Home / Rescue / Account Hacked

Account Hacked or Cloned — Recovery Protocol

If your WhatsApp, Instagram, Gmail, Facebook, or Telegram account has been hacked or cloned, this protocol gives you step-by-step recovery actions and a ready FIR draft for cybercrime.gov.in.

← Back to Home

🔓

Account Hacked
or Cloned?

Step-by-step recovery for hacking & impersonation victims in India.
Free · No data uploaded · Works offline.

🔒Runs on
your device only

📋Govt.
FIR format

⚡Under
5 minutes

No account · No signup · ₹0 · Works offline

🚨 MONEY MAY STILL BE MOVING — DO THIS FIRST

Call 1930 — National Cyber Crime HelplineKeep ready: bank account number, scammer UPI ID, transaction amount and time. Do not hang up.

Block card / UPI in your bank app right now💡 No app access? Enter the wrong UPI PIN 3 times deliberately — this locks UPI transactions immediately.

Screenshot every transaction SMS before clearing anythingPrimary evidence for your bank dispute and FIR. Do not delete notifications.

📞 Tap to Call 1930 Now📞 Dial 1930 on Your Phone

IF 1930 IS BUSY OR NOT CONNECTING:

• Call your bank's 24x7 helpline (number on back of card) — say "block my account, fraud in progress."

• Enter wrong UPI PIN 3 times on GPay / PhonePe / Paytm to lock UPI immediately.

• File at cybercrime.gov.in — a timestamped online complaint carries the same legal weight as 1930 for RBI dispute purposes.

• 1930 is least busy between 6–8am and 10pm–midnight. Keep redialling while doing the steps above.

• If the bank app is crashing or not loading: try the bank's mobile website (not the app), or net banking on a laptop. Wrong UPI PIN 3 times also works without the app.

• If branch is open, walk in and say "1930 is busy — I need to report an unauthorised UPI transaction." They can initiate a freeze internally.

⚠️ STOP USING THAT DEVICE FOR RECOVERY

If AnyDesk or a similar app is running, the attacker can see every key you press — including new passwords. Switch to a clean device before doing anything else.

Turn off Wi-Fi AND mobile data on the compromised deviceSwitch to Airplane Mode to cut the attacker's connection immediately.

Switch to a different clean phone or computer for all recovery stepsA family member's phone, office computer — anything not touched by the attacker.

Do NOT change any password from the compromised deviceA keylogger or screen recorder may be running — your new password goes straight to the attacker.

IF YOU DO NOT HAVE ANOTHER DEVICE:

• Borrow a family member's or neighbour's phone — all recovery steps work from a mobile browser. Log out completely when done.

• Visit a cyber café — use private/incognito mode, never save passwords, log out and clear history before leaving.

• Use any phone just for calls — call 1930, call your bank, call your telecom operator. These require no device.

• Visit your bank branch in person — say "my phone was compromised and money was taken." They can block, freeze and escalate without you needing a device.

📡 SIM MAY BE SWAPPED — USE ANOTHER PHONE

SIM swapping means a criminal convinced your mobile operator to transfer your phone number to a new SIM card they control. All OTPs meant for you now go to the attacker. Your phone shows "No Service" or "SOS Only." This is not a network problem — it is a crime. Use a family member's phone for everything below.

Call your telecom operator from a different phoneJio: 198 · Airtel: 121 · Vi: 199 · BSNL: 1800-180-1503

Request immediate SIM block and duplicate SIM issuanceSay "SIM swap fraud" — this is a flagged category under DoT guidelines and they must assist.

Do NOT use OTP-based password resets until your SIM is backAny OTP you request right now will go to the attacker, giving them access to even more accounts.

Go to nearest telecom store with your Aadhaar cardRequest duplicate SIM. You can use your Aadhaar number and biometric — physical card not required.

⚠️ After SIM restored: dial *#21# to check call forwarding. If active, dial ##21# to disable immediately. The call-merge trick uses forwarding to steal OTPs.

IF TELECOM HELPLINE IS ALSO BUSY:

• Visit the nearest telecom store physically — they handle SIM swap fraud on the spot.

• Call your bank from the family member's phone: "My SIM was swapped — please block all OTP and online transactions until I notify you."

SECURE

SECURE · LOCAL · ZERO UPLOADS

🔓

Your Account
CAN Be Recovered

⚠️ THIS IS NOT YOUR FAULT

These are professional criminal networks — often operating from overseas scam centres. They target thousands of smart, educated Indians every day.

Sharm ki wajah se delay mat kijiye. First we stop the damage. Then we get it back. Everything runs on this device only — nothing is uploaded.

Hacking vs Cloning — the fastest way to tell: HACKED — you are the victim You cannot log in · Password stopped working · Money was taken · You got OTPs you never asked for · Your contacts got messages from your account that you never sent CLONED — your contacts are the victims Your own account works fine · Someone made a SECOND account with your name and photo · That fake account is messaging your friends asking for money

🔒 Local Only• ⚡ Under 5 min• 🧾 No Uploads• ₹0 Always Free

FIRST — MOST IMPORTANT

What best describes what happened to you?

