Hacked WhatsApp or Instagram Account and Impersonation in Kuwait: How to Report, Recover Your Account and Protect Yourself

A friend messages you: "Did you just ask me to transfer money urgently?" Or you pick up your phone and find you are logged out of your WhatsApp or Instagram account, while your name and photo are being used to message your family, colleagues and customers with words you never wrote. At that moment two worries collide: the fear that what the intruder does will be attributed to you, and confusion about where to start. Should you contact the platform, go to the police station, or warn everyone you know?

This article deals with that specific situation: a personal or business account on a messaging app or social network that has been taken from its owner, or a fake account created with someone's name and picture to impersonate them. We do not repeat here the general overview of cybercrime, which we cover in our article on cybercrime under Kuwaiti law, nor the extortion scenario discussed in electronic threats and extortion. Instead we focus on three practical questions: what to do in the first hours, how to report and preserve evidence, and how to shield yourself from liability for what someone else did with your account, and then claim compensation.

Any technical steps mentioned are general, protective measures that every user should know. Platforms change their interfaces and procedures frequently, so the final word on recovery steps is always the platform's own official help pages. The legal analysis rests on Kuwaiti legislation and settled general principles, while the outcome of any specific matter depends on the assessment of the investigating authorities and the courts.

The Short Answer

Breaking into an account, taking it over and impersonating its owner are acts that Kuwaiti law criminalises. The main provisions are found in the Law on Combating Information Technology Crimes No. 63 of 2015, alongside the Penal Code No. 16 of 1960 for fraud, insult and defamation. The account owner can report the matter to the police and prosecution authorities and claim compensation for material and moral harm under the Civil Code No. 67 of 1980.

• What do I do first? Start the official recovery process inside the platform, change the passwords of the email address and phone number linked to the account, turn on two-step verification as soon as you regain control, and tell your contacts the account is not in your hands.
• Should I file a formal report even if I got the account back? Yes, if the account was used for fraud, defamation or abuse, or if you expect it might be. An early report protects your rights, fixes the date you lost control, and separates you from anything the account publishes afterwards.
• Where do I report? To the Cybercrime Department at the Ministry of Interior, the competent police station, or the Public Prosecution depending on the nature of the incident. The receiving authority routes the complaint to the body that investigates it.
• What evidence do I need? Full, uncropped screenshots showing dates, times, the account name and link; the platform's notifications about changed email or phone; the phone numbers and bank accounts the intruder asked people to pay into; and statements from contacts who received the messages. Do not edit or crop these files.
• Can I be held responsible for what the intruder did? Criminal liability is personal: as a rule you are not liable for an act you neither committed nor took part in. In practice, however, the burden of showing that you had lost control falls on you, which is why early reporting and a documented public warning matter so much.
• Can I claim compensation? Yes, against the intruder or impersonator once identified, either by joining a civil claim to the criminal case or through a separate civil lawsuit. Compensation can cover both material and moral harm, as proven.

The Legal Framework

Kuwait has no single statute titled "account hacking." The applicable rules are spread across several pieces of legislation that work together:

• Law on Combating Information Technology Crimes No. 63 of 2015: the core statute. It addresses unauthorised access to devices, systems, websites and information accounts, and treats the offence more seriously when access leads to deleting, altering, disclosing or seizing data. It also covers the use of information networks to defraud people of money or benefits, to assume a false name or capacity, and to infringe private life or insult and defame others electronically.
• Penal Code No. 16 of 1960: contains the general principles of criminal liability, criminal intent, complicity and attempt, together with offences such as fraud, insult, defamation and threats, which may apply alongside the special law or where it is silent.
• Criminal Procedure Code No. 17 of 1960: governs how complaints are filed, the powers of investigating authorities, the joining of civil claims to criminal proceedings, and the victim's right to follow the case.
• Civil Code No. 67 of 1980: the basis for compensation for unlawful acts. Compensation covers the loss suffered, the gain missed, and the moral harm that affects reputation, standing and feelings.
• Electronic Transactions Law No. 20 of 2014: regulates the evidential value of electronic records, messages and signatures, and is an important reference when the weight of chats and screenshots is debated.
• Law of Evidence in Civil and Commercial Matters No. 39 of 1980: governs proof in a civil compensation claim, including the court's power to appoint experts, among them digital forensic experts.

