Hacking of email: complaint, remedies and civil recovery
By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 4 Nov 2026 · Cyber law
The legal remedies for hacking of email fall into three families that answer three different questions: a criminal complaint for the offence, the bank's liability framework for the money already debited, and a civil suit for recovery from an identified wrongdoer. A complete response usually uses more than one.
When an email account is hacked, victims ask a single question — what can I do — when the law actually offers several distinct remedies, each aimed at a different wrong. A criminal complaint punishes and deters whoever broke into the account and used it to defraud. The Reserve Bank's liability framework shifts the loss of an unauthorised electronic transaction onto the bank. A civil suit recovers money from a wrongdoer who can be identified and sued. Choosing the right one, or the right combination, is what turns a distressing week into a plan.
It helps to separate the two harms the law sees. The first is the intrusion into the mailbox, which is an offence against the confidentiality of a computer resource. The second is the deception practised with that access, which is an offence against property and against the persons who were tricked. A single incident therefore supports a complaint that names both, and a victim who describes only the intrusion, or only the money, leaves half the case on the table for the other side to exploit.
Criminal remedies
The Information Technology Act, 2000
Section 43 creates liability for unauthorised access to a computer resource, and section 66 makes the dishonest or fraudulent version punishable. Section 66C covers identity theft through the fraudulent use of a password or unique identification feature, and section 66D covers cheating by personation through a computer resource. Where stored data is altered or deleted, sections 65 and 66 come into play. The mailbox is the computer resource throughout, so the intrusion itself is squarely punishable even before money moves.
The Bharatiya Nyaya Sanhita, 2023
The deception and the taking are charged under the BNS. Cheating is section 318, cheating by personation is section 319, forgery of documents is section 336, and criminal breach of trust is section 316 where money was entrusted to the wrongdoer. Where several persons acted together, the common intention and abetment provisions apply. The BNS and the IT Act are applied to the same facts rather than in the alternative, which is why a single complaint can name both.
Filing the criminal complaint
The information is given to the police station with jurisdiction, or through the national portal and the 1930 helpline. Under section 173 of the Bharatiya Nagarik Suraksha Sanhita, 2023 the police must record the information, and section 175(3) allows a magistrate to be asked to direct investigation where a station declines. Electronic material produced in court needs the certificate for electronic records contemplated by section 63 of the Bharatiya Sakshya Adhiniyam, 2023.
What the police investigate
Once an FIR is registered, the investigation usually follows the money before it follows the mailbox. Officers ask the provider for access logs, and the banks and payment intermediaries for the chain of the transfer, and they look for the receiving account. The mailbox record supplies identity and intent; the money record supplies the loss. A complainant who can hand over both, neatly dated and complete, shortens an investigation that might otherwise stall at the first request for records.
The certificate for electronic records
Digital material is easy to produce and easy to challenge. When it is relied on in court, the law expects a certificate in the prescribed form under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, recording how the record was produced and by whom. This is why the original message kept in the mailbox is worth more than a forwarded copy, and why a provider's own security report carries more weight than a screenshot of it. Preserve originals first, and let the certification follow.
The bank remedy for an unauthorised debit
Where the loss is a debit from your own account, the operative instrument is not a statute but the Reserve Bank's directions on customer protection in unauthorised electronic banking transactions. They sort transactions by whether the loss arose from the customer's negligence, and along each sort they build a reporting ladder so that prompt reporting yields nil customer liability and delayed reporting shifts liability towards the customer in defined steps. The exact figures change with the regulator's revisions, so the current circular is the source. This remedy sits beside the criminal complaint rather than inside it, and it is often the fastest route to actual money.
Civil recovery
How the remedies interact
The remedies are not rivals. A criminal complaint establishes the offence and may lead to the offender; the bank remedy returns an unauthorised debit; the civil suit recovers from a named wrongdoer. They can run together, and each can reinforce the other: a police acknowledgement supports the bank claim, while a bank refusal gives the ombudsman something to adjudicate. The one thing to avoid is letting them contradict one another, which usually happens when the same person gives different accounts at different counters.
A civil suit for recovery sits against the identified wrongdoer, not against the bank. Its value is durability: a criminal case can end without the money being returned, while a decree against a person with assets can be executed over time. Its limits are identification and solvency, because a suit against someone who cannot be found or has nothing to pay is an expense without a return. A civil claim can also be brought where a business has suffered a measurable loss of reputation or where a contractual counterparty contributed to the fraud, but the facts of each such case are different and the court weighs them on their own merits.
Where the fraud was committed against a customer or vendor rather than against you, remember that the money is theirs to recover; your civil exposure, if any, is a separate question of whether your own arrangements contributed to the loss, and it should be assessed on its own facts.
Choosing among the remedies
| Remedy | Against whom | What it achieves |
|---|---|---|
| Criminal complaint (IT Act, BNS) | The offender | Investigation, punishment, possible court-ordered return |
| Bank liability (RBI directions) | Your bank | Credits back an unauthorised electronic debit |
| National cyber complaint | The banking network | Freezes money still inside the system |
| Ombudsman complaint | The bank, if it refuses | Adjudicates a disputed liability decision |
| Civil suit for recovery | An identified wrongdoer | A decree that can be executed against assets |
Timing and limitation
Each remedy has its own sense of time. The bank liability position is set by the reporting date. A freeze depends on how quickly the complaint reaches the banking network. A civil claim is governed by the periods of limitation that apply to it, and those periods can run while a criminal case is pending, so a victim who simply waits for the prosecution to conclude may find the civil claim barred. There is no single clock for an email fraud; there are three, and the shortest one is the one that costs the most when missed.
