Social media, email or messenger account hacked: what to do under Georgian law

What to do

1. First hours: recover the account through the platform's official form (email or phone, identity document, video selfie). Change the passwords of your email and linked phone number, sign out of all sessions, and enable two-factor protection. Warn contacts through another channel that requests for money are not from you. Do not pay the ransom.
2. Record: emails saying the password or email has been changed, with IP address and time; screenshots of the hacker's messages; ransom demands; the payment details they ask you to pay into.
3. Classification: unauthorised access to a computer system is a crime (Criminal Code of Georgia, Art. 284). A computer system is any device that processes data automatically, including a computer and a mobile phone (Art. 284). “Unauthorised” means unlawful, or access where the rights holder has not, directly or indirectly, transferred the right to this person. This matters for a former SMM manager or employee (Art. 284). Unauthorised alteration, deletion or concealment of computer data (changing a password, deleting posts) is a separate offence (Art. 286). A ransom, meaning a demand for property under threat of disclosing damaging information or destroying property, is extortion (Art. 181). Money obtained from friends is fraud, meaning property obtained by deception (Art. 180). Access or interference committed for financial gain, causing financial damage to another person, is a qualified offence (Art. 286¹). In this chapter, significant damage means damage above 2,000 lari, which is an aggravating factor (Art. 284).
4. Report to the police (Ministry of Internal Affairs) or the prosecutor's office: upon receiving information about a crime, the investigator or prosecutor must open an investigation (Criminal Procedure Code of Georgia, Art. 100). A report may be made in writing or orally, and the applicant is entitled to written confirmation of it (Art. 101). Attach the evidence and the details of the victims. Friends who transferred money file their own reports and approach their banks.
5. The account owner is a victim, not a participant in the fraud. The sooner the owner warns contacts, the fewer disputed situations arise. Keep a business page on a company account with several administrators.
6. Where to apply: platform support, then the police (Ministry of Internal Affairs) or the prosecutor's office (crime report).
7. Evidence: platform notifications about the password or email change; screenshots of the hacker's correspondence; ransom demands; payment details; testimony of deceived friends.
8. Pitfalls: paying the ransom, since access is usually not returned. Paid “recovery services” are a repeat fraud. A former SMM manager who “had the password”: without a transfer of the right, the access is unauthorised.

Be sure to check

• immediate steps to recover and protect the account, and warning contacts
• unauthorised access is a crime; a ransom is extortion; money from friends is fraud
• a report to the police or prosecutor's office and confirmation of its receipt
• what evidence to preserve