Where the victim is a minor, the Child Rights Law No. 21 of 2015 and the Juveniles Law No. 111 of 2015 may also come into play; see our article on online extortion of minors and the guardian's role.

A methodological note: we deliberately avoid citing provision numbers or penalty ranges. The precise characterisation of the facts determines which provision applies, and the penalty depends on aggravating or mitigating circumstances assessed by the judge. The aim is to show you the relevant laws so you understand the path, not to give a final legal characterisation before your documents are reviewed.

Substantive Rules: How Is What Happened to Your Account Classified?

1. Unauthorised access to the account

The heart of the matter is that someone entered an account they had no right to enter, without the owner's permission or beyond the scope of that permission. The method generally does not matter: tricking the owner into handing over a verification code, using a password leaked elsewhere, or exploiting a device left unlocked. What counts is the absence of authorisation, not the sophistication of the technique. The act becomes more serious if it results in changing the account details, such as replacing the email, phone number or password to lock the owner out, deleting content, or reading and disclosing private conversations.

A recurring practical question is whether a spouse, relative or former partner who logs in with a password they once knew is acting unlawfully. The answer depends on whether permission existed, and its scope, at the time of access. Past permission is not permanent permission, and changing the password or settings to exclude the owner is strong evidence that consent was absent. Ultimately, this is assessed by the investigating authority and the court in light of the relationship and the circumstances.

2. Impersonation

Impersonation takes two forms. In the first, the intruder uses your real account to talk to people as if they were you. In the second, they create a new account bearing your name and photo to mislead followers into thinking it is yours. Both rest on deceiving others about identity. Impersonation can itself lead to liability, but it becomes far more serious when paired with another aim: obtaining money, damaging your reputation, or reaching private information about your contacts.

In practice, a distinction is drawn between an impersonation account and a parody or fan account that clearly states it is not the official one. The deciding factors are the likelihood of public confusion and the intention to deceive, which is a factual assessment that varies from case to case.

3. Defrauding your contacts in your name

The most common pattern is for the intruder to message your contact list asking for an urgent transfer, the purchase of vouchers, or a code that has just arrived on their phones. Here, the victim of the fraud is the person who was deceived and paid, while you are the victim of unauthorised access and impersonation. The distinction matters: each injured person has their own right to report and claim, and it helps when the complaints are coordinated and the facts presented together so the investigator sees the full picture. If money went to a local bank account, speed of reporting may help in tracing it, which is a matter for the competent authorities and banks under their own procedures.

4. Defamation and abuse through your account

The intruder may use the account to publish private photos or offensive statements about you or others. Where you are the target, you are the victim of offences against reputation and private life. Where others are targeted, they may complain against you believing you wrote the content, which is why the protective steps discussed below are essential. For electronic insult and defamation in detail, see insult and defamation on social media under Kuwaiti law.

5. Reading and publishing private chats

Once an intruder controls a messaging account, they can read years of conversations, photos and files. Reading them is already an attack on the secrecy of correspondence; publishing any of it, or threatening to, moves the incident into more serious territory and may turn into extortion. If you receive such a threat, do not pay and do not negotiate; follow the steps in our extortion article referenced above.

6. Business accounts

When the compromised account belongs to a shop or professional activity, the harm reaches the business itself: customer orders, prepaid amounts, reputation with followers, and sometimes advertising contracts. Additional questions arise about customers who paid the intruder believing they were paying the shop, which depend on the circumstances of each transaction and on whether the business announced the compromise in good time. If the account itself was being sold or transferred, see buying and selling online accounts and stores.

General Judicial Principles and a Methodological Note

The Court of Cassation has consistently held that criminal liability is personal: a person is criminally liable only for an act they committed or participated in, and criminal intent is never presumed but must be proven. This principle is the cornerstone of the defence of a hacked account owner. The mere fact that a message came from an account bearing their name is not, on its own, enough to attribute the act to them if it is shown that the account was outside their control.

The Court has likewise held that the trial court has discretion to weigh the evidence, including evidence derived from electronic means, accepting what it finds convincing and setting aside what it does not, provided its reasoning is sound. The value of a screenshot or chat therefore depends on its integrity and on corroborating evidence, and the court may appoint a technical expert where authenticity is disputed. See our article on proof by electronic and WhatsApp messages.

Settled principles of civil liability provide that compensation follows the harm, that it covers both material and moral damage, and that assessing the amount lies within the trial court's discretion once its elements are explained. The injured party must prove fault, harm and the causal link between them.

