Cybercrime Law Guide | Kolkata
Instagram or Facebook Account Hacked in Kolkata: Legal Response
A social-media account takeover can expose private messages, enable impersonation, trigger fraud against contacts, and destroy useful evidence. The immediate response should secure the connected email and phone, preserve the takeover trail, use the platform’s official recovery channel, and report any criminal conduct or financial loss through the appropriate route.
Legal information notice: This guide provides general information, not advice for a specific incident. Platform processes change, and the appropriate police, portal, bank, or legal response depends on the evidence and harm. Call 112 for immediate physical danger.
Distinguish account takeover from impersonation
An account takeover means someone has obtained control of the real account or changed its credentials. Impersonation may involve a separate fake profile using another person’s name, image, or business identity. Both can occur together, but the evidence and platform reports differ. Record the original username, current username, profile URL, linked email or phone, and every visible change.
Secure connected access first
- Use a trusted device and secure the email account and phone number linked to the social account.
- Change reused passwords and review active sessions, recovery addresses, forwarding rules, and two-factor settings.
- Save login alerts, password-change notices, security emails, and messages showing when control was lost.
- Use only official Instagram or Facebook recovery pages and in-app support routes.
- Warn affected contacts through a separate trusted channel if the account is sending requests or payment instructions.
Avoid repeated password resets from a device that may still be compromised. Do not pay anyone who claims they can recover the account through an unofficial insider, verification payment, or secret code.
Preserve a complete evidence package
- Full profile URLs, usernames, page or account identifiers, and linked contact details
- Login alerts, recovery emails, changed-email notices, and platform ticket numbers
- Screenshots showing the full screen, date, time, sender, URL, and surrounding context
- Messages sent by the compromised account, payment requests, advertisements, or impersonation posts
- Reports from contacts who received fraudulent messages, with originals where available
- Device type, SIM changes, suspicious applications, and the time each security step was taken
- Bank or payment records if any person transferred money because of the compromised account
Keep original emails and files where possible. Do not crop away identifiers, edit the apparent conversation, delete the account before preserving the relevant trail, or circulate intimate or harmful material merely to prove it exists.
Use official platform recovery and reporting
Instagram directs compromised-account users to its official hacked-account recovery flow. Facebook provides its own hacked-account route. Follow the current prompts shown by the platform because identity and recovery checks can differ by account and may change over time. Record each submission, reference, and response.
If a separate fake profile is involved, report that profile through the platform’s impersonation or abuse tools as well as pursuing recovery of the genuine account.
Report criminal conduct and financial loss appropriately
The National Cyber Crime Reporting Portal accepts complaints concerning online and social-media crimes, including hacking. State what happened in ordinary factual language and attach the identifiers, chronology, and supporting records. Do not guess the offender’s identity or rely on a list of unverified legal sections.
If the takeover caused a recent financial cyber fraud, immediately contact the bank or payment provider and use the official financial-fraud reporting route, including 1930 where applicable. The 1930 route is for financial cyber fraud; an account takeover without a financial transaction should still be reported through the appropriate platform and cybercrime or police channel based on the facts.
For complaint structure and evidence organisation, use the cybercrime complaint preparation guide.
Handle threats, intimate material, or business harm carefully
If the compromised account is used for threats, stalking, extortion, intimate material, child-safety concerns, or fraudulent business communications, preserve the content without forwarding it unnecessarily and seek prompt case-specific assistance. A business should also preserve customer warnings, advertisement changes, page-role changes, invoices, and proof of ownership or administration.
Official reporting and legal references
Official-source review completed 4 September 2026.
Request an account-takeover evidence review
Share the profile URL, security alerts, platform ticket, incident chronology, and any message or payment evidence through a safe channel.
