Facebook account hacked: recovery, FIR and legal steps

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Cyber crime

A hacked Facebook account is an offence, not just an inconvenience. Unauthorised access is punishable under Section 66 of the IT Act, 2000, identity theft under Section 66C and cheating by personation under Section 66D. Recover the account first, preserve the login records, then register an FIR under Section 173 of the BNSS, 2023.

When your Facebook account is taken over, three things happen at once and they need to be handled in the right order. Someone has accessed a computer resource without your authorisation, which is an offence under Section 66 of the Information Technology Act, 2000. Your name, photograph and identity have been used, which is identity theft under Section 66C. And if money, gifts or favours were demanded from your friends in your name, that is cheating by personation under Section 66D, and it also attracts Section 318 of the Bharatiya Nyaya Sanhita, 2023.

The recovery comes first, because every hour the account stays in the wrong hands is an hour in which the fraud spreads to people who trust you. The legal record comes second but not much later, because the login history, device identifiers and IP logs that prove the takeover are held by Meta for a limited period. A complaint filed on day one gets records. A complaint filed after two months often gets an apology.

What the takeover actually is, in law

Section 66 of the IT Act is the core provision. It applies where a person dishonestly or fraudulently does an act referred to in Section 43, which covers unauthorised access, downloading, damaging or disrupting a computer resource. The punishment extends to three years imprisonment, or a fine up to five lakh rupees, or both. It does not matter that the account was free, or that no money was taken from you directly. Access without permission is the offence.

Section 66C is narrower and often more useful. It covers the fraudulent or dishonest use of the electronic signature, password or any other unique identification feature of another person. A takeover almost always involves the password, and where the attacker also changed the recovery email or the linked phone number, the case under 66C becomes straightforward on the record. Section 66D covers the deception that follows: using the compromised profile to persuade your contacts to send money, to share an OTP, or to click a link.

Where money is actually induced, the BNS adds the cheating offence. Section 318 defines cheating and punishes it, with the aggravated form for dishonestly inducing delivery of property. Section 319 is cheating by personation. For conduct before 1 July 2024, the corresponding IPC sections apply, and charge sheets in older files still cite Sections 419 and 420 IPC. Section 336 of the BNS covers forgery, which becomes relevant when the attacker creates documents, invoices or identity proofs in your name from the hacked account.

There are two provisions that victims rarely think about and that matter in business settings. Section 43A of the IT Act imposes a compensation liability on a body corporate that fails to protect sensitive personal data, and Section 72A punishes the disclosure of personal information in breach of a lawful contract. If the takeover came through a third-party app, a data broker or a careless service provider, those provisions are worth examining. The Digital Personal Data Protection Act, 2023 adds a separate regulatory track for data breaches, but it does not replace the criminal complaint.

Recover the account before anything else

Try the standard recovery flow. On the login screen, choose that you cannot access the account and follow the identity verification route. If the attacker changed the email or phone number, use the option to report a hacked account and provide the original email, the old password and the date you last had access. Meta weighs the age of the account and the consistency of your details heavily, so answer from memory rather than guessing.
Kill the attacker's sessions. Once you are back in, open the security settings and end all active sessions on devices you do not recognise. Change the password to something long and unique, and change it from a device that the attacker has never used.
Reclaim the recovery routes. Remove any email address or phone number you do not own from the account, then add two-factor authentication with an authenticator app rather than SMS, because SIM swapping and OTP interception are the usual entry points. Save the recovery codes offline.
Check what was done while you were out. Review the login history, the posts, the pages you administer, the ad account, the payment methods and the connected apps. Remove unfamiliar apps, because an old connected app with posting rights is a way back in after a password reset.
Warn your contacts the same day. A short post and a message to your closest contacts telling them that the account was compromised and that any request for money is false prevents the second wave of loss. Do this from another channel, not from the compromised account.
Report to Meta formally. Use the hacked account report and, separately, the privacy or grievance route. The Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021 require a grievance officer, acknowledgement within twenty-four hours and disposal within fifteen days, and the ticket number is evidence that you notified the platform on a date certain.

