Quick answer: If you cannot recover your social media account through the platform's recovery flow, the next stage is collecting evidence and the legal process. What to do, in order: document the incident, meaning take screenshots and if possible screen recordings, with date and time, of change notification emails, unfamiliar login alerts and fake messages sent from the account; preserve them in original form. Then file a criminal complaint with the prosecutor's office or the police cyber crime unit; account takeover is a crime under unlawful access to an information system and seizure of data. If harm has occurred, a civil suit for material and moral damages can be filed. If personal data was affected on a corporate account, a data protection notification should also be evaluated. If evidence is preserved original and time stamped, its admissibility in court increases.

Sometimes the platform's recovery flow yields no result: the attacker may have changed all recovery information, identity verification may have failed, or the request may have gone unanswered. At this point the goal is less about recovering the account and more about limiting harm, holding the perpetrator accountable and protecting future rights. This article gives the evidence and legal process to follow when the account cannot be recovered. For recovery steps, see the first hour emergency response guide.

What to do when it cannot be recovered

Step Purpose Channel
Evidence collection Preserve the incident original Screenshot, screen recording, email
Criminal complaint Hold the perpetrator accountable Prosecutor, cyber crime unit
Damages evaluation Remedy the harm Civil suit
Data protection notification Compliance, corporate account Data protection authority
Reputation and communication Limit harm Warning through an official channel

The essence of this table: even if you cannot recover the account, properly collected evidence is the basis both for holding the perpetrator accountable and for remedying harm.

Collecting evidence

The basis of the legal process is evidence, and the value of evidence depends on preserving it original and time stamped. Document, with date and time, change notification emails, unfamiliar login alerts, fake messages sent from the account, and the statements of any defrauded people. Alongside a screenshot, take a screen recording if possible; keep the full header information of the emails. How evidence is collected and preserved directly determines its admissibility in court; we detailed these principles in the digital evidence and chain of custody and admissibility of digital evidence in court articles.

Criminal complaint

In Turkey, the unauthorized takeover of an account is a crime under the Penal Code as unlawful access to an information system and seizure of data. You can file a criminal complaint with the Chief Public Prosecutor's Office or the police cyber crime unit. Attach the evidence you collected to your petition; the device and location information in login alerts guide the investigation. If your contacts were defrauded through the account, this is a separate fraud offense and the harmed people can also file a complaint; in such cases the bank and complaint steps in the I was defrauded online, what to do guide apply.

Damages suit

If harm has arisen from the takeover, for example reputation loss, commercial harm or defrauded amounts, a civil suit for material and moral damages can be filed against the perpetrator. This is evaluated within the Code of Obligations tort and damages framework. If who the perpetrator is is determined through the investigation, the damages claim becomes concrete; so the criminal investigation and the damages suit often run together.

The data protection dimension on a corporate account

If the compromised account belongs to an organization and customer messages or personal data were accessed through it, the incident involves a data breach. In this case notification to the data protection authority within 72 hours should be evaluated; for details, see the 72 hour breach notification guide. If affected people suffered harm, a data protection damages suit process may also come up. We gathered the holistic path for corporate takeover in the corporate social media account takeover article.

Digital forensics support

In complex incidents, for example when the perpetrator must be traced or the evidence must be reported to court standard, the support of a digital forensics expert strengthens the process. The expert preserves the evidence original with hash verification and reports it in a format the court will accept; you can find how this process works in the digital forensics process and chain of custody article. The goal is for the collected evidence to be technically sound and legally usable.

The KAOS and DSET approach

DSET provides evidence collection and digital forensics support in account takeover incidents. Our local AI engine KAOS collects the technical traces of an incident and reports every finding with a working proof, without false positives; our digital forensics team turns this evidence into a report to court standard. The goal is that even when you cannot recover the account, holding the perpetrator accountable and remedying the harm rest on a solid basis.

Frequently asked questions

If I cannot recover my account, how do I hold the perpetrator accountable? With the evidence you collected, file a criminal complaint with the prosecutor's office or the police cyber crime unit. In Turkey the unauthorized takeover of an account is a crime under unlawful access to an information system and seizure of data. The device and location information in login alerts guide the investigation; so preserving evidence original and time stamped is critical.

Is a screenshot admissible as evidence in court? A screenshot is evidence but its value depends on how it was collected and preserved. Evidence that is original, time stamped, supported if possible by a screen recording, and with email headers kept, increases admissibility. In complex incidents a digital forensics expert preserves evidence with hash verification and reports it to court standard.

How do I recover my loss? If the takeover caused harm, you can file a civil suit for material and moral damages against the perpetrator. If the criminal investigation determines the perpetrator's identity, the damages claim becomes concrete; so the criminal and civil processes often run together. If it is a corporate account, the data protection dimension is also evaluated separately.

Sources

For evidence collection, a digital forensics report and preparation for the legal process in an account takeover incident, contact DSET. We provide digital forensics and security consulting from our Ankara Hacettepe Teknokent laboratory.