WhatsApp Banned or Hijacked: Recovery and Complaint Guide India

A small kirana store in Lucknow loses its WhatsApp Business account on a Tuesday morning; five hundred regular customers cannot place orders, and the screen just says “Your phone number is banned from using WhatsApp.” Across town, a college student wakes up to thirty missed calls because a hijacker is messaging her family asking for “urgent ₹40,000 hospital money.” Two different problems, one platform, one fix-it window of roughly thirty minutes before damage compounds. This guide is the operational playbook for every Indian WhatsApp user facing a sudden ban, a takeover, an impersonation account, or a Business profile freeze.

30-minute crisis ladder for WhatsApp loss of access
Confirm what happened (ban screen vs logged-out vs duplicate account) → if hijacked, re-register your number immediately to force-logout the attacker → enable two-step verification with a recovery email → email [email protected] from the registered number's primary email → file a Grievance Officer escalation under IT Rules 2021 Rule 3(2)/Rule 4(8) within 24 hours of incident → dial 1930 if any money has moved → file at cybercrime.gov.in within 60 minutes → SMS or call every contact with the standard “I was hacked” message. Recovery rate inside the first hour: 70 to 90 percent. After six hours: under 30 percent.

If your WhatsApp is banned by mistake, email [email protected] from your account email with subject “Banned: Request review”, body should state your full E.164 number (+91XXXXXXXXXX), the exact ban screen text, and a one-line truthful explanation of usage. WhatsApp typically replies in 24 to 72 hours; mistaken bans on broadcast or mass-forward grounds are routinely reversed. If your WhatsApp is hijacked (you got logged out, contacts are getting fake messages from your number), reinstall WhatsApp on your phone, enter your number, request a fresh 6-digit code, enter it; this forcibly evicts the attacker within roughly seven minutes. Immediately enable two-step verification (Settings, Account, Two-step verification). For both scenarios, file a parallel Grievance Officer complaint under IT Rules 2021 Rule 3(2) within 24 hours and, if money was lost or extortion attempted, dial 1930 and file at cybercrime.gov.in under IT Act §66C / §66D and BNS §318 (cheating) / §336 (forgery).

• What just happened? Diagnose in 60 seconds
• The 30-minute emergency action plan
• Evidence checklist (screenshot before you click anything)
• The five reasons WhatsApp bans Indian numbers
• Official complaint route: support, Grievance Officer, MeitY
• When you must file a police or cyber complaint
• Sample appeal letter to WhatsApp
• Sample "I was hacked" message to contacts
• WhatsApp Business: extra steps
• Group misuse and impersonation accounts
• Hardening: prevent the next attack
• Frequently asked questions

Open WhatsApp on your phone and look at the very first screen. Match it to one of the five patterns below; everything that follows depends on this diagnosis.

Your account has been banned by WhatsApp's automated systems or by a human reviewer. Common triggers: broadcast lists hitting unknown numbers, bulk forwarded messages flagged as spam, multiple “report and block” actions from recipients, suspected use of an unofficial app like GB WhatsApp or WhatsApp Plus, or the number being on an internal abuse list inherited from the previous owner of a recycled SIM.

Someone else just registered WhatsApp on your number from another device. Either they stole your 6-digit code through social engineering, or they used a SIM-swap or call-forwarding trick. The other party currently has your WhatsApp; you have nothing.

Less common, but a sign that an attacker has session access from a paired Linked Device (WhatsApp Web/Desktop). Go to Settings, Linked devices, and check for any session you do not recognise.

Pure impersonation. The other account uses your photo and name to message your friends. Your own account is fine; the problem is takedown of the fake one.

Business-tier restriction. Often caused by a complaint about catalog content, payment-link spam, or volume of unanswered customer reports. The chat side may still work; the catalog and Click-to-Chat ads will not.

Decision rule
Patterns A and E need a support email plus Grievance Officer appeal. Patterns B and C need re-registration first, then evidence collection. Pattern D needs a takedown complaint with the impersonating profile's screenshots.

