Hacked account (Instagram, Gmail, WhatsApp): filing a complaint and taking back control

An email from Meta tells you that the address linked to your account has been changed. You asked for nothing. Ten minutes later your followers receive a private message offering an investment, signed with your name, and your password no longer works. The scene plays out every day, on Instagram, on Gmail, on WhatsApp, and the reaction in the first hours decides almost everything: what you recover, what you will be able to prove, and whether the person behind it will ever be identified.

A hacked account is dealt with in two stages that do not exclude each other: taking back control, then having the hacker prosecuted. The first depends on the platform and on your speed. The second depends on a precise complaint, filed while the traces still exist.

The first hours: taking back control without erasing the traces

The instinct is to change everything at once. It is the right instinct, with one reservation: before each correction, take a screenshot of what you are correcting. A hacker leaves traces in the account settings, and those traces are the substance of the complaint.

Instagram. Recovery goes through the platform, and through it alone. If the email address on the account has been changed, the message Instagram sent to inform you contains a link to reverse that change. If you can no longer log in at all, Instagram’s help page for hacked accounts offers a login link sent to the original address or phone number and, failing that, an identity check. These procedures take anywhere from a few hours to several days. Neither the police nor a judge can order Meta to give you your account back any faster.

Gmail. Google’s account recovery page lets you regain control by answering verification questions. Once back in, four settings must be checked, and photographed before being changed: automatic forwarding of messages to another address, filters that sort or delete incoming mail, the list of connected devices, and the list of third-party apps with access to the account. Google’s own advice is to remove any labels, filters and forwarding rules you did not set up yourself. A discreet forwarding rule is the most common way of continuing to read your mail after you have changed the password.

WhatsApp. The account is tied to the phone number. In principle it is enough to reinstall the app and register again with your number: the code received by SMS logs the hacker out. Two traps. If the hacker has switched on two-step verification with a PIN you do not know, WhatsApp imposes a waiting period before the number can be re-registered without it; that period is in the region of a week. And a WhatsApp takeover almost always begins with a message from a contact who has already been hacked, asking you to “send back a code received by mistake”: that code is the one that registers your number on their phone. Never pass on a code received by SMS, whoever asks for it.

In all three cases, next: a new password, different from all the others; two-factor authentication switched on; every open session logged out; recovery details that the hacker replaced with their own put back. Then change the password on every service where you used the same one.

Warn your contacts, through a channel other than the hacked account: they are the hacker’s next target. If banking details were readable inside the account (statements, invoices, photographs of cards), tell your bank without waiting for the complaint.

What to keep before you clean up

A hacking complaint without evidence gets closed. A complaint with an orderly file gets investigated. That file is built in the hours that follow, and part of it disappears if you clean up too quickly.

• The platform’s notifications: emails or text messages announcing a new login, a change of address, number or password. They often carry the time, the type of device and an approximate location. Keep them as they are, without forwarding them: forwarding strips the technical headers.
• Screenshots of every abnormal setting: an unknown recovery address, an automatic forward, an unrecognised device, a post or message you did not write. Date them.
• The login history that the platform makes available to the user. Meta and Google both let you download a copy of your data, which includes the log of logins and security changes. Request it as soon as you are back in control: it is the document the investigators will ask for anyway, and you bring it to them ready.
• The messages the hacker sent to your contacts, obtained from those who received them, with date and time. If they paid money, the references of the transfer or payment.
• The phishing message that preceded the hack, if you can identify it: an email, a text, a private message containing a link or a request for a code.

For posts made in your name and visible to third parties, a report drawn up by a commissaire de justice (the French judicial officer, formerly huissier) fixes the evidence before the content is taken down. It is not essential for a complaint, but it is decisive if you later seek compensation for damage to your reputation.

What the hacker has committed: the offences under French law

Hacking an account is not a technical mishap; it is a series of criminal offences, and the complaint should name them all.

Fraudulent access to, and remaining in, an automated data processing system (Article 323-1 of the French Criminal Code) is the basic offence: three years’ imprisonment and a fine of €100,000. The penalty rises to five years and €150,000 where the access resulted in the deletion or modification of data, which is the case as soon as the hacker changed the password, the recovery address or the phone number. That aggravating circumstance is assessed objectively: it is enough that the modification is established, without having to show that the hacker was seeking it. Nor is it necessary for the hacker to have forced anything: whoever enters with a password obtained by deception, or stays inside an account knowing they have no right to be there, commits the offence. The Court of Cassation so held in the case of a network administrator who legitimately possessed the access tool and used it to read his business partner’s private mailbox: the offence is committed by “the person who, knowing that they are not authorised to do so, remains in an automated data processing system”¹. It confirmed the point in 2025 for an administrator who, holding general access rights to the company’s mail system, had read the messages exchanged for purposes unrelated to his duties and without the knowledge of their owners². The right to access a system never covers the use made of it.

