently asked questions
My email was hacked — what do I secure first?
Your primary email, because it can reset the password on almost every other account. Recover it, change the password, enable 2FA, then move on to the accounts linked to it.
The hacker changed my recovery email and phone. Can I still get in?
Yes — the major platforms have an account-recovery flow for exactly this that verifies your identity another way. Use the official recovery page for that platform (links in resources).
Should I report it even if I recovered the account?
Yes. Report on cybercrime.gov.in — account takeover and impersonation are offences, and a report helps if the account was used to defraud others in your name.
Official resources
When professional assistance may be appropriate
Where an issue significantly affects your legal position, banking access, livelihood or business, or involves a notice, investigation or multiple jurisdictions, consider advice from an appropriate qualified professional.
Relevant professional types: Cyber crime lawyer
Need help with this issue?Sources: National Cyber Crime Reporting Portal (cybercrime.gov.in) · Platform account-recovery help centres · CERT-In
Last reviewed: 30 August 2026. This independent guide is general information, not legal advice, and does not control official investigations or processes.