1. If hijacked (Pattern B), reinstall WhatsApp from the official Play Store or App Store. Enter your number. Request the new 6-digit code via SMS, enter it. The attacker's session is destroyed.
2. If linked-device session is the issue (Pattern C), go to Settings, Linked devices, and tap “Log out from all devices.”
3. If banned (Pattern A or E), do not reinstall and do not change your number; that resets the appeal clock and weakens your case.
4. Switch off mobile data and Wi-Fi for 30 seconds, then back on. This forces WhatsApp to refresh server status.

1. Settings, Account, Two-step verification, Enable. Set a fresh 6-digit PIN you have not used anywhere else.
2. Add a recovery email you control and check daily. This is the only way to reset the PIN if you forget it.
3. Settings, Privacy, Last seen / Profile photo / Status / About: set to “My contacts” or “Nobody” temporarily.
4. Settings, Privacy, Groups: set to “My contacts” to stop unknown additions.
5. Settings, Chats, Chat backup: take a manual backup so you have a recoverable copy.

1. Screenshot the ban screen, the linked-devices list, the chat where the 6-digit code was requested, and the timestamp of logout. Save with a timestamp filename.
2. Send the standard “I was hacked” SMS or normal phone-call message to every important contact. Sample text is in the section below.
3. If money was asked for, dial 1930 (cyber-fraud helpline) and read the script. Even if no money has yet moved, log the call.

1. Email [email protected] from the registered number's primary email address. Subject: “Banned: review request, +91XXXXXXXXXX” or “Hijacked: account compromise, +91XXXXXXXXXX”.
2. Use the in-app “Help” / “Contact us” form if available; it adds device fingerprint data that strengthens the case.
3. Email the WhatsApp Grievance Officer for India (the address is published on WhatsApp's “Contact us” page; verify before sending) under IT Rules 2021 Rule 3(2) for content takedown and Rule 4(8) for SSMI accountability. Set a 24-hour SLA expectation in writing.
4. If extortion, threats, or money loss occurred, lodge the NCRP complaint at cybercrime.gov.in and download the acknowledgement PDF.

What most citizens get wrong
They reinstall WhatsApp during a ban. This destroys their chat backup and has zero effect on the ban itself, because the ban is tied to the phone number, not the device.

• Full-screen screenshot of the ban or logout message, including the timestamp.
• Screenshot of Settings, Linked devices, showing any unknown session.
• Screenshot of any SMS asking you to forward a 6-digit code, including sender's number.
• Screenshot of any WhatsApp chat where someone is impersonating you (ask a friend to take it).
• Screenshot of any UPI debit or bank notification within the last 72 hours.
• Call-record export from your phone for the last 72 hours.
• SIM card details: IMSI / ICCID number printed on the card and the SIM provider's last-recharge SMS.
• IMEI of your phone (dial *#06# to retrieve).
• NCRP acknowledgement PDF, if filed.
• Copy of the email sent to [email protected] (and any reply).

Store all of the above in a single folder on your phone and email a copy to yourself. This becomes the evidence pack you attach to every later complaint (consumer commission, police, RTI, civil suit).

Sending the same message to a broadcast list where many recipients are not in your contacts. WhatsApp's anti-spam classifier flags this. The fix in the appeal is to confirm in writing that you have customer consent and to undertake to switch to the WhatsApp Business API for any future bulk use.

Five or more recipients reporting your number in a short window triggers an automatic ban. Common with cold-calling sales numbers and re-issued SIM cards inherited from a previous owner. Appeal evidence: KYC documents showing the SIM is freshly issued in your name.

Using GB WhatsApp, WhatsApp Plus, YoWhatsApp, or any modified APK is an explicit Terms of Service violation. Uninstall it before you appeal; switch to the official app from the Play Store or App Store.

Anything that looks like a script or bot, including some auto-reply tools, will trip the classifier. If you run a legitimate small-business chatbot, you must move to the WhatsApp Business API through an approved Business Solution Provider.

If your number was previously used by someone now banned, the ban can transfer with the number. The fix is a clean appeal that includes the SIM activation date and the porting-history SMS from your operator.

