Online Fraud in Pakistan: 11 Urgent Steps Before Your Money Is Gone

Online fraud does not always begin with a mysterious hacker. It may begin with a WhatsApp message from a “relative,” a cheap product advertised on Facebook, a call from a “bank officer,” a fake job interview, or an investment group promising daily profit. One hurried click can expose a password, while one trusted voice can persuade a family to transfer its savings.

The victim often feels ashamed after discovering the deception. That shame helps the offender, not the victim. If online fraud has happened, the right response is to act quickly, preserve the digital trail and report the incident through the correct channels. This guide explains the warning signs, Pakistan’s current complaint system, the relevant law, the evidence that matters and a recent Sindh High Court lesson in simple English.

Quick Answer: What Should You Do First?

In an online fraud emergency, if money has just left your bank account or mobile wallet, immediately call the bank or wallet provider through its official helpline. Ask it to block further access, register a fraud complaint and consider a hold, recall or trace of the disputed transfer. Obtain a complaint reference number. Recovery is never guaranteed, but delay can reduce the available options.

At the same time, preserve the complete chat, advertisement, profile link, phone number, transaction ID and beneficiary details. File the cybercrime complaint through the official NCCIA complaint portal, which lists 1799 as its 24/7 helpline. Report a scam number first to the mobile service provider and, where necessary, through the PTA complaint system. Contact the police or emergency services as well if there is an immediate physical threat.

Your immediate problem	First practical action
Bank, card or wallet transfer	Call the official bank or wallet helpline and obtain a reference number
Hacked account or exposed password	Use a clean device to change credentials, end other sessions and enable two-factor authentication
Digital deception or identity misuse	Preserve evidence and submit a written NCCIA complaint
Fraud call or SMS number	Report it to the operator, then PTA if required
Threat to life, home or physical safety	Contact local police or emergency services immediately

What Is Online Fraud?

Online fraud is deliberate deception carried out through the internet, a phone, an app, email, social media, an online marketplace or another digital system to obtain money, property, account access or personal information. Fortinet’s internet-fraud explanation treats phishing, identity theft, spoofed websites and malicious software as common forms of the wider problem. A general internet-fraud reference also correctly explains that the expression covers a range of acts rather than one single offence.

That distinction matters in Pakistan. The words “online fraud” describe the harm, but investigators and courts examine the exact conduct. A fake payment receipt may involve electronic forgery. A fraudulent investment message may involve electronic fraud and cheating. Use of another person’s CNIC or account may involve identity misuse. Hacking, blackmail or money laundering may add further offences.

Not every failed online purchase is automatically online fraud. A late delivery, poor product or genuine business failure may create a consumer or civil dispute. Criminal fraud normally requires proof of deception and dishonest intention, not merely disappointment after a transaction. State the facts honestly and let the competent authority determine the legal provisions.

Why Online Fraud Can Trick Intelligent People

The psychology of online fraud is simple: scammers do not only attack computers; they attack human emotions. They create urgency so that the victim has no time to verify. They copy official logos to borrow authority. They offer an unusually high reward, threaten account closure, exploit loneliness, or tell the victim to keep the conversation secret.

The Pakistan Telecommunication Authority’s scam guidance warns that scammers target people of every background, age, and income level and may use believable stories to obtain money or personal details. Becoming a victim is not proof of foolishness. It is proof that the deception worked. The useful question is what can still be protected and proven.

11 Common Types of Online Fraud in Pakistan

The platform used for online fraud changes, but the pressure tactics remain similar. These are the schemes Pakistani users should recognise.