Methodological note: we present these principles in the general form in which they recur in Kuwaiti case law, without citing particular appeal numbers, because the aim is to explain the idea rather than offer a scholarly study. Applying any principle to your situation depends on your facts and evidence, and on any developments in judicial approach.

Practical Steps: From the First Hour to the Courtroom

Stage one: the first hour after discovering the compromise

1. Use only the platform's official recovery channels. Choose "forgot password" or "my account was hacked" from within the app or the official help page and follow the verification steps the platform asks for. Never deal with anyone offering to "recover your account" for a fee or asking for your details; this is a common second scam aimed at the same victim.
2. Secure the email and phone number linked to the account. Change your email password first, since email is usually the key to recovering every other account, and confirm that your phone number is still under your control and your SIM has not been transferred.
3. Turn on two-step verification as soon as you regain control, review the list of devices connected to the account and log out any you do not recognise, and check the registered email and phone, restoring anything that was changed.
4. Warn your contacts quickly through another channel. Send a warning from another account, by text message or through someone close to you: "My account has not been under my control since such a time; do not transfer any money or send any code." Keep a copy of this warning and its timing; it later serves as evidence of your good faith.
5. Use the platform's reporting tool for the compromised or impersonating account, ask your contacts to report it as well, and keep any reference numbers or confirmation messages.
6. If bank cards or e-wallets are linked to the account or the compromised email, call your bank immediately to block what is necessary.

Stage two: preserve the evidence before it disappears

Many victims start by deleting offensive messages or closing the account altogether to end the embarrassment, and the evidence is lost. It is better to preserve first and decide on deletion or closure afterwards, with advice.

• Full, uncropped screenshots showing the account name, photo and link, the date and time of each message, and the phone's status bar where possible.
• Links to accounts and posts written out as text, not just captured in an image, since the link helps the investigator approach the platform.
• The emails platforms usually send when a password, email or phone number is changed. They prove the moment control was lost; do not delete them.
• Screenshots from the phones of contacts who received the intruder's messages, with their names, numbers and willingness to testify.
• The phone numbers, bank accounts and beneficiary names the intruder asked people to pay.
• Chat exports made with the app's official feature where available, and the phone itself kept without a factory reset, as the investigator may ask to examine it.

The golden rule: do not modify, edit or annotate the files, and do not add arrows or comments. Keep the original copies as they are in a safe place, and if you want to explain them, write a separate note. Any alteration opens the door to challenges against the integrity of the evidence. For more on digital evidence, see digital and electronic evidence under Kuwaiti law.

Stage three: filing the report

Reports are usually filed with the Cybercrime Department of the Ministry of Interior, the competent police station, or the Public Prosecution depending on the seriousness and nature of the incident, and the receiving authority forwards the report to the competent investigating body. It helps to bring:

• Your civil ID and proof that the account is yours: the phone number registered in your name, the linked email, older screenshots of the account, and any advertising invoices if it is a business account.
• Your evidence file, printed and saved on an electronic medium.
• A written timeline: when you noticed the problem, when you lost control, when you notified the platform, when you warned your contacts, and when you recovered the account if you did.
• Names and numbers of other injured people, if any, and the amounts they transferred, without filing on their behalf unless authorised.
• Any suspicion about a specific person, with the reasons, avoiding accusations that lack supporting indications.

Make sure you obtain the report number or proof of filing and its date; this is the document you will need later before any authority. If the impersonator is unknown, the investigating authority is the body empowered to request data from service providers and platforms, which may take time, especially if the data is held outside Kuwait. The process is similar to the one we describe in the anonymous online seller and how to identify them.

Stage four: after the report

Follow up on the report, attend when summoned, and submit any new evidence that comes to light. If the suspect is identified and the case is referred to court, you can join a civil claim to the criminal case for compensation, or reserve your right to file a separate civil lawsuit. Choosing between the two is a tactical decision to be made with your lawyer based on the strength of the evidence and the extent of the harm.

Short document checklist

• Civil ID and proof of account ownership.
• Original screenshots and text links.
• Platform notifications about changed details.
• A copy of the warning you sent to your contacts, with its timing.
• Details of any money transfers.
• Witness names and numbers.
• The written timeline.
• Reference numbers with the platform and with the official authority.