Who you contact	What they can do	What they cannot do
Meta account recovery	Return access, lock the profile, remove an attacker's session	Identify the attacker or recover money
Meta grievance officer	Log the complaint, act on violating content, give a ticket reference	Investigate a crime or share subscriber data with you
cybercrime.gov.in or 1930	Register the complaint nationally, route it to a unit, trigger bank action if money moved	Register an FIR on its own
Police station, s 173 BNSS	Register an FIR, requisition records from Meta and banks, investigate	Act without identifiers and documents
Bank or wallet	Freeze the beneficiary account, raise a dispute, limit your liability	Investigate the takeover

Filing the FIR for a hacked Facebook account

Write the complaint as a chronology, not as an explanation. Start with the date you last had normal access. Then the date you noticed the takeover and how you noticed it. Then what the attacker did: the posts, the messages to your contacts, the changed recovery email, the ad spend, the payment requests. Then what you did about it, with ticket numbers and dates. End with the loss, stated as a figure with the supporting entries, or with the words no financial loss if there was none.

Attach the screenshots of the login history, the unfamiliar device names, the messages sent from your account and the profile as it now stands. Attach the Meta ticket numbers and your own identity proof. If money moved, attach the bank statement page with the debit and the UPI or IMPS reference. Give the complaint to the officer in charge and ask for the FIR number and a certified copy before you leave.

Section 173 of the BNSS, 2023 requires the registration of information that discloses a cognizable offence. A station that says the matter is for Meta to handle has misunderstood the provision: the platform can restore your account, but only the police can investigate who took it. If the station refuses, ask for the refusal in writing and apply to the Magistrate under Section 175(3) of the BNSS for a direction to investigate.

If the account was used to take money from others, the recipients of those messages are also victims and should file their own complaints. Several complaints from different stations about the same account are what turn a single grievance into a case that a cyber unit will pursue, because the pattern is visible only when the files are read together.

What decides whether the case moves

Identification is the first hurdle. Facebook does not display an IP address to a user, so the police must send a requisition to Meta India for the subscriber record, the login IP logs and the device identifiers for the relevant dates. That requisition is routine, but it needs a specific date range and the profile URL. A complaint that gives both gets a response; one that says my account was hacked sometime last month does not.

The second factor is the loss. A takeover with no financial loss is still an offence under Section 66 and 66C, but it competes for attention with cases where money moved. If there is a loss, quantify it and document it. If there is none, say so plainly and point to the non-financial harm: reputational posts, contacts deceived, business pages misused.

The third is the strength of the access trail. A password reset that came from an IP in another country, a login alert email you still have, a two-factor prompt you did not initiate, and an unfamiliar device name in the security settings together make a record that is hard to dispute. Save those notifications before they expire from your inbox.

The fourth is what you did after the takeover. If you posted publicly about the hacker with his photograph and guessed identity, or if you confronted a person you suspected, you may create a defamation exposure and give the defence material to use. Report to the platform and the police and keep your public statements factual.

Finally, jurisdiction matters in practice. An FIR can be given where the offence was committed or where the consequence occurred, and for online offences the place where the victim suffered the loss is ordinarily a valid forum. In Kolkata, cyber crime complaints are commonly routed to the cyber crime police station and tried before the appropriate Magistrate, with bail applications going to the City Sessions Court or the Calcutta High Court.

What not to do after a takeover

Do not pay anyone who offers to recover the account for a fee. Recovery service scams target hacked account owners specifically, and they usually take a payment and then ask for your login credentials. Meta's recovery routes do not charge a fee. Do not send your password, OTP or identity documents to anyone who contacts you claiming to be from Meta, because Meta does not ask for them in a message.

