Hacked Demat or Trading Account in India? What to Do (2026)

Quick answer: do these in order, the first two within minutes. (1) Ask your broker, through the freeze or block route it publishes, to cut online access to your trading account and cancel pending orders. (2) Ask your depository participant (DP) to freeze your demat account for debits. (3) Complain to your broker in writing and keep every record. If money has left a bank account, also call 1930 and file on the National Cyber Crime Reporting Portal. If the broker does not fix it, you can escalate to the stock exchange, to SEBI SCORES (within one year of the event) and to the SMART ODR portal. SEBI’s rules make brokers keep proof of who placed an order, but no official text we read promises that you will be repaid.

What to do in 3 steps

1. Block access and freeze the demat. Use the broker’s own freeze or block option (below) and ask your DP to freeze the demat account for debits. Do both. If anyone contacts you about the incident, use only the contact details on the broker’s own website or app.
2. Change credentials and check the money trail. SEBI’s investor page says never to share your online account password and to change passwords frequently. Our suggestion: change your trading, email and phone-account passwords from a device you trust. Check the bank accounts and UPI apps linked to the trading account for movements you did not make. If funds left a bank account, tell the bank at once, call 1930, and read our UPI first-30-minutes guide and bank fraud help for India.
3. Complain in writing and save the evidence. Email the broker’s designated grievance address or compliance officer, list the disputed trades, say you did not place them, and ask for the order-placement records SEBI requires brokers to keep. Keep the sent email, any reply and screenshots.

Block the trading account

SEBI’s circular of 12 January 2024 (SEBI/HO/MIRSD/POD-1/P/CIR/2024/4) says investors at times notice suspicious activity in their trading accounts and that a blocking facility was needed, as already exists for ATM and credit cards. Its text now sits in para 50 of SEBI’s Master Circular for Stock Brokers of 17 June 2025. The Brokers’ Industry Standards Forum, under the stock exchanges, then laid down a framework, which NSE circulated on 8 April 2024 (NSE/INSP/61529). In plain terms:

• A broker offering internet or mobile trading must give you at least two ways to ask for a freeze, such as email from your registered email ID, SMS from your registered mobile number, a phone or IVR line, a chatbot, or its app or website. It must publish the policy, modes and timelines on its website.
• If it gives an email address for this, it should be a dedicated one named stoptrade@ followed by the broker’s domain. Check the exact address on the broker’s own website, not in a message someone sent you.
• For a request received during trading hours (or in the 15 minutes before trading starts), the broker must acknowledge it and block online access within 15 minutes. After hours, it must do so before the next trading session. The framework planned to shorten the 15-minute limit after a six-month review; we found no later exchange circular doing so, so read your broker’s current policy.
• The broker must cancel pending orders, message your registered mobile and email, and within one hour of freezing send details of any open positions with expiry information.
• It checks the request came from you: from your registered number or email, or, if from elsewhere, with two-factor authentication. It must validate your request again before switching access back on.

This blocks online access. Trades already executed are a matter for the complaint process below.

Freeze the demat account

SEBI’s January 2024 circular notes that a voluntary freeze for demat accounts was already available. The depositories describe it like this:

• NSDL. Freezing suspends further transactions from the depository account until it is de-frozen. An account at a DP can be frozen if the DP receives a written instruction in the prescribed form from the client, and de-frozen the same way (NSDL account maintenance). If your DP subscribes to SPEED-e, NSDL’s online service, and you use it with an e-token, you can also freeze online, by “suspending for debit” or “suspending for debit and credit”, and the DP cannot undo that freeze (NSDL SPEED-e page and SPEED-e FAQs).
• CDSL. In CDSL’s operating instructions for DPs (September 2026 edition), the holder can freeze the account for debits, for credits or for both. The holder submits a Freeze Request Form to the DP, which records it and sends a signed acknowledgement (CDSL DP operating instructions, chapter 13).

A freeze also blocks your own transfers until you lift it. We found no official deadline for a DP to act on a freeze form, so ask for the acknowledgement and note the time.

If money moved: 1930 and the cybercrime portal

The Ministry of Home Affairs says the National Cyber Crime Reporting Portal (cybercrime.gov.in) lets the public report cyber crimes, the Citizen Financial Cyber Fraud Reporting and Management System (CFCFRMS) was launched in 2021 for immediate reporting of financial frauds and to stop money being siphoned off, and the toll-free helpline 1930 helps people lodge online cyber complaints (PIB, 22 July 2026). A June 2026 release says CFCFRMS helps block fraudulent transactions through the banking network, raising the chance of securing funds (PIB, 17 June 2026). See also our India cyber agencies directory.

How to complain: the ladder

SEBI’s rule is to take the grievance to the entity first. If that fails, you can use SCORES, and then the SMART ODR portal for conciliation and arbitration (SEBI’s ODR master circular, para 11).

Step	Where	What the official page says	Time limit printed
1	Your broker: its investor-grievance email, then the compliance officer, then the CEO, partner or proprietor	SEBI requires brokers to keep an email ID for investor complaints and show it on their website. SEBI’s model notice lists the compliance officer first, then the head of the firm.	Broker “will strive” to resolve within 21 days of receipt (SEBI’s Investor Charter for stock brokers)
2	The exchange where your broker is a member (SEBI’s notice names NSE, BSE and MSEI)	NSE’s Investor Service Cell handles complaints against trading members, including “execution of trades without consent”. NSE says to file on SMART ODR or SCORES, or by email or letter to the nearest investor service centre. NSE toll-free: 1800 266 0050 (9:30 AM to 5:45 PM, Monday to Friday). BSE’s complaint page likewise points to SCORES, the ODR portal or a letter to its nearest investor service centre.	None stated on the NSE pages we read
3	SEBI SCORES (scores.sebi.gov.in) or the SCORES app	Register with PAN and contact details, pick the entity, upload documents. The entity files an Action Taken Report. You can ask for a first review (by the designated body or exchange), then a second review by SEBI. SEBI toll-free: 1800 22 7575 or 1800 266 7575, 9 a.m. to 6 p.m. on all days except declared holidays (SCORES FAQ).	Lodge within 1 year of the cause of action. Entity replies in 21 calendar days. Ask for each review within 15 days of the reply.
4	SMART ODR (smartodr.in)	Online conciliation, then online arbitration if that fails. The exchange or depository first reviews the matter to try to settle it.	Review 21 days; conciliation 21 days (extendable by 10); arbitration 30 days (extendable by 30). Filing must fall within the applicable law of limitation.

• SEBI’s investor page says SCORES does not treat anonymous, incomplete or unspecific complaints, or allegations without supporting documents, as complaints. Documents go up as PDF files of up to 2 MB. The SCORES home page says grievances emailed to SEBI addresses will not be attended to.
• SEBI’s SCORES circular of 20 September 2023 says you can go to ODR or civil remedies at any time, and that opting for ODR while a SCORES complaint is pending closes the SCORES complaint. It calls SCORES a facilitation platform; disputes needing a ruling on facts or law go to ODR or the courts. Choose the order deliberately.
• NSE says its cell does not take up claims for notional or opportunity loss.

What the rules say about unauthorised trades

These are SEBI texts, not our opinion, and not legal advice.

• Brokers must keep proof of who placed an order. SEBI circular CIR/HO/MIRSD/MIRSD2/CIR/P/2017/108 of 26 September 2017, effective 1 January 2018, first required brokers to execute client trades only after keeping evidence that the client placed the order, such as a signed record, a phone recording, an email from the authorised address, an internet-order log, an SMS record or another legally verifiable record. It and a 30 November 2017 clarification were replaced by a consolidated circular of 22 March 2018 (SEBI/HO/MIRSD/DOP1/CIR/P/2018/54).
• Where the rule sits now. The requirement is para 35 of SEBI’s Master Circular for Stock Brokers of 17 June 2025, which cites the March 2018 circular. It says that when a dispute arises the broker shall produce these records for the disputed trades. In exceptional cases such as technical failure, other evidence such as your post-trade confirmation may also be considered. Brokers must keep the records for at least the period in which arbitration accepts complaints (currently three years), or until final resolution if a dispute has been raised. The 2017 wording that put the “burden of proof” on the broker is not in the current text.
• Missed freeze deadlines. Under the exchange framework above, a broker that fails to block access within the prescribed time is responsible for trades executed from the time it received the request until access is blocked.

What we did not find: any SEBI or exchange text saying a broker is automatically liable for every trade made through your login. A broker’s log may show the order came through your credentials, and who bears that loss is for the grievance process, ODR or a court. Do not assume either outcome.

Build your evidence

• SEBI’s Do’s and Don’ts page advises keeping signed documents, statements, contract notes and payment records, and insisting on a contract note or confirmation memo within 24 hours of a trade. NSE’s investor advice says to report any discrepancy to the broker in writing straight away.
• Our suggestions: tabulate each disputed trade (date, time, scrip, quantity, price, order number); screenshot login alerts and OTPs you did not request; export the trade book and ledger; note when you spotted the problem, asked for the freeze and got an acknowledgement; and ask the broker in writing for the SEBI-listed order records for those trades.

Can you get your money back? Honest odds

• No official promise. The pages we read describe how to complain and what brokers must do, not a guaranteed refund. Outcomes depend on facts such as how the intruder got in and what the records show.
• Speed helps most (our reading). Both the broker’s responsibility after a missed freeze deadline and bank-side blocking depend on how quickly you report.
• National numbers are sobering. PIB (22 July 2026) says that for FY2023-24 to FY2025-26 cyber fraud complaints on the portal reported more than Rs 56,087 crore, about Rs 9,079 crore was marked as lien, and more than Rs 206 crore was refunded. Our arithmetic: refunds were well under 1% of the amount reported. These figures cover all cyber fraud, not only trading accounts.
• Arbitration is binding. NSE says an arbitration award is binding on both parties.

Prevent a repeat

• Never share credentials. NSE advises not sharing your login ID, password, OTP or TPIN with anyone, including broker employees and authorised persons.
• Keep your mobile number and email current. SEBI says to tell your broker and DP when they change. Because SIM cards can be ported to other providers, it suggests one mobile number for all your accounts, calling it the key to important transactions.
• Read the alerts. SEBI lists regular checking of the exchange’s daily SMS and email about your trades, and the monthly funds and securities statements, as a habit.
• Second login factor. SEBI’s master circular for brokers says two-factor authentication for login may be implemented for internet orders. Our suggestion: switch on whatever second factor your broker offers.
• Pay brokers only on verified UPI IDs. SEBI’s circular of 11 June 2025 created UPI IDs whose handle is “@valid” followed by the bank’s name (SEBI’s example: @validhdfc) for payments to registered intermediaries, with a thumbs-up-in-a-green-triangle icon, available to investors from 1 October 2025 and optional for them. SEBI Check verifies UPI IDs and intermediaries’ bank account details.

Common questions

Should I go to SCORES or ODR first?

SEBI’s ODR master circular sets the usual order as broker, then SCORES, then ODR, but also allows ODR at any stage if the broker did not resolve the issue. Remember that opting for ODR closes an open SCORES complaint.

What if I was lured into a fake trading app instead?

That is a different problem: the platform may not be a registered broker, so the broker route above may not apply. Start with 1930, then see our investment scams overview.

Official complaint routes for the main stock brokers, exchanges, depositories and crypto platforms, each read on the organisation’s own page, are in our Investment Fraud Help directory (India).

Related guides: Bank account frozen after a crypto P2P trade, Lost money to a fake trading app or stock-tip group.

We are an independent news site, not a broker, regulator, police or recovery service, and this is general information, not legal or investment advice. Details were checked against official pages on 23 October 2026 and can change. We do not name or blame any broker here. If you have been targeted, you are not alone: see our country-by-country cybercrime help hub for step-by-step reporting and recovery guides.