Think an account is compromised? First steps, and where to go next (India)
Last updated: 2026-07-11
Don't panic. From a different, trusted device, secure your email first — it is the master key that can reset almost every other account — then change the password, turn on two-factor, and sign out other sessions. Report at cybercrime.gov.in, then follow the guide for the exact account you're worried about (the route table is below).
Acting from a device you trust matters: if the compromise reached the phone or computer you normally use, doing recovery from that same device can hand the attacker your new password too. Use a different one you are sure is clean.
The universal first moves — for any account
These apply whatever the account is. Do them from a different, trusted device, in this order.
- Secure your email first. Your email can reset the password on your bank, UPI, social, and shopping accounts, so it is the master key — lock it down before anything else. The ordered steps are here: your email is compromised: what to do first, in the right order.
- Change the password on the affected account to a new, unique one.
- Turn on two-factor authentication so a password alone can no longer let anyone in.
- Sign out all other sessions and devices so anyone still logged in on another device is kicked out.
- Watch for the attacker's way back. Check for and undo anything they set up to return: a changed recovery email or phone, mail forwarding rules, or connected apps you did not authorise. A password change alone does not remove these.
- Report it. File a complaint at cybercrime.gov.in; if any money moved, also call 1930, the national cyber-crime helpline, and note the reference and acknowledgement numbers.
Which account was it? Go here
Once the universal moves above are done, follow the guide that matches your situation for the account-specific steps.
| What happened / which account | Where to go |
|---|---|
| Your email itself is compromised | Your email is compromised: what to do first, in the right order |
| WhatsApp — someone else is using your account | Hacked WhatsApp: how to recover your account |
| Instagram or Facebook is hacked | Hacked Instagram or Facebook: recover and lock it down |
| Your phone suddenly lost signal / calls and SMS stopped | SIM swap fraud: signs and what to do — your SIM may have been swapped |
| Your number was on someone else's SIM — now re-secure your accounts | How to secure your accounts after a SIM swap |
| Money has left your bank or UPI account | UPI fraud — what to do in the first hour |
Beware a second scam: never pay a "recovery agent", "ethical hacker", or "hacker-for-hire" who promises to get your account back for a fee — that is a fresh fraud. The only real routes are each provider's own account-recovery flow and, to report, cybercrime.gov.in and 1930. Do anything involving passwords from a different, trusted device if you think the attacker still had access to yours.
If you can't get back in
Keep every complaint acknowledgement number. Recovery is possible but not guaranteed; acting quickly gives the best chance. If a provider's recovery flow does not restore control, keep trying it, and use the National Consumer Helpline (1915) for guidance. All official channels are linked below so you can act directly.
Was this helpful? (anonymous — no sign-up, nothing stored about you)