Email: [email protected]. Send from the email registered on the device (or your primary personal email). Body should be short, factual, and contain the registered number in international E.164 format. Do not threaten legal action in the first email; it slows the human review. Typical SLA: 24 to 72 hours.

If the app still opens to the ban screen, tap “Request a review” or “Contact support.” This passes device fingerprint, locale, and last-session metadata that the email route does not. Do both.

Under the Information Technology (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, every Significant Social Media Intermediary (SSMI) operating in India must publish a Grievance Officer's name and contact, and must acknowledge complaints within 24 hours and resolve them within 15 days (Rule 3(2)). For content impersonating you or showing private nude images, the take-down window is 24 hours under Rule 3(2)(b). For loss of access to your own account, Rule 4(8) governs the Resident Grievance Officer's role.

The officer's email address is published on WhatsApp's India “Help Center” page; always copy it fresh from the official site before sending, because contact addresses are updated periodically. Send the same evidence pack from Step 1, plus the support-ticket number you received.

If the Grievance Officer does not respond inside 24 hours (acknowledgement) or 15 days (resolution), escalate to the Ministry of Electronics and Information Technology (MeitY) grievance portal at pgportal.gov.in (Department: MeitY). Cite the ticket numbers, the date you wrote to the Grievance Officer, and request enforcement action under IT Rules 2021. The Grievance Appellate Committee (GAC) at gac.gov.in is the next step if you remain unsatisfied; you have 30 days from the SSMI's reply to file a GAC appeal.

If a fake account in your name persists after takedown, the Digital Personal Data Protection Act, 2023 gives you the right to demand erasure of your personal data (name, photo, voice notes) from the impersonating profile. Cite §12 (right of correction and erasure) in a separate written notice to the Grievance Officer.

A WhatsApp problem becomes a criminal problem the moment any of these are true:

• Someone has demanded money in your name and at least one contact has paid.
• Someone has threatened to share your private photos or chats (sextortion).
• The hijacker has obtained access to your linked bank account, e-wallet, or UPI app.
• A fake account in your name is sending fraudulent messages to clients or family.
• You suspect SIM-swap fraud where someone obtained a duplicate SIM with your number.

Open cybercrime.gov.in, choose “Report Other Cybercrime,” create an account, and file under the relevant category (Social Media Crime, Online Financial Fraud, or Impersonation). Upload the evidence pack. Download the acknowledgement PDF (Acknowledgement Number is critical for later RTI).

For money-loss cases the 1930 cyber helpline can request a hold on the fraudulent transaction inside the golden hour (RBI's zero-liability window). Read the script verbatim; do not improvise. See the 1930 helpline script for the exact wording.

• IT Act 2000 §66C : identity theft using electronic signature or unique identifier (the 6-digit code, the password, the OTP). Up to three years' imprisonment and ₹1 lakh fine.
• IT Act 2000 §66D : cheating by personation using a computer resource. Up to three years' imprisonment and ₹1 lakh fine.
• Bharatiya Nyaya Sanhita 2023, §318 : cheating. Imprisonment up to seven years and fine.
• Bharatiya Nyaya Sanhita 2023, §336 : forgery for purpose of cheating. Up to seven years' imprisonment.
• Bharatiya Nagarik Suraksha Sanhita 2023, §173 : the new code for filing an FIR. Police cannot refuse a cognisable cyber complaint.
• IT Rules 2021, Rule 3(2) : 24-hour acknowledgement, 15-day resolution by SSMI Grievance Officer.
• DPDP Act 2023, §12 : right to erasure of personal data held by a Data Fiduciary (WhatsApp is a Data Fiduciary).

If the local cyber cell tries to file only a “complaint” rather than an FIR, politely cite BNSS §173 which mandates registration of FIR for cognisable offences. Identity theft (IT Act §66C) and cheating (BNS §318) are cognisable. Ask for the FIR number in writing.

The body below works for both a mistaken ban and a hijack appeal. Keep it short, factual, and free of legal threats in the first round.