Choosing between the remedies in practice
The choice is driven by the facts, not by preference. If your own account was debited and you disclosed nothing, the bank claim is the strongest and quickest lever and the criminal complaint supports it. If a one-time password was given up, the criminal complaint carries more weight and the bank claim narrows. If an identified wrongdoer has assets, a civil suit becomes an additional instrument. If only your sender line was forged and nobody entered your mailbox, the criminal complaint and the payer's own claim are the relevant routes. Matching the remedy to the facts is the whole exercise.
What decides which remedy works
Three facts steer the choice. If money left your account and you disclosed nothing, the bank remedy is strong and the criminal complaint runs alongside it. If money left after you entered a one-time password or clicked a link, the bank remedy weakens and the criminal complaint carries more of the weight. If a wrongdoer can be identified with assets, a civil suit becomes viable on top of everything else. And if the sender line was only spoofed and your account was never entered, you are in the smallest category: there is no intrusion into your mailbox, so the remedy is largely a criminal complaint about impersonation and a civil claim by whoever paid.
No remedy here is a promise, and the four factors above are matters of fact that develop as the case proceeds, not fixed points. What a victim can control is the completeness of the record, and completeness is the difference between a remedy that is available and one that is merely theoretical.
What a victim should do in the first week
The first week decides most of the practical questions. Secure the mailbox, report the debit to the bank in writing, register on the national portal, file the police complaint, and gather the provider's logs and the attacker's messages into one dated file. None of these steps requires a lawyer, and all of them are harder to do well once the trail has cooled. The remedies described above work best when they rest on a record made while the events are still fresh, and that record is the one thing within the victim's control.
Common mistakes
- Treating the criminal complaint as a substitute for the bank claim, and losing the liability position while the police investigation runs.
- Waiting for the criminal case to conclude before filing a civil suit or a national portal complaint.
- Describing only the intrusion and not the deception, or the reverse, in the same complaint.
- Not asking the bank for its reasons in writing, which leaves the ombudsman with nothing to review.
- Overlooking the certificate for electronic records that section 63 of the BSA, 2023 requires when the material reaches court.
Protecting yourself while the remedies run
Investigations and suits take months. In the meantime the sensible precautions are ordinary ones: unique passwords, two-factor authentication, a second-channel confirmation before any bank details are changed, and the habit of reading the sender's full address rather than the display name. None of this recovers money already lost, but it stops the same criminal from taking a second round from the same victim while the first is still being investigated.
When to involve a lawyer
Where the loss is small and the bank acts, the free national channels will carry most of the matter. A lawyer becomes the sensible step when remedies need to be combined — a criminal complaint, a bank claim and a recovery suit all pointing the same way — or when one of them has been refused. A criminal defence lawyer in Kolkata can shape the complaint and the investigation, and because recovery from a wrongdoer is a separate civil proceeding, a civil litigation lawyer in Kolkata is the natural match for that leg. A cyber crime lawyer in Kolkata can hold both tracks together so that the choices do not cancel each other out, and contact the office to have the combination reviewed on your facts.
Need help with a cyber crime matter?
Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.
Call +91-9007000603 WhatsAppFrequently asked questions
What legal remedies exist for hacking of email in India?
Three main families: a criminal complaint under the Information Technology Act, 2000 and the Bharatiya Nyaya Sanhita, 2023; the bank's liability under the RBI directions for an unauthorised electronic debit; and a civil suit for recovery from an identified wrongdoer. A complete response often combines more than one. Each remedy has its own evidence, its own forum and its own clock.
Which is faster, the criminal case or the bank claim?
The bank claim is usually faster for money debited from your own account, because the RBI framework ties liability to the reporting date rather than to an investigation. The criminal case runs on the offender's trail and depends on traceability. Filing the bank claim first does not prevent the criminal complaint; the two run in parallel.
Can I file both a criminal complaint and a civil suit for the same fraud?
Yes. The criminal complaint addresses the offence and the civil suit addresses the money owed by an identified wrongdoer, and they proceed independently. You should not wait for the criminal case to finish before filing a civil suit, because assets can be dissipated and limitation can run while the prosecution is pending.
What is the bank's liability when my hacked email led to a debit?
Under the RBI directions on customer protection in unauthorised electronic banking transactions, liability depends on how promptly you report and whether the loss arose from your negligence. Prompt reporting gives nil customer liability; delay shifts it towards you in defined steps. The exact figures follow the regulator's current circular. The regulator's current circular is the operative text, not an old figure.
Do I need to go to court to recover money from an email fraud?
Not always. The bank remedy and the ombudsman handle unauthorised debits without a court case, and a national portal complaint can freeze money still in the banking system. A court is needed mainly for a civil recovery suit against an identified wrongdoer or where a complaint has been wrongly refused.
What evidence is needed for a hacking of email remedy to succeed?
Provider access logs, the attacker's messages with full headers, the bank statement, and every written complaint and reply. Electronic records used in court need a certificate in the prescribed form under section 63 of the Bharatiya Sakshya Adhiniyam, 2023, so preserve the originals rather than screenshots alone. Preserve the originals rather than copies or screenshots alone.
Is a civil suit worth pursuing after an email fraud?
It is worth pursuing when a wrongdoer can be identified and has assets to satisfy a decree, and when the amount justifies the cost. It is generally not worth it against an unidentified person. A civil suit can also outlast the criminal case, which is why identification and solvency are the two factors that decide the question.
Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.
Related articles
Cyber crime lawyer in your city · Bank account freeze help · Contact