Can I file a complaint if someone hacks my WhatsApp account?

A compromised WhatsApp account: the first legal and practical steps

If someone gains control of your WhatsApp account without permission, the immediate priorities are to contain the compromise, preserve evidence and identify whether the facts disclose a criminal offence. An unauthorised login is different from the temporary loss of access caused by a lost SIM, device failure or a legitimate platform restriction. It may involve stolen verification codes, SIM-swapping, malicious linked devices, phishing or access to an unlocked phone. The legal complaint should describe the actual mechanism insofar as it is known, rather than assert confidently that a named person “hacked” the account without proof.

In Pakistan, relevant offences may arise under the Prevention of Electronic Crimes Act, 2016 (PECA), as amended, including provisions concerning unauthorised access to an information system or data, unauthorised copying or transmission, and interference with systems or data. The elements of a particular offence must be established. It is not enough to describe every awkward or unwanted WhatsApp interaction as a cybercrime.

The competent federal investigation agency for PECA offences in 2026 is the National Cyber Crime Investigation Agency (NCCIA), established under the amended framework. Its official public guidance identifies online complaints through complaint.nccia.gov.pk, designated reporting centres and other supported complaint channels. Do not rely on older references to the FIA cybercrime wing without checking current jurisdiction.

Secure your mobile number and primary device first

An account recovery attempt should begin through WhatsApp's official instructions and the mobile network operator where appropriate. If your SIM may have been replaced or diverted, promptly contact the operator through a verified customer-service channel and request the necessary security action. Review linked devices and terminate unfamiliar sessions when legitimate access is restored. Enable available verification safeguards, including two-step verification and strong security for the email account associated with the device or services.

Check the rest of the phone and accounts. The same compromised email address or stolen device may expose banking, cloud storage and other communications. Change passwords from a device you trust. Avoid using a recovery website sent by an unknown caller or providing a new verification code to a person claiming to be “helping” you regain the account.

Tell close contacts through an independent trusted channel that suspicious messages may have come from a compromised account. If a criminal is requesting money from your contacts, ask recipients to retain transaction particulars and the exact messages. Warn people not to send further money or credentials.

What conduct could constitute an offence under PECA?

Section 3 of PECA addresses unauthorised access to information systems or data, subject to its statutory requirements. Section 4 concerns unauthorised copying or transmission of data, again with the necessary legal ingredients. Section 5 concerns interference with systems or data. The facts must establish the relevant unauthorised act and mental element where the provision requires it.

For example, a person who obtains a victim's code through deception and uses it to take over an account may raise a different evidentiary case from a person who merely receives screenshots supplied by someone else. A former partner who already had consensual device access may create difficult questions about the scope and withdrawal of authorisation. Whether information was actually copied, transmitted or altered is separate from whether a login occurred.

Identity theft, impersonation, fraud, extortion, publication of private material and threats may engage additional provisions depending on the conduct. A responsible complaint identifies the distinct acts, their chronology and their available proof. It does not attach every possible section in the hope that one will eventually apply.

Preserve electronic evidence properly

Create a reliable chronology of the suspicious events. Record when access was lost, messages warning of a login, verification prompts, SIM events, unknown linked devices and communications from contacts who received fraudulent requests. Keep the original SMS and email alerts. Ask the mobile operator for a reference number and preserve any official correspondence about SIM replacement or unusual activity.

Screenshots can assist preliminary reporting but should not be the entire evidentiary strategy. Retain the original phone, messages, relevant files and app information insofar as doing so is lawful and technically possible. Preserve complete conversations showing context, not just one cropped message that favours a particular account. For money paid by victims of impersonation, retain bank or wallet transaction identifiers and complaint acknowledgements.

Do not try to “hack back” into the suspected person's account or secretly obtain their private communications. That response can create separate criminal and evidentiary problems. Investigative authorities have legal procedures for obtaining data, device examinations and records from service providers.

How to complain to NCCIA

Use the official NCCIA website and complaint channels. The online complaint form may request your name, CNIC, contact details, city, category of offence and narrative. Those details are provided to the competent agency for a legal complaint, not published in the public Ask Chambers comments section. Where sensitive intimate material is involved, avoid uploading it to an unverified website or circulating it by email to multiple individuals.