Subject: Banned account review request: +91XXXXXXXXXX

Dear WhatsApp Support team,

My WhatsApp account on the number +91XXXXXXXXXX was banned on
[date] at approximately [time IST]. The ban screen reads:
"Your phone number is banned from using WhatsApp."

I am the legitimate owner of this number, registered in my name
with [Airtel / Jio / Vi / BSNL] under KYC, since [date].

Account use pattern (truthful, one paragraph):
- I run a small kirana shop / I am a student / I am a homemaker.
- I have approximately [N] regular contacts.
- I do not use unofficial WhatsApp clients.
- I do not run automation or scraping tools.
- I have not made any new broadcast list in the last 30 days.

If the ban was triggered by reports from recipients, please note
that [brief truthful context, e.g., the SIM is new and the previous
owner may have generated those reports].

I respectfully request a review and reinstatement of my account.

I have parallelly filed:
- Grievance Officer complaint under IT Rules 2021 Rule 3(2), on [date].
- NCRP acknowledgement [number, if filed].

Kind regards,
[Your name]
+91XXXXXXXXXX
[City, State]

For a hijack appeal, replace paragraph 2 with: “My WhatsApp was hijacked on [date] at [time IST]. The hijacker requested a 6-digit code from me by impersonating a known contact. I have since re-registered the account and enabled two-step verification.”

Send this by SMS, normal phone call, or email; not on WhatsApp (the attacker may be reading). Keep it short.

This is [Your name]. My WhatsApp account on +91XXXXXXXXXX was
briefly compromised between [start time] and [end time] on [date].
During that window, please IGNORE any urgent request from me asking
for money, OTPs, bank details, or a 6-digit code. I will NEVER ask
for money over WhatsApp. If you already responded or transferred
money, please tell me immediately so I can help you file 1930 inside
the golden hour. The account is now back under my control and two-
step verification is on. Thank you.

Why this exact text
It establishes a clear time window for any later FIR, gives recipients a path to act (1930), and pre-empts the hijacker's social engineering on people you may not have reached yet.

A WhatsApp Business ban hurts more because customers, payments, and catalog all sit in the same account. The recovery path is identical for steps 1 to 3 above, with three additions:

1. Append to the appeal email: Business name, GSTIN, the Business category you registered under, average daily customer messages, and Business Profile creation date.
2. If you have Click-to-Chat ads running on Meta Ads Manager, pause them; bans during a live ad burn budget with zero conversions.
3. If you are using the WhatsApp Business API through a Business Solution Provider (BSP), open a parallel ticket with the BSP. The BSP has direct escalation channels that the consumer app does not.
4. If the ban affects the catalog only, mention the specific products and confirm in writing that none of them are on WhatsApp's restricted list (alcohol, tobacco, weapons, medical drugs, animals, adult content).

For payment-link spam complaints, switch to verified WhatsApp Pay or a payment gateway link rather than raw UPI handles in bulk messages.

Long-press the group, Exit Group, then Report. Settings, Privacy, Groups, “My contacts” or “My contacts except” to stop further additions. If the group is being used to defame you, screenshot the participants list and the offending messages, then file under IT Rules 2021 Rule 3(2)(b) for take-down.

1. Ask three friends to open the fake profile and tap “Report” within their app.
2. Email the WhatsApp Grievance Officer with screenshots and the fake number; cite Rule 3(2)(b) for 24-hour takedown of impersonation content.
3. File NCRP under “Impersonation” with full screenshots.
4. Cite IT Act §66D (cheating by personation by computer resource) and BNS §319 (cheating by personation) in any FIR.
5. If you are a public figure or a small business, post a single public clarification on Facebook, Instagram, or X with your verified WhatsApp link so customers do not message the fake number.

Save full chat export (Settings, Chats, Export chat). Forward to the cyber cell. The admin attracts liability under IT Act §69A read with BNS §353 (statements conducing to public mischief).