Your entire rescue plan depends on this. Refer to the explanation on the previous screen if unsure.

QUICK TRIAGE

3 quick questions — tap one answer each

These tell us which path to open for you.

1. CAN YOU LOG INTO YOUR OWN ACCOUNT RIGHT NOW?

2. DID YOU RECEIVE OTPs OR LOGIN ALERTS YOU NEVER REQUESTED?

3. ARE YOUR CONTACTS SAYING A SECOND ACCOUNT EXISTS IN YOUR NAME?

Please answer all 3 questions above.

STEP 1 — PLATFORM

Which account was hacked?

Recovery steps are completely different for each platform. Choose the one that matters most right now.

🏦 Selecting Bank / UPI? Bank fraud is the most urgent of all. Money can only be frozen within a short window — we act on this before anything else and skip straight to the emergency steps.

STEP 2 — ACCESS

Can you still log into your account?

Select what best describes your current situation.

STEP 3 — RECOVERY

Do you still control the recovery option?

This tells us which recovery path is available to you.

⚠️ IMPORTANT — READ BEFORE CONTINUING If the attacker set a new 2-Step Verification PIN on your WhatsApp, you CANNOT bypass it for up to 7 days. This is WhatsApp's own security rule — it applies equally to you and the attacker.

What this means: Stop trying to re-register WhatsApp right now. You will not succeed for 7 days. Trying repeatedly may reset the clock in some versions.

Use these 7 days to: Warn contacts by SMS or call · Secure your bank accounts · Secure your other social accounts · Email support@whatsapp.com now (your plan includes a 1-tap email button).

Quick check — takes 30 seconds: Open your account app or website → go to Settings → look for Recovery Email or Linked Phone Number. Is it still the one you set up?

STEP 2 OF 5

When did the unauthorised transaction happen?

This is the single most important factor for fund recovery. The sooner you reported, the better the chance of freezing the funds.

STEP 3 OF 5

Transaction details

Approximate is fine. The 1930 helpline needs the UPI ID or account number — keep it ready. Skip anything you don't have.

AMOUNT TAKEN (₹)

₹

UPI ID / ACCOUNT MONEY WENT TO

YOUR BANK / UPI APP

STEP 4 — OTHER DAMAGE

Has anything else happened alongside the hack?

Sometimes one attack causes multiple problems. Select everything that applies — your plan will cover each one.

Please select at least one option.

STEP 5 — CONTACTS

Is the attacker targeting your contacts?

Select all that apply.

STEP 6 OF 6 — LAST STEP

How did it happen?

Select the closest match. This shapes the language in your FIR and the recovery steps. Do NOT contact the attacker to get more details.

OPTIONAL — SCAMMER DETAILS (skip if you don't have these)

PHONE NUMBER / UPI ID OF SCAMMER

WEBSITE OR LINK YOU CLICKED

Analysing your situation…

Building your personalised recovery plan

STEP 1 — PLATFORM

📍 You are on the CLONING path Cloning does NOT mean your account was hacked. Your password is fine. Someone simply copied your name and profile photo and made a second fake account next to yours. Changing your password will not stop this. Reporting the fake and warning your contacts is what works.

Which platform has the fake account?

The reporting steps are different for each platform.

STEP 2 — TIMING

When did you discover the fake account?

Timing matters — platforms remove fake accounts within 24–72 hours of reporting and all evidence disappears with them. The sooner you act, the more you can save.

STEP 3 — HOW FOUND

How did you find out about the fake account?

This helps us understand how far the clone has spread.

🔍 Cannot find the fake account? Scammers often block the real person immediately after creating the clone. Ask 3–4 different contacts to search your name from their devices — or check any message they received "from you" which will contain a link back to the fake profile.

STEP 4 — FAKE ACTIVITY

What is the fake account doing?

Select all that apply.

STEP 5 — MONEY LOST

Has anyone already sent money to the fake account?

If yes, your plan will include urgent steps for that person as well. They are a separate fraud victim and 1930 applies to them directly.

💬 If a contact already paid — reassure them: Many contacts feel ashamed and do not tell you. This is not their fault. The scammer built a convincing fake version of you — it was designed to deceive people who trust you. They must call 1930 immediately and NOT send more money to "recover" the first payment.

STEP 6 — YOUR REAL ACCOUNT

Is your own real account still working normally?

Cloning sometimes happens alongside or after a real account breach. This check makes sure we catch both if they happened together.

STEP 7 — EVIDENCE

Do you have the fake account URL or link?

The URL speeds up platform review and is required for the FIR. Even a screenshot of the profile URL is sufficient.

PASTE FAKE ACCOUNT URL

🔍 How to find the fake profile URL: Ask a contact who received a request or message to open that conversation and tap on the profile name — the URL appears in the address bar. Ask them to copy and send it to you via SMS.

Analysing your situation…

Building your personalised recovery plan

YOUR RECOVERY PLAN

🏆

Recovery Plan Complete

You have worked through every step. Keep your incident pack safe — you may need it for follow-up complaints or bank disputes.

YOUR RECOVERY PLAN

🏆

Recovery Plan Complete

You have worked through every step. Keep your incident pack safe for follow-up complaints.