The Hacked Account Owner's Liability: How to Distance Yourself

This is the biggest worry for many victims: what if someone files a complaint against me because an offensive message or a fraudulent request came from my account? As noted, criminal liability is personal and intent must be proven. In practice, though, when someone files a complaint with a screenshot from an account bearing your name and number, the investigator will summon you and hear your account, and you will need to show convincingly that you were not in control of the account at the relevant time.

What strengthens your position?

• An early formal report: a dated report made before the complaint against you, or shortly after it, carries far more weight than claiming a hack for the first time in front of the investigator.
• Platform notifications: a message saying "the email linked to your account was changed" or "new login from an unrecognised device" is strong technical evidence.
• A public warning: a post or message to contacts announcing the loss of the account before or at the time of the abuse.
• Different style and context: messages in language or tone unlike yours, or sent at times when you can show you were not using your phone.
• Technical examination: the investigator or court may examine your device or ask the platform for login addresses and devices used.

Can the owner be liable for negligence?

This question admits more than one view. If it is shown that the owner gave a verification code to a stranger, used a weak password, or waited a long time before reporting despite knowing the account was being used for fraud, do they bear part of the civil liability towards those harmed? One view holds that a victim should not be blamed for being deceived, and that the only fault giving rise to liability is the intruder's. Another view holds that a clear delay in reporting after gaining knowledge may be a fault contributing to the harm. In practice the matter is factual and left to the judge in each case, looking at the owner's conduct, knowledge and speed of response; it cannot be settled by a general rule. On the criminal side, negligence alone is generally not enough to establish an intentional offence.

Advice if you are summoned

If you are summoned over a message sent from your compromised account, do not go without your evidence file, and preferably attend with a lawyer. Give your account calmly and in sequence, and hand over a copy of any earlier report. If you have not reported yet, do so immediately; delay does not establish guilt, but it weakens your position.

Hypothetical Cases

Case one: the verification code that ended everything

A woman received a message from a number displaying her friend's photo, saying a code had been sent to her "by mistake" and asking her to forward it. She did, and minutes later her account was logged out of her phone. That evening her aunt called asking about the money she had requested "for an emergency," which the aunt had already transferred. What helps here? Starting recovery from the app, immediately warning her family from her husband's phone, saving a screenshot of the first message requesting the code, and then filing a report together with her aunt, who is the victim of the fraud. The bank account that received the money is the starting point for tracing the culprit. The woman is not criminally liable for messages she did not write; her civil position regarding sharing the code might be discussed, but that is for the court to assess if it is raised at all.

Case two: a home business loses its account

The owner of a home business selling through an account with thousands of followers discovered that the registered email and phone had been changed, and the account began posting "offers" and requesting prepayments. Meanwhile some customers complained about the owner personally. The safest course: report the compromise to the platform as a business account, announce it from alternative accounts and the customer channels already known, and file an early formal report with proof of ownership of the business. Then deal transparently with affected customers while keeping their names and transfers, which are useful both to the investigator and to a later compensation claim against the culprit.

Case three: a fake account in an employee's name

An employee discovered a new account with his name and photo, adding his colleagues and sending them offensive remarks about their managers. His real account was never hacked, but impersonation is clearly present. He should save the fake account's link, screenshots of it and of the messages his colleagues received, inform his employer in writing that the account is not his, report it to the platform, and file a formal report. If the impersonator is identified, the employee may claim compensation for the harm to his professional reputation, and the managers targeted retain their right to complain against the real perpetrator rather than against him.

Quick Comparison: Hacking, Impersonation and Related Offences

• Account hacking: unauthorised entry into an existing account, often with changes to its details to lock out the owner. The primary victim is the account owner.
• Impersonation through a fake account: no entry into your account, but a new account in your name and image to mislead others. The victims are you and anyone deceived.
• Defrauding your contacts: using the hacked or fake account to obtain money. The victim is whoever paid; you are a victim of the hacking and impersonation.
• Extortion: threatening to publish private content the intruder obtained in order to get money or a benefit. A more serious offence with its own path; see the extortion article.
• Insult and defamation: publishing offensive statements through the account. If aimed at you, you are the victim; if aimed at others, you must show you had no connection with it.
• Buying an account or taking it under a sham contract: a mixed contractual and criminal matter, distinct from pure hacking.
• A deceased person's account: access by the heirs is governed by its own considerations; see digital inheritance and online accounts after death.

Frequently Asked Questions

Do I need to report to the police if I recovered my account within the hour?