Breach of the secrecy of correspondence (Article 226-15) covers intercepting, diverting or using electronic correspondence: one year’s imprisonment and a €45,000 fine. It applies to reading your private messages, setting up an automatic forward of your mail, and producing your exchanges to a third party.

Identity theft (Article 226-4-1) punishes with one year’s imprisonment and a €15,000 fine the use of data identifying a person with a view to disturbing their peace or damaging their honour. The penalties are doubled where the offender is the victim’s spouse, cohabitant or civil partner. The text requires a specific intent: to have acted in order to disturb the peace of the victim “or of others”, or to damage their honour. Messages, posts or stories published in your name from the hacked account usually establish it, whether they target your reputation or serve to solicit your contacts, whose peace is precisely that “of others”. The Court of Cassation has held that it is immaterial whether the impersonator is personally the author of the messages published: what is punished is having made their publication under someone else’s identity possible³. For the phishing that preceded the hack, courts tend to rely on fraudulent access and fraud rather than identity theft; the complaint should cite all three⁴.

Collecting personal data by fraudulent means (Article 226-18) punishes with five years’ imprisonment and a €300,000 fine the harvesting, through the hack, of your data and that of your contacts.

Depending on what the hacker did with the account, further offences apply: fraud (escroquerie, Article 313-1, five years and €375,000) where contacts paid money believing they were sending it to you; blackmail (chantage, Article 312-10) where the hacker threatens to publish photographs or conversations unless paid; the non-consensual distribution of sexual images (Article 226-2-1) where intimate content has been published.

The list is not a flourish. Each offence opens up investigative powers, sets a limitation period and grounds a separate claim for compensation. A complaint that speaks only of “hacking” leaves the investigators to choose, and they often choose the simplest.

Where and how to file a complaint

A complaint is filed at a police station, at a gendarmerie or by letter to the public prosecutor; none of them may refuse it, and it may be directed against an unknown offender.

The police station or the gendarmerie. Judicial police officers and agents “are required to receive complaints lodged by victims of criminal offences”, including where the station has no territorial jurisdiction (Article 15-3 of the French Code of Criminal Procedure). A refusal to take the complaint on the ground that “it’s on the internet, nothing can be done” is contrary to the law: ask for the receipt, which the text requires to be issued immediately, and failing that go through the prosecutor.

A letter to the public prosecutor. A complaint may also be sent in writing to the procureur de la République at the judicial court (tribunal judiciaire) for your place of residence, by registered post with acknowledgement of receipt. This is the route we recommend as soon as the file contains several documents or several offences: the complaint is read by a magistrate, with its attachments, rather than summarised in a few lines of police report. It should contain the exact identifier of the account (username, page address, email address, phone number), an hour-by-hour chronology, the screenshots, the list of contacts approached and, where relevant, the sums paid. You do not need to be resident in France to file one: French criminal law applies as soon as one of the constituent elements of the offence took place in France (Article 113-2 of the Criminal Code), for instance because the hacker acted from France or the account and its owner are there.

Online complaint through THESEE. The Ministry of the Interior allows adult individuals to file a complaint online for certain offences committed on the internet, including the hacking of messaging accounts. The service is designed for scams: it asks for an IBAN and is aimed first at cases where the hacker demanded money, from you or from your contacts. For a hack without a demand for money, eligibility is not guaranteed and the ordinary complaint remains the safe route.

17Cyber and cybermalveillance.gouv.fr give guidance; they do not receive complaints.

The time limit. Offences of this kind (délits) are time-barred six years after the day they were committed (Article 8 of the Code of Criminal Procedure). The legal deadline is comfortable; the useful one is not, for the reason explained below.

If nothing happens. Three months after the complaint is filed without a response from the prosecutor, or after a decision not to prosecute, a complaint with an application to join the proceedings as a civil party (plainte avec constitution de partie civile) before an investigating judge remains available (Article 85 of the Code of Criminal Procedure); we explain the mechanism in our article on anonymous accounts.