A concise complaint should identify the account and associated number, the suspected unauthorised activity, dates, the circumstances of discovery, loss or threatened loss, and the evidence available. Clearly distinguish what you personally know from what you suspect. If a specific individual is named, explain why available evidence connects that person to the act.

Retain the complaint reference and supporting submission. If the matter is urgent—such as extortion, credible threats or ongoing financial fraud—contact the relevant emergency or banking authorities without waiting for a routine appointment. NCCIA's official guidance also permits attendance at designated Cyber Crime Reporting Centres where the circumstances call for it.

What if the account was used to ask friends for money?

Financial fraud involving a compromised social-media account can create two overlapping problems: the unauthorised account access and the separate deception of the recipient who paid money. Preserve evidence for both. Identify each transfer, recipient account and stated reason given by the impersonator. Report the transaction promptly to the bank or wallet provider under the applicable dispute and fraud procedures.

A transfer initiated by the victim after receiving a false WhatsApp message is not necessarily treated by the bank in the same way as a transfer made entirely without the account holder's authorisation. The recovery mechanism depends on the financial service and facts. A timely report may help preserve records and create an opportunity for appropriate intervention, but recovery cannot be guaranteed.

The person whose WhatsApp identity was impersonated should not make admissions of responsibility merely because the messages appeared under their name. Their conduct, security measures and any independent dealings with the person who paid must be considered.

What if private photographs or documents were taken?

The copying, threatened release or publication of private material can raise different offences and civil remedies from a bare account takeover. Record the threat and any demand made, and preserve the original messages and accounts through which it was communicated. Do not send additional intimate images in response to threats or pay an extortionist simply on the promise that all copies will be deleted.

The applicable provisions depend on the nature of the material, consent, the method of acquisition and any subsequent dissemination. Platform removal requests can proceed in parallel with a lawful investigation. An injunction or other civil remedy may also be appropriate where continuing disclosure threatens legal rights, but the forum and relief need examination.

Special care is necessary where minors are involved. Sensitive evidence should be handled through lawful and secure channels, not reproduced on an open discussion forum.

How will investigators establish who accessed the account?

Attribution is often more difficult than proving that access was unauthorised. A displayed name, avatar or phone number does not by itself identify the person operating an account. Relevant evidence may include device information, connection records lawfully obtained, SIM issuance history, payment trails, admissions, associated messages and forensic analysis.

Investigators must consider evidence that supports or contradicts the initial suspicion. Service-provider retention and disclosure policies can affect the available records, and delays may make evidence difficult to recover. For this reason a prompt and accurate chronology is more useful than a speculative allegation presented weeks later.

The Qanun-e-Shahadat Order, PECA and applicable procedural rules govern the treatment of digital evidence. The admissibility and weight of a screenshot or forensic result can be contested in court. Maintain an intelligible chain of custody from the earliest possible stage.

What if the police or agency take no action?

Keep proof of submission and identify which investigative body has legal jurisdiction. Follow the agency's official procedure for a status update or supervisory review. Legal remedies may exist where a statutory duty is not performed, but they must be selected with reference to the current investigative framework and stage of proceedings. An FIR registration remedy under ordinary CrPC should not be assumed to operate identically for every PECA investigation.

If an investigation is opened, cooperate truthfully and respond to lawful requests. If you are wrongly accused of controlling the compromised account, preserve exculpatory digital and physical material and seek advice about the lawful defence and any summons.

Practical conclusion

Act in two tracks. Secure the account, SIM and linked services immediately; at the same time preserve evidence and, where the statutory elements appear to be met, lodge an accurate complaint with NCCIA. Financial deception, publication of intimate information and threats should each be identified separately rather than buried under a generic allegation of hacking.

Technical recovery and criminal liability are not the same question. A legally sound complaint helps investigators distinguish an actual unauthorised act from a platform error or private quarrel, identify the responsible person through evidence and select the correct statutory offences.

Legal sources: Prevention of Electronic Crimes Act, 2016, as amended by the Prevention of Electronic Crimes (Amendment) Act, 2025; sections 3, 4 and 5 where applicable; NCCIA's official complaint and reporting guidance; and relevant provisions of the Qanun-e-Shahadat Order, 1984.