Not every brief compromise requires a formal report. But if messages asking for money were sent, offensive content was published, or the intruder accessed sensitive content that could be exploited later, a report protects your rights and fixes the date of the incident. A report you never need does less harm than one you filed too late.

Is a screenshot alone enough evidence?

A screenshot is admissible in principle, but its weight increases with the text link, platform notifications, testimony from recipients, and the possibility of examining the device. The judge decides how far to rely on it, especially if the other side disputes its authenticity.

Can I find out who the intruder is myself?

Self-tracing, confronting a suspect or trying to access their accounts is not advisable, as it could turn into an offence committed by you. The competent authority is the one empowered to request data from platforms and service providers through lawful channels.

The platform has not responded to my recovery request. What now?

Keep using the platform's official channels and keep proof of your attempts, announce to your contacts that the account is not under your control, and file the formal report. Failing to recover the account does not stop you from protecting yourself legally; it makes the report even more important.

Should I publicly name the person I suspect?

No. Warn people about the account and the messages coming from it, but do not publicly name an individual before the investigation establishes their involvement, or you may face a defamation complaint yourself if you are wrong. Put your suspicions and reasons in the formal report only.

My friend paid the intruder thinking it was me. Do I have to repay him?

As a rule, the person obliged to return the money is the one who obtained it by fraud, not the account owner who neither benefited nor participated. Particular questions may arise if serious fault by the owner is shown, which is for the judge to assess; most often personal relationships are resolved amicably while cooperating in the report against the culprit.

Is it different if the intruder is a relative or former spouse?

Being a relative does not make access lawful where permission was absent. The relationship may influence how the circumstances are assessed, or the possibility of settlement or withdrawal depending on the offence, but it does not erase the act. Where family disputes are ongoing, the incident may overlap with them and needs careful handling.

Can I withdraw the complaint later?

The effect of withdrawal depends on the nature of the offence. For some offences prosecution depends on the victim's complaint and withdrawal has an effect; others involve a public right and do not end with withdrawal. Where there are several victims, such as someone who was deceived into paying, your withdrawal does not affect their rights.

Can I claim compensation even if I lost no money?

Yes. Compensation is not limited to financial loss; it also covers moral harm arising from damage to reputation, standing and privacy, and the distress and embarrassment caused among your contacts. You must prove the elements of that harm, and the court assesses the amount.

What if the impersonator is outside Kuwait?

Reporting in Kuwait remains possible and useful because the harm fell on someone living there through accounts used there. Reaching and prosecuting the culprit depends on international judicial cooperation and the availability of their data, which can be a long process. Either way, the report remains evidence that you were not connected to what the account published.

Should I delete the account permanently after recovering it?

Do not rush. Preserve the evidence first and decide afterwards. Deleting the account may erase content you need and may prevent the investigator from obtaining useful data. It is usually better to secure the account, review its contents, and decide after taking advice.

Does two-step verification protect against every compromise?

It reduces the risk considerably but does not eliminate it, especially if the owner is tricked into handing over the code. The most important rule is never to share any code you receive with anyone, however close they are or however convincing their message, and never to open links that ask you to enter your login details.

Conclusion

Account takeovers and impersonation are no longer rare; they have become one of the most common problems people face, and the consequences can go beyond embarrassment to financial loss for your contacts, a complaint against you for something you did not do, or damage to your professional reputation. Kuwaiti law provides clear tools to protect you, chiefly the Law on Combating Information Technology Crimes and the rules of civil liability.

These tools work only as well as the victim's speed and evidence allow. The first hour of recovery and warning, and the first days of preserving evidence and reporting, make the difference between a victim who easily establishes innocence and pursues the culprit, and one who ends up defending messages they never wrote. Preserve, do not alter, report early, and do not accuse anyone publicly without proof.

If you find yourself in this situation, whether as the owner of the compromised account, as someone harmed by its messages, or as someone summoned over what your account published, an early review of your documents helps choose the right path: a report, a civil claim, or a defence. Our team at Yumnaak Law Firm will be glad to help you with that.

Legal Notice

This article is for general awareness and does not constitute legal advice or a substitute for consulting a qualified lawyer after reviewing your case documents. The technical steps mentioned are general, and the reference for them is each platform's official help pages. Legislation may be amended, and outcomes depend on the facts of each case and the assessment of the investigating authorities and the competent court.

To reach the firm, visit our Contact Us page, or book an in-office appointment through the Book an Appointment page.