What should I do if my phone has been hacked in India?

As of 24 October 2026: the service descriptions, prices and turnaround figures on this page are current.

What should I do in the first hour?

Contain first, then capture, then fix. Containment: switch the phone to airplane mode, which stops an active remote session and stops SMS and calls, and do not unlock it again except to photograph what you need. Capture: take full-screen photographs with the date and time visible, of the installed apps list, WhatsApp Settings then Linked Devices, the device administrator and accessibility-permission lists, the recent call and SMS logs, the notification shade, and the banking and UPI apps' transaction history. Capture the phone's IMEI and the phone number in dialler settings, because both are needed on a police complaint. Then fix, from a clean device: change your email password first, because email resets everything else, then the primary social and banking accounts, and revoke every session.

What is the six-hour CERT-In clock, and does it apply to me?

CERT-In's six-hour reporting obligation is directed at organisations, not individuals: a listed incident must be reported within 6 hours of detection to incident@cert-in.org.in, with a 1800-11-4949 helpline, and logs retained for 180 days. For a person whose personal phone is compromised, the equivalent clock is the fraud reporting window, because the money moves in hours. File on the National Cyber Crime Reporting Portal at cybercrime.gov.in and on helpline 1930, call your bank's fraud helpline to flag the beneficiary, and ask for a transaction limit on the account. If your phone was compromised because of a work device, or if the attacker used your access against your employer, then the organisation's CERT-In clock has also started, and you should tell your employer the same hour so they can report and preserve their own logs.

Should I factory reset the phone straight away?

No, not before the evidence is captured. A factory reset destroys the installed-app list, the remote-access configuration, the linked-device entries and the forensic artifacts that let a CERT-In empanelled examiner or the police establish what happened and when. Resetting also does not fix the real entry point, which is usually a compromised email account, a hijacked SIM or a still-active WhatsApp session. The correct sequence is: preserve, secure the accounts from a clean device, get the phone examined, and only then wipe it. If the phone contains banking credentials and you are not going to have it examined, at minimum revoke every session, remove the app, change the password and get a new SIM with a port-out lock.

What if money has already moved?

Move in hours, not days. Call your bank's fraud helpline first and ask for three things: the beneficiary account flagged, the transaction reversed or recalled, and a temporary limit and block on new payees. Then file on cybercrime.gov.in and call helpline 1930, and keep the report number, because restitution is conditional on it. Under RBI's June 2026 instructions, effective 1 January 2027, a genuine individual victim with a gross loss up to Rs 50,000 may be compensated at 85% of net loss or Rs 25,000, whichever is less, provided the fraud is reported to the bank and to the NCRP or helpline 1930 within five calendar days. Indians lost over Rs 22,800 crore to telecom fraud and impersonation scams in 2026, and the reporting speed, not the amount, is what decides the outcome.

What are the frequently asked questions?