Instagram or WhatsApp hacked, even with the email and phone changed? How to get it back
Reviewed by the VirtualVakil legal team · Last reviewed:
For WhatsApp, reinstall the app and register again with your own number: entering the six-digit SMS code logs the other device out, and you should then turn on two-step verification. For Instagram, go to instagram.com/hacked from any browser, which lets you recover the account through your email, phone number or identity checks. Warn your contacts at once, because hackers use the account to ask friends for money or OTPs, and report on cybercrime.gov.in if money or threats are involved.
Right now
- Tell your contacts through another account or phone: 'My account is hacked. Do not send money or codes to it.'
- WhatsApp: reinstall and register with your number. Never share the six-digit code with anyone, including friends who ask for it.
- If someone asked you to dial a code starting with *401* or similar, your calls may be forwarded to the hacker. Dial ##002# to cancel all call forwarding, then ask your mobile operator to confirm.
- Instagram: open instagram.com/hacked in a browser and follow the steps.
How to recover the account, step by step
Re-register WhatsApp with your number
Reinstall WhatsApp, enter your number and the SMS code. The hacker's session ends when you register. If the hacker has set a two-step verification PIN, WhatsApp may make you wait before you can register without it; keep the app installed and write to WhatsApp support from the app or the Help Centre.
Lock WhatsApp down
Turn on two-step verification (Settings, Account, Two-step verification), add an email address, and check Linked devices to log out anything you do not recognise.
Recover Instagram
Use instagram.com/hacked. If your email address was changed, look in your inbox for the email from Instagram about the change; it usually contains a link to reverse it and secure the account. Instagram may ask for a video selfie to confirm it is you.
Secure the email and phone behind the account
Change the password of the email linked to the account from a clean device, turn on two-factor authentication, and check your phone for unknown apps if the hack happened without you sharing a code.
Report misuse
If the hacker asked anyone for money, shared private content or threatened you, report on cybercrime.gov.in or 1930 with screenshots, and report the account inside the app as hacked or impersonating you.
How accounts usually get taken over
- A message from a friend's hacked account asking you to forward a code 'sent by mistake'. That code is your WhatsApp registration code.
- A caller asking you to dial a code such as *401*, which forwards your calls so the hacker receives WhatsApp's voice verification call.
- A fake login page, 'copyright notice' or 'verified badge' message for Instagram that collects your password.
- An APK file sent on WhatsApp (a wedding card, challan, bank KYC or electricity bill) that gives the sender control of your phone.
Which sections usually apply
| Section | What it covers |
|---|---|
| IT Act S. 66C | Identity theft: fraudulently using another person's password or unique identification feature. |
| IT Act S. 66D | Cheating by personation using a computer resource, for example asking your contacts for money as you. |
| IT Act S. 43 and S. 66 | Unauthorised access to a computer resource; an offence under S. 66 when done dishonestly or fraudulently. |
| BNS S. 319 | Cheating by personation. |
The police decide which sections go into the FIR after looking at your facts. This list is a guide, not a charge sheet.
Three ways we can help
Free guidance on WhatsApp
Tell us what happened. We tell you what to do next and which law applies. Starting is free.
We file your complaint: ₹999
We draft your cybercrime.gov.in complaint, bank dispute letter, police follow-up and ombudsman escalation, and follow up with you on WhatsApp.
Cyber Surety membership
A membership, not insurance: ethical hackers and lawyers on WhatsApp 24×7 for the next incident. Cyber-loss cover included, up to plan limits. T&C apply.
Prefer to file it yourself? Reporting on 1930 and cybercrime.gov.in is free. The step-by-step portal guide is on codesnag.ai: how to file a cyber crime complaint. All our cyber questions are on the cyber help page.
What people ask
Can the police recover my WhatsApp or Instagram account?
Someone is asking my friends for money from my account. What do I do?
WhatsApp asks for a two-step PIN I never set. Why?
How do I stop it happening again?
Do I need a lawyer to recover a hacked account?
Where these rules come from
- WhatsApp Help Centre: stolen or hacked accounts, two-step verification
- Instagram: recover a hacked account (instagram.com/hacked)
- National Cyber Crime Reporting Portal (cybercrime.gov.in), Ministry of Home Affairs
- Information Technology Act, 2000 (India Code)
- Bharatiya Nyaya Sanhita, 2023 (India Code)
Last reviewed: 19 Oct 2026. This page gives legal information, not legal advice for your specific case. Rules and portals change; if anything here differs from the official source, the official source prevails. VirtualVakil is not a government portal.