Re-register WhatsApp on your own phone with your number to log the intruder out, then turn on two-step verification and remove unknown linked devices. Warn contacts at once that money requests are fake. For Instagram, Facebook and Gmail, use the platform's official hacked-account recovery page, and report any money loss or misuse on cybercrime.gov.in or 1930.
Key takeaways
- Never share the 6-digit WhatsApp code or any login code, even with a friend asking for it.
- Re-registering WhatsApp on your number logs the hacker out of that account.
- Use only official recovery pages; 'recovery experts' on social media are usually scammers.
- Secure your email first, because it controls password resets for everything else.
- Unauthorised access is an offence under IT Act s.43 and s.66; misuse of your identity under s.66C/66D.
How do you know if someone has hacked your WhatsApp?
Most WhatsApp "hacks" in India are not technical hacks at all. Someone tricks you into sharing the 6-digit registration code, often posing as a friend who "sent it by mistake", or links your account to WhatsApp Web on a device you left unlocked. Warning signs:
- WhatsApp suddenly says your number is registered on another phone and logs you out.
- Linked devices (in Settings) shows a computer or browser you do not recognise.
- Contacts receive messages you did not send, often asking for urgent money or a code.
- Chats are read, archived or deleted without you doing it.
- You received a WhatsApp registration code SMS you did not request.
If you think the phone itself has spyware or is being tracked, that is a different problem; use our guide on checking whether your phone is hacked or tracked.
WhatsApp account hacked: what to do in India
- Re-register WhatsApp on your phone using your own number. Enter the SMS code you receive. This logs out whoever is using your account on another phone.
- If WhatsApp asks for a two-step verification PIN you never set, the hacker has set one. You will normally have to wait for the period WhatsApp specifies before you can register without it. Keep trying to re-register so the hacker cannot keep control, and do not pay anyone who promises to bypass it.
- Check Linked devices and log out of everything you do not recognise.
- Turn on two-step verification with your own PIN and add an email address for recovery.
- Write to WhatsApp support from within the app or by email, saying the account was stolen, if you cannot regain access.
- Warn contacts through another account, a status, SMS or calls: "My WhatsApp was hacked. Do not send money or codes."
If you also lost mobile signal at the same time, the number itself may have been hijacked through a duplicate SIM. Read our guide on SIM swap fraud before anything else.
How to recover a hacked Instagram, Facebook or Gmail account
| Platform | Official recovery route | After you are back in |
|---|---|---|
| On the login screen, use the option for help logging in or a hacked account; Instagram may send a link to your email or phone or ask for a selfie video to confirm identity | Change password, remove unknown email or phone, turn on two-factor authentication, review login activity | |
| facebook.com/hacked, or the "Find your account" option on the login page | Check Security and login, remove unknown devices and apps, review recent posts and Marketplace | |
| Gmail / Google | Google Account Recovery (accounts.google.com/signin/recovery), answering questions from a device you have used before | Run Security Checkup, remove unknown recovery details, forwarding rules and connected apps |
| Re-register on your own phone with your number | Two-step verification, check linked devices |
Start with your email. Whoever controls your email can reset your other accounts. In Gmail, check Settings for forwarding and filter rules the hacker may have added to hide alerts.
Beware of "account recovery experts" who contact you after you post that you were hacked. Platforms do not work through freelance agents. These offers are themselves a common fraud.
How do you limit damage while the account is compromised?
- Money requests: Hacked accounts are used to ask your contacts for urgent UPI transfers. Tell people to call you on your number before paying. If anyone has already paid, they should call 1930 at once; see what to do after UPI fraud.
- Business pages: If a business Instagram or Facebook page is taken over, inform customers on other channels and use the platform's business support.
- Intimate or private content: If the hacker threatens to share private photos or chats, do not pay. Follow our guide on sextortion and blackmail.
- Linked logins: Change passwords on any site where you used the same password, starting with banking and email.
When should you file a cyber complaint for a hacked account?
You do not have to go to the police for every lost account. File a complaint when:
- Money was lost by you or by your contacts.
- The hacker is impersonating you to cheat others, posting defamatory or obscene content, or blackmailing you.
- You suspect someone you know, such as an ex-partner, has accessed your account; this can be part of a pattern of cyber stalking and online harassment.
- You cannot recover the account through the platform and it is being actively misused.
Report on cybercrime.gov.in or at your police station's cyber cell. Unauthorised access to a computer resource is covered by IT Act s.43 and s.66, identity theft by s.66C and cheating by personation by s.66D. If money was taken, cheating under BNS s.318 is added. The general portal process is explained in our guide to reporting cyber fraud.
How to prove your Facebook or Instagram was hacked
If the hacker posted something in your name, you may need to show it was not you. Collect:
- Security emails from the platform about password, email or phone changes, with their timestamps.
- Screenshots of the login activity or "where you're logged in" page showing unknown devices or locations.
- Screenshots of posts or messages sent by the hacker, with the date.
- Your timely complaint to the platform and the cyber complaint acknowledgement.
- Messages from friends who flagged the unusual activity.
Publicly posting that your account was hacked, with the date, also helps show you disowned the content quickly.
How to stop it happening again
- Turn on two-step or two-factor authentication everywhere, preferably with an authenticator app rather than SMS.
- Use a different, long password for email and for each social account; a password manager helps.
- Never share a login code, WhatsApp code or "verification" link, whoever asks.
- Lock your phone and log out of WhatsApp Web and social media on shared or office computers.
- Check linked devices and login activity once a month.
If you believe a specific person keeps getting into your accounts and you need lawful help to document it for the police or a court, a verified investigator through Hire Your Detective can help organise the evidence. No legitimate investigator will hack an account, even to "get it back" for you.
Bottom line
Act within minutes: re-register WhatsApp, secure your email, use the official recovery pages for Instagram, Facebook and Google, and warn contacts not to send money. File a cyber complaint when money, impersonation or blackmail is involved. Then switch on two-step verification so it does not happen again.
Sources & official links
This guide is general information, not legal advice. Laws and procedures change, and every case is different — speak to a lawyer about your situation. In an emergency, call 112.