Do not delete the hacked account. Victims sometimes think that removing the profile removes the problem, but deletion destroys the evidence of what was posted and who was contacted, and may not stop a linked page or ad account from running. Archive first, then decide.

Do not delay the bank call if money moved. Under the Reserve Bank of India's 2017 directions on customer protection and unauthorised electronic transactions, your liability depends on how quickly you notify the bank after the unauthorised transaction, and the clock starts when you receive the communication, not when you finish your investigation. A prompt written dispute also forces the bank to give you a reference number and a timeline.

Do not assume that changing the password ends the matter. The attacker may have added an alternate login, granted himself admin rights on a page, or installed an app with persistent access. Check every one of those before you tell people the account is safe.

When to involve a lawyer

Many victims recover an account and stop there, which is reasonable if nothing was posted and nobody lost money. A lawyer becomes necessary when the attacker used the account to defraud your contacts and you are being blamed for it, when the police decline to register an FIR, when your business page or ad account was used and the loss is substantial, when you are the person accused of the hacking and need to answer a notice under Section 35 of the BNSS, 2023, or when the platform has not acted within the fifteen-day period and you want a documented escalation. A cyber crime lawyer in Kolkata can convert the chronology into a charge-ready complaint and pursue the requisitions that produce the login records. If the matter has already reached a charge sheet and you are weighing custody, the note on bail in cyber crime cases sets out the tests a court applies.

Need help with a cyber crime matter?

Tell me what happened and I will tell you what to file, where, and by when. First conversation is free.

Call +91-9007000603 WhatsApp

Frequently asked questions

Is it a crime if someone hacked my Facebook account in India?

Yes. Unauthorised access to a computer resource is punishable under Section 66 of the IT Act, 2000, using your password is identity theft under Section 66C, and using the profile to deceive people is cheating by personation under Section 66D. Where money is induced, Section 318 of the BNS, 2023 is added.

How do I recover a hacked Facebook account?

Use the login help flow and choose the hacked account option, providing your original email, the last password you remember and the date you last had access. Once inside, end all unknown sessions, change the password, remove unfamiliar recovery contacts and turn on authenticator-based two-factor authentication.

What evidence should I save after my Facebook account is hacked?

Save the login alert emails, the security settings page showing unfamiliar devices and locations, screenshots of posts and messages sent from your account, the Meta ticket numbers, and any payment references. Keep the original device, because Section 63 of the Bharatiya Sakshya Adhiniyam, 2023 requires the electronic record with a certificate.

Can police get the hacker's IP address from Facebook?

Yes, through a requisition to Meta India for subscriber details, login IP logs and device identifiers for a specified date range. The police cannot obtain it from you, and you cannot obtain it yourself. That is why the FIR must state the exact dates and the profile URL, so the requisition is specific enough to be answered.

Should I file an FIR or only report to Facebook?

Both. The platform report gets the account restored or locked, but it does not identify or punish anyone. An FIR under Section 173 of the BNSS, 2023 is what allows the police to requisition records from Meta and the banks, and it is the only route to a prosecution.

What if money was taken from my friends through my hacked account?

Those friends are separate victims and should each file a complaint, because their loss is the offence. Report the transactions to your bank and to 1930 immediately so that the beneficiary accounts can be flagged. Your own complaint should list each person who paid, with the amount and the reference number.

Can I be held liable for what the hacker posted from my account?

Ordinarily not, if you can show the account was accessed without your authorisation and that you reported it promptly. That is why the login alerts, the Meta ticket and the FIR matter: together they establish the date you lost control and the steps you took. Delay is what creates the argument that you knew or acquiesced.

How long does a Facebook hacking case take in India?

There is no statutory deadline. The platform grievance is expected to be resolved within fifteen days under the 2021 Intermediary Rules, while the police investigation and trial run on the ordinary criminal timeline of months to years. Most of the delay sits in waiting for records from the platform and the banks.

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Cyber crime lawyer in your city · Bank account freeze help · Contact