You wake up in the morning and Snapchat asks you to log in again, but your password does not work. In your email there is a message from 3 a.m.: “The email linked to your account has been changed.” On your phone there are three messages from friends asking why you are sending them an urgent request to borrow money. What you do in the first hour decides how much others will lose, and how much evidence you will keep.
The short answer: start by securing your email and phone number, then recover the account through the platform's official channels, and file a report if messages were sent in your name or any of your content was leaked. Unlawful access to your account is a crime under the Anti-Cyber Crime Law. In its simple form, the maximum is one year in prison and a fine of SAR 500,000; it rises to four years and SAR 3 million if the hacker accessed the account to delete, leak or republish your private data.
What should you do in the first hour after a hack?
- Secure your email and phone number first, because they are the key to recovering all your accounts. Change your email password and turn on two-step verification.
- Take screenshots of the notices about the changed email or password before any other step.
- Start recovery only through the platform's official channels.
- Warn your contacts through another channel: the account is not in your hands, and they should not transfer anything.
- Ask those who received messages from your account to screenshot them in full with the date.
Do not give the verification code to anyone, and do not pay someone who advertises that he “recovers stolen accounts”. Many of them use the code you give them to take another of your accounts, or your email itself.
You got the account back. Is it over?
Recovering the account through the platform gives you back control of it. But it does not bring back photos that were copied, does not reveal who did it, and does not compensate your friend who transferred money. So once the account is back, do not treat the matter as closed until you review what happened in it: were chats deleted? Were messages sent in your name? Was anything private published?
Someone hacked a female employee's Snapchat account and sent twenty of her friends a request to borrow SAR 2,000. Two of them transferred SAR 4,000 in total to an IBAN in the name of a person they did not know. She recovered the account the same day, but the money did not come back.
Here the account owner files her report about the hacking, and each friend who transferred money files his own report with the transfer receipt and a screenshot of the message he received, because each of them has his own private right in his money.
What is the penalty for hacking an account in Saudi Arabia?
The Anti-Cyber Crime Law defines unlawful access as a person deliberately accessing a computer, website, information system or network that he is not authorised to access (Article 1). The penalty differs according to what the hacker did after access:
| Act | Provision | Maximum penalty |
|---|---|---|
| Unlawful access to a website, changing it, or taking over its address | Article 3(3) | 1 year in prison and SAR 500,000 fine, or one of them |
| Access to threaten or blackmail the account owner | Article 3(2) | 1 year in prison and SAR 500,000 fine, or one of them |
| Access without justification to bank or credit data | Article 4(2) | 3 years in prison and SAR 2 million fine, or one of them |
| Access to delete, leak, change or republish private data | Article 5(1) | 4 years in prison and SAR 3 million fine, or one of them |
So a hacker who published your private photos or deleted your chats may face Article 5, not only Article 3. The figures in the table are ceilings, and the court decides the penalty within them. Anyone who helped or incited is punished up to the maximum if the crime occurred (Article 9), and anyone who attempted but did not complete it, up to half (Article 10).
If the account was used to ask your contacts for money, the act may also be fraud. The Anti-Fraud and Breach of Trust Law punishes fraud with up to seven years in prison and a fine of up to SAR 5 million, and the harsher penalty applies if the act is also a crime under another law (Articles 1 and 9).
A store account and a former employee
One of the most complicated cases: an employee or marketer managed a store's account with the owner's permission, then the relationship ended and he changed the password and refused to hand it over. The investigation will ask: did his permission really end? Who owns the account under the contract? What did he do after his permission ended? Earlier permitted access does not justify use after permission is withdrawn, but a dispute over ownership of an account without a clear contract may be more a civil dispute than hacking. So write in the contract of anyone who manages your business's accounts that the account belongs to the business, and that he must hand it over when the relationship ends.
How do you report a hacked account in Saudi Arabia?
The Law of Criminal Procedure requires criminal investigation officers to accept reports and complaints for all crimes (Article 27), so a police station is available, and so is the Kollona Amn (“We Are All Security”) app, which the Human Rights Commission urged people to use to report social media account hacking, blackmail, defamation and fraud; it lets you attach photos and videos. Attach proof that the account was yours before the incident, the change notices, and the messages received by the people who were asked for money. Your complaint counts as a claim for your private right unless you expressly waive it (Article 29).
This is general information based on the official Arabic texts of Saudi laws, which prevail over any translation. It is not legal advice for your specific case.
Practical solutions for both sides
If your account was hacked:
- Secure your email and phone number before any attempt to recover the account.
- Screenshot every notice and every message sent in your name before it is deleted.
- Do not try to access the account of the person you suspect; that would be unlawful access by you.
- If it is a business account, collect proof that the business owns it and of the powers of those who managed it.
If you are accused of hacking:
- If you managed the account under authorisation, keep proof of that authorisation, its limits and when it ended.
- Hand over the account and passwords to the owner when the relationship ends, and do not use them as pressure in a money dispute.
- Do not delete anything from the account or your devices after you learn of the complaint.
- If the account owner owes you money, claim it in a separate case, not through the account.
If your account or your store's account was hacked, or you were summoned in a case like this, send the notices and screenshots on WhatsApp and we will help you organise the report or the response.
Need advice on your own case?
Every case turns on its own facts and documents. Send us a short summary and we'll arrange a session with a licensed Saudi lawyer who will tell you clearly where you stand.
Frequently asked questions
Is anyone who accesses my account without permission punished?
If the access was deliberate and without authorisation, it is unlawful access as defined in Article 1, and the penalty depends on what was done after access.
What is the penalty for hacking an account and publishing photos?
If access was to leak or republish private data, Article 5(1) punishes it with up to four years in prison and a fine of up to SAR 3 million, or one of them.
I got my account back. Do I still need to report?
Yes, if there was a leak, fraud messages or threats. Recovery does not fix what happened and does not reveal who did it.
A former employee refused to hand over the store account. Is that hacking?
It may be, if his permission ended and he continued using it. A contract that sets ownership of the account is your strongest evidence.
General information, not legal advice. The official Arabic texts of Saudi laws prevail over any translation. Disclaimer