• Turn on two-step verification with a fresh PIN and a recovery email you check daily.
• Set Settings, Privacy, Profile photo to “My contacts,” not “Everyone.”
• Set Settings, Privacy, Last seen to “Nobody” or “My contacts.”
• Set Settings, Privacy, Groups to “My contacts” to stop random group additions.
• Set Settings, Privacy, Default message timer to 7 days for sensitive personal chats.
• Periodically check Settings, Linked devices and log out any device you do not recognise.
• Never share your 6-digit registration code or your two-step PIN with anyone, including someone claiming to be from WhatsApp. WhatsApp staff will never ask for either.
• Lock the WhatsApp app itself with Settings, Privacy, App lock (fingerprint or face unlock).
• If you receive a sudden SMS with a code you did not request, do not forward it. Someone is trying to register your number on their device.
• Keep your phone's operating system and WhatsApp updated to the latest version from the official store.

The SIM-swap connection
A SIM-swap attack lets a fraudster receive your 6-digit code on their duplicate SIM, bypassing you entirely. If your phone suddenly shows “No service” for more than 30 minutes for no reason, call your operator from a friend's phone and ask whether a SIM port-out or duplicate-SIM request is active. See how to block a lost or stolen SIM card for the immediate ladder.

Email [email protected] from your registered email, with subject “Banned: Request review, +91XXXXXXXXXX”. State your number in E.164 format, the exact ban-screen text, and a short truthful description of your usage (small business, family chats, etc.). In parallel, file a Grievance Officer complaint under IT Rules 2021 Rule 3(2). Typical reversal time for a mistaken ban is 24 to 72 hours. Do not reinstall the app or change your number; that destroys the appeal trail.

You have been hijacked. Reinstall WhatsApp, enter your number, request a fresh 6-digit code, enter it. The attacker's session is destroyed within roughly seven minutes. Then enable two-step verification, log out all linked devices, and SMS or call every important contact with the standard “I was hacked” message. File at cybercrime.gov.in and dial 1930 if any money moved. See the 1930 cyber-fraud helpline script.

No. Re-register your number on WhatsApp right now (open WhatsApp, enter your number, request the new code via SMS, enter it). This forcibly logs out the attacker. Then turn on two-step verification with a recovery email so the same trick cannot work twice. Recovery is near-instant if you act within the first hour. After six hours, contacts may have already paid the attacker; that's where 1930 and the police FIR come in.

Yes, if money was demanded or paid in your name, threats were made, your private images were shared, or your bank or UPI was compromised. The offences are IT Act §66C (identity theft), IT Act §66D (cheating by personation), BNS §318 (cheating), and BNS §336 (forgery for cheating). Under BNSS §173, police must register an FIR for cognisable offences. If they refuse, escalate in writing to the Superintendent of Police citing BNSS §173(4).

You can, but do this in the right order. First, appeal the existing ban via [email protected] and the Grievance Officer; many Business bans reverse in 48 to 72 hours. Second, register a new number only after the appeal is filed and acknowledged; using a fresh number while the old one is under appeal can flag both. Third, if you genuinely need to move, update your Google Business Profile, the link in your Instagram bio, and any printed material so customers find the new number.

Under IT Rules 2021 Rule 3(2), the Significant Social Media Intermediary's Grievance Officer must acknowledge in 24 hours and resolve in 15 days. If they miss either deadline, escalate to MeitY at pgportal.gov.in (Department: MeitY) with the ticket number and timestamps. Beyond that, the Grievance Appellate Committee (GAC) at gac.gov.in accepts appeals within 30 days of the SSMI's response (or non-response).

This is impersonation, not hijack. Steps: (1) Ask three contacts to open the fake profile and tap “Report” in their own app. (2) Email the WhatsApp Grievance Officer with screenshots and the fake number, citing IT Rules 2021 Rule 3(2)(b) for 24-hour takedown of impersonation. (3) File at cybercrime.gov.in under “Impersonation,” cite IT Act §66D and BNS §319. (4) Post one public clarification on your verified social channels so contacts know to ignore the fake. See the sibling guide how to report a fake social media profile in India.

