Home › Legal Articles › Digital evidence

Hacking of email evidence to preserve in 48 hours

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 3 Nov 2026 · Digital evidence

If your email account has been hacked, the single most important thing you can do in the first 48 hours is preserve the evidence before it disappears. Emails can be deleted by the attacker, login logs rotate, and recovery codes change. India's IT Act 2000 and the Bharatiya Sakshya Adhiniyam 2023 both recognise electronic records as evidence, but only if you capture them properly.

Email hacking is the unauthorised access, use or takeover of an email account. In India it is prosecuted mainly under the Information Technology Act, 2000, section 66 for computer-related offences, section 66C for identity theft and section 66D for cheating by personation using a computer resource, and, where money or property is taken, under the Bharatiya Nyaya Sanhita, 2023. Which section fits matters far less, in the first two days, than locking the evidence down before the attacker erases it.

The first 48 hours decide how strong your complaint will be. An attacker who controls a mailbox usually deletes mail, adds forwarding rules, changes the recovery phone number and email address, and drains any wallet or payment account linked to the address. Investigators can still work on a recently compromised account, but a mailbox that has been quietly reorganised for a week is far harder to reconstruct. Electronic records are admissible evidence in Indian courts, yet only when they are captured in a form the court will accept and accompanied by the right certificate.

What counts as hacking an email account

Not every unexplained login is a hack, and understanding what actually happened helps you choose the right remedy instead of over-reporting. The law treats the following as unauthorised access, or as its direct consequences.

Someone reading, copying or forwarding your mail without your consent.
Someone sending mail from your address, or deleting mail you did not delete.
Someone resetting your password or altering the recovery phone and address.
Someone using a linked wallet, card or payment account to move money.
Someone using your identity to defraud the people in your address book.

If you lent your credentials, or shared a device and a login with a colleague or family member, the position is genuinely different, and the dispute may be about trust and authority rather than intrusion. Where an employee with legitimate access exceeded that access for personal gain, the law may treat it as criminal breach of trust under BNS section 316 rather than as a pure outsider hack.

How attackers usually get in

Most hacks are not clever technical break-ins; they exploit habits. Knowing the common methods helps you close the door the attacker used and explain the sequence clearly to the police.

Password reuse, where a password leaked from one service opens another.
Phishing pages that copy a familiar login screen and harvest your password.
Malicious third-party apps or "app passwords" granted access to your mailbox.
A one-time code read from a message you were tricked into revealing.
An unlocked or infected device left in someone else's hands.

What the law says

More than one provision can apply to the same hack, depending on what the intruder did after gaining access. The important point is that email hacking is a recognised offence, not merely a matter for the platform's help centre.

IT Act section 43: unauthorised access to, downloading, copying or extracting data from a computer resource, which also grounds a claim for compensation.
IT Act section 66: computer-related offences committed dishonestly or fraudulently.
IT Act section 66C: identity theft, meaning the fraudulent use of another person's electronic signature, password or other unique identification feature.
IT Act section 66D: cheating by personation using a computer resource or communication device.
IT Act sections 67 and 67B: publishing obscene or sexually explicit material, where the intruder posts or mails such content from your account.
BNS section 318 on cheating and section 336 on forgery: where your contacts are tricked into sending money, or documents and emails are fabricated.
BNS section 316: criminal breach of trust, which can apply against a person entrusted with your account credentials, such as an employee.
BSA 2023 section 63: the provision on admissibility of electronic records and the certificate that must accompany them.
BNSS 2023 section 173: the FIR procedure, with section 175(3) allowing a limited preliminary enquiry for offences punishable with three to seven years.

Where the hack is used to move money or to impersonate you to your contacts, the cheating and forgery provisions of the Bharatiya Nyaya Sanhita and the IT Act typically run together, and the police may register the case under both statutes.

Why the first 48 hours matter

Most of what a court will eventually rely on is generated automatically and then rotates out of existence. Login session logs, "new sign-in" alert emails, and one-time-password records all have limited lives, and a service provider may retain them for only a fixed period before overwriting or deleting them. Delay means asking investigators to recover details that may no longer exist on the server.

There is also an evidentiary rule to respect. Under the Bharatiya Sakshya Adhiniyam, 2023, an electronic record is generally proved by a certificate identifying the record and describing the process by which it was produced. The cleanest certificate describes a copy taken early, from a device that was not subsequently modified. Screenshots taken a week later, after you have upgraded a phone or cleared a cache, are weaker and easier for the other side to challenge. This is precisely why evidence collection should begin on the day you notice the hack.

The evidence you must preserve

Work through the following list on the day the hack is discovered. It is not necessary to do everything before contacting anyone, but the steps that come first should be done first.

Do not delete anything from the account, and do not wipe the phone or laptop you used to reach it.
Change the password from a device you trust, but export mail first if the attacker still has access.
Take dated screenshots of the inbox, sent items, trash, and any unfamiliar rules or filters.
Use your mail client's export or download-archive feature to keep a complete copy of the mailbox as a single file.
Save every security alert email, whether a new sign-in, a password change or a recovery-details update, together with its full headers.
Note the exact times of every suspicious event in a plain diary, in chronological order.
Record the recovery email address and phone number the attacker set, if the account settings still show them.
Keep bank or wallet statements that show any money moved, and write down the transaction reference numbers.
Avoid posting publicly about the hack until the above is done; a later post cannot undo a deletion, though its timestamp can help.

Where each piece of evidence sits

The table below maps the material an investigator usually asks for to where it is found and how it is best preserved.