How the investigation identifies the hacker

An account hacked from the other side of the world looks out of reach. That is often wrong, provided you move fast.

The mechanism is the one we describe in our article on identifying the author of an anonymous account: a requisition to the platform, which supplies the IP addresses used to log in and the contact details the hacker registered to secure control of the account, then a requisition to the operator behind those addresses and, since 18 August 2026, a European Production Order sent directly to a provider established in another EU Member State. What is different for a hacked account is the starting trace: the hacker had to replace the recovery address, the phone number or the password, and each of those changes is time-stamped and tied to a login. The account’s login history, which you have already downloaded, tells the investigators where to look.

All of this rests on data that the law requires to be kept for only a short time. Operators keep the technical data identifying the source of a connection for one year from the connection (Article L. 34-1 of the French Postal and Electronic Communications Code). After that, the IP address recorded by Meta leads nowhere. A complaint filed ten months after the facts is admissible; it is rarely useful.

A hacker who demanded money leaves another trace: the bank account, crypto-asset wallet or payment service that received the funds. These intermediaries answer requisitions too, and the trail of the money completes the trail of the connections.

Obtaining compensation

The victim of a hack may join the proceedings as a civil party, before the criminal court if the hacker is prosecuted, or before the investigating judge through the complaint under Article 85. The victim claims compensation for the loss suffered: the sums paid by them or by their contacts on the strength of the hacker’s messages, the non-material loss caused by the intrusion into their correspondence and the publication of content in their name, and, for a business account, the loss of customers or income while the account was unavailable.

Where payments were made from your means of payment without your authorisation, for instance with a card stored in the hacked account, the bank must in principle refund them under Article L. 133-18 of the French Monetary and Financial Code, subject to the gross negligence it may try to raise against you. The dispute with the bank is independent of the criminal complaint and must be raised without delay.

Offers to “recover” an account or funds for a fee, which flood the comments and private messages after a hack, are almost always a second scam aimed at the same victim.

Business accounts

The account of a company, a firm, a shop or a content creator calls for three further precautions.

If the hacked account held personal data of third parties (customers, patients, subscribers, files attached to a mailbox), the hack is a personal data breach within the meaning of the GDPR, with the 72-hour notification to the CNIL, the French data protection authority, and the director’s exposure that we describe in our article on criminal liability after a cyberattack.

The complaint should quantify the commercial loss from the outset: turnover generated by the account, contracts lost, campaigns cancelled. These figures are hard to reconstruct months later.

Finally, communication with customers and followers should be prepared: a short message, sent through another channel, stating that the account has been compromised, that messages received from it during the period did not come from you, and that no request for payment is legitimate. That message cuts short the ongoing scam and, in its turn, fixes a date.

Frequently asked questions

Do I still need to file a complaint if I have already recovered my account?

Yes. Recovery ends the intrusion; it does not erase the offence, does not repair what was sent to your contacts and does not protect you against a second attempt by the same person. The complaint is also the document your bank, your insurer or the platform will ask for if the hack has had consequences.

The hacker replaced my email address and phone number: is the account lost?

Usually not. Platforms keep a record of the original details and offer, in the email announcing the change, a link to reverse it, then an identity check if that link no longer works. What matters is to start the recovery procedure without delay, since some of these routes close after a few days, and to keep the notification email, which records the time and the device used for the change.

Can I file a complaint online for a hacked account?

The Ministry of the Interior’s THESEE platform accepts complaints from adult individuals for the hacking of messaging accounts, in particular where the hacker demanded money from the victim or their contacts. For a hack without a demand for money, or for a business account, the complaint is filed at a police station, a gendarmerie or by letter to the prosecutor.

How long do I have to file a complaint?

The limitation period for this type of offence is six years. But the connection data that makes it possible to identify the hacker is kept for only one year by operators and internet service providers. A complaint filed within days of the facts is the only one that leaves the investigation a real chance of succeeding.

Can a judge order Instagram or Google to give me my account back?

No. Returning an account is a matter for the platform’s recovery procedure, which the complaint does not replace. On the other hand, the prosecutor or the judge can require Meta or Google to disclose the hacker’s connection data and, since 18 August 2026, can send them directly a European Production Order to be executed within ten days.

My relatives sent money to the hacker who was posing as me: who is the victim?

You are, for the fraudulent access, the breach of your correspondence and the theft of your identity. Your relatives are, for the fraud they paid the price of. Each files their own complaint, and it helps if the complaints refer to one another: investigators link files that point to each other more easily.