Yes, immediately. This is sextortion or extortion. Do not pay; payment guarantees another demand. Preserve every message, do not delete anything, and file at cybercrime.gov.in plus dial 1930. The offences are BNS §308 (extortion), §351 (criminal intimidation), IT Act §67 (publishing obscene material in electronic form), §67A (sexually explicit material). Women's Cyber Helpline 155260 is also available. Tell a family member you trust the same hour; the shame the criminal weaponises depends on isolation.

Call your mobile operator from another phone. Ask whether a duplicate SIM or port-out request is active on your number, and request immediate block of any unauthorised SIM. Then visit the operator's store with original ID proof to reactivate your SIM. Once your SIM is back, re-register WhatsApp using the new 6-digit code. File at cybercrime.gov.in under “Online Financial Fraud” if any money moved during the no-service window. See how to block a lost or stolen SIM card in India for the operator-by-operator process.

Not directly; WhatsApp is a private company and not a “public authority” under the RTI Act 2005. But you can file an RTI to MeitY asking for the consolidated number of grievances filed against WhatsApp under IT Rules 2021 in the last quarter, the average resolution time, and any compliance directions issued. For day-to-day citizen RTIs, see the citizen RTI playbook.

FAQ schema note
The 10 questions above are formatted as H3 headers (`==== Q? ====`) so that the sitewide schema-auto.js picks them up as FAQPage entities. Never paste inline JSON-LD here; the sitewide schema layer handles it.

• WhatsApp Help Center, “Banned accounts,” faq.whatsapp.com/general/account-and-profile/about-banned-accounts.
• WhatsApp Help Center, “Two-step verification,” faq.whatsapp.com/1920866721452534.
• IT (Intermediary Guidelines and Digital Media Ethics Code) Rules, 2021, MeitY, meity.gov.in.
• Information Technology Act, 2000, sections §66C and §66D, indiacode.nic.in.
• Bharatiya Nyaya Sanhita, 2023, sections §318 (cheating), §319 (cheating by personation), §336 (forgery for cheating), indiacode.nic.in.
• Bharatiya Nagarik Suraksha Sanhita, 2023, §173 (FIR for cognisable offence), indiacode.nic.in.
• Digital Personal Data Protection Act, 2023, §12 (right to correction and erasure), meity.gov.in.
• National Cyber Crime Reporting Portal, cybercrime.gov.in.
• Cyber Crime Helpline 1930, Indian Cyber Crime Coordination Centre (I4C), Ministry of Home Affairs.
• MeitY Grievance Portal, pgportal.gov.in (Department: MeitY).
• Grievance Appellate Committee, gac.gov.in.
• RBI, “Customer Protection: Limiting Liability in Unauthorised Electronic Banking,” 6 July 2017.

• 1930 cyber-fraud helpline: the exact script to read
• Bank account frozen for cyber-fraud: unfreeze guide India
• Block a lost or stolen SIM card and recover the number
• How to report a fake social media profile in India
• WhatsApp OTP fraud explained: 6-digit-code hijack
• The citizen RTI playbook
• Middle-class traps: scams every Indian family should know
• NCRP acknowledgement and bank-lien decoder
• The golden hour and zero-liability rule under RBI

For the social card at 1200×630, generate a flat-design illustration: a smartphone screen split vertically; left half shows a dimmed WhatsApp ban screen in Indian-English with a red shield icon; right half shows a checklist with green ticks captioned “Re-register, 2FA, Grievance Officer, 1930, FIR.” Background: soft mint-green gradient (#E8F5E9 to #C8E6C9). Top-right corner: “RTI Wiki citizen guide 2026” wordmark in dark green. No human faces, no celebrity likeness, no copyrighted logos. Aspect 1200×630, save as PNG.

This article is general guidance, not legal advice. Statutory references are accurate as of 2026 but laws are amended periodically; verify on indiacode.nic.in and meity.gov.in. For an active criminal case, consult a lawyer admitted in your state. Always re-verify WhatsApp's support and Grievance Officer addresses on the official Help Center before sending.