Evidence	Where it sits	How to preserve it
Security alert emails	Your inbox and the provider's account-security page	Download as a file with full headers; do not forward and then delete the original
Login and session log	Account security settings and the provider's own records	Request in writing; the provider may retain it only briefly
Forwarding and filter rules	Mailbox settings	Screenshot, then export the rule list with its dates
Recovery phone and email changes	Account recovery settings	A timestamped screenshot before you reverse them
Payment instructions to contacts	Sent items and recipients' inboxes	Ask recipients to preserve the original message untouched
Bank or wallet debits	Bank statements and payment apps	Download statements and note the transaction references

How to file the complaint, step by step

Once the material is preserved, report it in the following order. Keeping the sequence matters, because each acknowledgement strengthens the next stage.

Call the national cyber-crime helpline on 1930 and note the acknowledgement number you are given.
File the same complaint on the National Cyber Crime Reporting Portal at cybercrime.gov.in and upload the evidence as one organised set.
If money moved, inform your bank or wallet provider at once and ask for the transaction to be flagged; in parallel, ask the bank's nodal officer for a written response on liability.
Go to the police station with jurisdiction and give a written complaint, keeping a stamped receipt copy for yourself.
If the station declines to register the FIR, send the complaint to the Superintendent of Police, and thereafter to the Magistrate if it is still unresolved.
Where the hacked address belongs to a business, preserve internal access logs and the list of people with administrative rights.
Keep every acknowledgement, from the helpline number and portal complaint ID to the bank reference, in a single folder.

What decides the outcome

Investigators, banks and courts look at a small number of practical questions rather than at how upsetting the incident was.

How quickly you reported: a complaint filed within hours is treated differently from one filed weeks later.
Whether the evidence was captured before the account was changed a second time.
Whether the account had weak or reused passwords, or third-party apps with unusual access.
Whether money loss is documented by bank records and not only by screenshots.
Whether the same intruder attacked others, which can link separate cases into a pattern.

Common mistakes

Deleting the attacker's emails "to clean up", which destroys the best evidence available.
Resetting the phone before exporting the mailbox.
Reporting only to the platform and not to the helpline, the portal and the police.
Forwarding alert emails and then deleting the originals, which strips the original headers.
Waiting for the platform to handle it before filing a police complaint.
Handing the account back to the attacker by reusing a password exposed elsewhere.

When to involve a lawyer

A simple account takeover with no money loss can often be handled through the helpline, the portal and the platform's recovery process. A lawyer becomes genuinely useful when the police are slow or refuse to register the FIR, when a large sum has moved, when you are served with a notice because the compromised account was used against someone else, or when defamatory material was posted from it. In each of those situations, a cyber crime lawyer in Kolkata can push the complaint forward, prepare the electronic-evidence certificate the court expects, and keep the criminal and civil tracks aligned so that one does not weaken the other.

Location can matter in practice. Complaints that reach the courts in Kolkata are handled at Bankshall Court for the city police area, with further proceedings before the City Sessions Court and the Calcutta High Court. If the accused is in another state or the data is held on servers elsewhere, the West Bengal cyber crime practice can advise on where the complaint should properly be filed, which is often the difference between a case that moves and one that is returned for want of jurisdiction.

The practical rule is straightforward. Preserve first, report within 48 hours, and escalate with legal help only when the ordinary channels stall or when the stakes are large enough that the outcome will be decided in court rather than by a bank or a platform's support desk. A short written chronology of events, kept from the first day, is often the single document that lets a lawyer move quickly if the matter reaches that stage.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

How soon must I report an email hacking incident in India?

There is no fixed legal deadline, but you should report within 48 hours. Early reporting preserves server-side logs that providers may overwrite, strengthens the electronic-evidence certificate under BSA 2023 section 63, and is treated more seriously by banks and police. Call 1930 and file on cybercrime.gov.in the same day you notice the takeover.

Is email hacking a bailable offence in India?

It depends on the section invoked. Offences under IT Act sections 66, 66C and 66D are generally bailable and cognizable, carrying imprisonment up to three years. If the hack is used for aggravated cheating under BNS section 318, the offence can be non-bailable and punishable more severely. The charge sheet decides which applies.

Can the police obtain my login logs from the email provider?

Yes, investigators can requisition records from a service provider through the legal process available to them under the BNSS. You cannot compel the provider yourself, because a private individual has no power to force disclosure. That is why you should file a police complaint rather than relying only on the platform's internal recovery process.

Can I get my account back if the attacker changed my recovery email?

Often yes, but it is not guaranteed. Major providers run account-recovery processes that weigh device history, prior passwords and identity documents. Recover through the official process, never through a link in an unexpected message, and preserve your own copies of the recovery attempts as evidence. If recovery fails, the police complaint becomes the main route.

Do screenshots count as evidence of email hacking in court?

Screenshots can support a case but are weak on their own. An electronic record is best proved by the original data together with a certificate under BSA 2023 section 63 describing how it was produced. Where possible, keep the original file, the full headers and a dated record of when each screenshot was taken.

What if money was taken from a wallet linked to my email?

Treat it as two connected problems. Report the unauthorised transaction to your bank or wallet provider at once under the RBI directions on customer liability, and report the account takeover as a cyber-crime on 1930 and cybercrime.gov.in. Keep the transaction references, because the bank's liability decision turns on how quickly you notified it.

Can I complain if someone accessed my email but took nothing?

Yes. Unauthorised access to a computer resource is itself an offence under IT Act section 43 and section 66, even if no money was taken and nothing was deleted. Log in, preserve the evidence, and file a complaint. Whether police prioritise it is a practical matter, but the conduct is clearly punishable.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact