Hacked Account or Phone Complaint
The account owner wakes up locked out, while friends receive requests for money or photos he never sent. Or a phone goes in for repair and its photos turn up elsewhere days later. The office of Ali Barakat in al-Yarmouk, Baghdad, sets out the legal options in these situations.
What is punishable
Penal Code No. 111 of 1969 predates the internet and has no specific provision for simply entering another person's account. The investigation therefore does not stop at the intrusion; it asks what the intruder did. Reading chats and revealing them to others to someone's harm falls under article 438(2). Publishing private photos falls under article 438(1). Threatening the owner with exposure in exchange for money brings in articles 430 and 452. Asking friends for money while posing as the owner is fraud by false name under article 456. Posting harmful material about others in the owner's name may be defamation or insult under articles 433 and 434. If the intruder was a repair technician who accessed the device through his work, article 437 applies.
First steps
Before complaining: try to recover the account through the platform's own tools, change passwords for email and linked accounts, and turn on two-step verification. Tell friends from another account or by group message that the account was hacked; this prevents new victims and fixes the date you learned of the intrusion. Then preserve everything showing what the intruder did: screenshots from friends who received messages, and email alerts about password changes or log-ins from new devices, with their dates.
Where and how to complain
Article 1 of Criminal Procedure Code No. 23 of 1971 allows a complaint to the investigating judge, an investigator or a police station officer. Article 53 gives jurisdiction to the place where all or part of the offence or any result occurred, and to the place where the victim was, so the intruder's location need not be known. The complaint should state specific facts: when access was lost, what was posted or sent, who received it, and what harm resulted.
Complaints and deadlines
If what the intruder did was disclosure of secrets, threats, defamation or insult, article 3 requires the victim's complaint and article 6 sets a three-month deadline from learning of it. Defrauding friends needs no complaint, and each friend who lost money may complain as a victim in his own right.
Identifying the intruder
Tracing who is behind an account or log-in address is technical work done on judicial order. Article 74 of the Criminal Procedure Code lets the investigating judge order in writing anyone holding items or papers useful to the investigation to produce them by a set date. Article 69 lets him appoint an expert on matters connected with the offence, such as examining the phone and identifying traces of access. See Electronic evidence before the investigating court.
Phones left for repair
If a phone's photos surface after it was left at a repair shop, keep the drop-off receipt or any message proving the date, and ask the investigating judge to have the shop's devices examined. Article 437 punishes disclosing a secret learned through one's trade, and article 438 punishes the publication itself. If the photos are used for extortion, see Online threats and extortion.
What to avoid
Trying to hack the intruder back, or publicly naming suspects without proof, can turn the victim into the subject of a defamation or insult complaint. Leaving identification to the investigation is the safer course, and any public notice should say only that the account was hacked, without accusing anyone.
Legal basis and sources
- Penal Code No. 111 of 1969 (Official Gazette No. 1778 of 15/12/1969) — Articles 430, 433, 434, 437, 438, 452 and 456
- Criminal Procedure Code No. 23 of 1971 (Official Gazette No. 2004 of 31/5/1971) — Articles 1, 3, 6, 53, 69 and 74
Frequently asked questions
Is hacking an account a crime in Iraq?
There is no standalone offence for mere access, but what the intruder does next, revealing, publishing, threatening or defrauding, is punishable under the Penal Code.
Must I know who the intruder is to complain?
No. A complaint can be made against an unknown person, and identification follows on the investigating judge's order and through technical expertise.
My friends sent money to the intruder. Who complains?
Each friend who paid is a fraud victim and may complain himself; the owner complains about what happened to him.
Related topics and articles
- 01Electronic FraudOnline fraud under Iraqi law: article 456 of the Penal Code, fake sellers, verification codes, mule accounts, territorial jurisdiction and recovering money.
- 02Publishing Private Photos and ChatsPublishing private photos and chats without consent under article 438 of the Iraqi Penal Code: private life, disclosing messages and calls, professional secrets, the complaint and compensation.
- 03Electronic Evidence before the Investigating CourtHow screenshots, chats and recordings are presented to an investigating judge in Iraq: the court's conviction, technical expertise, production orders, electronic document conditions and preserving evidence.
- 04Online Threats and ExtortionHow the Iraqi Penal Code handles threats and extortion by phone and social media: articles 430, 431, 432 and 452, the complaint and its deadline, preserving evidence, and reconciliation.
- 05Online Defamation and InsultDefamation, insult and smearing on Facebook, TikTok and WhatsApp under articles 433 to 436 of the Iraqi Penal Code: the difference, publicity, proving truth, the three-month complaint and compensation.