Scam	How the trap works	A warning sign
1. WhatsApp impersonation	A criminal copies a relative’s picture or claims to have a new number and asks for emergency money	The sender prevents a voice call or wants payment to an unrelated account
2. Fake bank, OTP or KYC call	A caller claims that an account, card or biometric record will be blocked	The caller asks for an OTP, PIN, password or remote access
3. JazzCash or Easypaisa deception	A fake receipt, reversal story or “mistaken transfer” is used to obtain money	The message screenshot does not match the balance shown inside the official app
4. Social-media shopping scam	An attractive product is offered at a deep discount and advance payment is demanded	A new page has copied reviews, no verifiable address and refuses a secure payment method
5. Investment, forex or crypto scheme	A group shows manufactured profits and promises fixed or daily returns	Returns are guaranteed, withdrawals require another “tax,” or funds go to personal accounts
6. Fake job, visa or task scam	The victim is offered easy work, overseas employment or paid online tasks	Registration, security, training or release fees are demanded before genuine verification
7. Prize, lottery or government-aid scam	A message claims that the victim has won money or qualifies for assistance	A fee or OTP is required to receive a prize never entered for
8. Romance or emergency scam	A fake relationship is built before requests for medical, travel or customs money begin	Every crisis needs money, but an in-person meeting or independent identity check never happens
9. Fake loan or recovery app	An app collects contacts and identity data, then demands unlawful charges or uses threats	It seeks unnecessary permissions and has no verifiable regulated entity behind it
10. Business invoice redirection	A supplier’s email or identity is copied and payment details are quietly changed	The IBAN changes suddenly and the request discourages a telephone confirmation
11. AI voice, video or recovery scam	A cloned voice creates a family emergency, or a “recovery agent” promises to return lost money	The caller demands secrecy, instant payment or a second fee to recover the first loss

Students are frequently targeted through fake profiles, online jobs, shopping offers and investment claims. This form of online fraud is illustrated usefully on the Prime Minister’s Youth Programme awareness page. Its complaint details refer to the former FIA Cyber Crime Wing, however, so the present NCCIA route explained below should be used for a current cybercrime complaint.

Crypto-related online fraud can look like an ordinary investment opportunity. Before handing money to a social-media trader or “account manager,” readers should understand the difference between personal trading, a regulated service and a deceptive investment arrangement in Qanooni Dastak’s guide on whether crypto is legal in Pakistan.

Online Fraud Red Flags That Should Stop a Payment

Online fraud often reveals itself through a detail that cannot be independently verified. Pause the transaction if even one important fact is doubtful. Several red flags together make the danger stronger:

• “Act in the next ten minutes or your account will close.”
• “Do not call your family, bank or employer.”
• “Share the OTP so I can cancel the transaction.”
• “Install this screen-sharing or remote-control app.”
• “Send a small fee before your prize, loan, refund or profit is released.”
• “Pay into my brother’s, agent’s or employee’s personal account.”
• “The investment is risk-free and the return is guaranteed.”
• “The QR code will receive money for you,” when scanning it actually authorises payment.
• A government or bank logo appears, but the domain, email or account title is different.
• The person becomes abusive when asked for a written contract, licence or video verification.
• A second person suddenly appears to confirm the first person’s story.
• After the loss, an unknown “officer” or “hacker” guarantees recovery for an advance fee.

No genuine bank employee needs your complete PIN, password or one-time password. NCCIA’s own financial-fraud safety page similarly tells citizens to keep PINs, passwords and OTPs private, even when the caller claims to represent a bank.

Online Fraud: Follow These 11 Urgent Steps

Step 1: Stop the Loss Without Sending a “Final Fee”

Online fraud victims should end the payment process immediately. Do not send a tax, unlocking fee, verification amount or recovery charge merely because the offender says the first payment will otherwise be lost. Do not threaten the suspect, attempt to hack the account or publicly publish unverified identity details.

If remote access is still active, disconnect the affected device from the internet. Use a different, trusted device for banking and password changes.

Step 2: Call the Bank or Wallet Provider Immediately

In online fraud involving money, use the number printed on the card, shown inside the official app or published on the institution’s real website. Tell the representative whether the transfer was unauthorised, induced by deception, made through a card, or sent to a bank or wallet account.

Ask for:

1. blocking of cards, tokens or compromised access;
2. registration of a formal fraud complaint;
3. a complaint or ticket number;
4. consideration of a beneficiary hold, recall, dispute or trace; and
5. written guidance on the documents required.

Do not rely only on “we have noted it.” Record the time of the call and the name or ID of the representative where available.

Step 3: Secure Every Connected Account

Online fraud can spread from one compromised account to several connected services. Change the email password first if that email controls password resets. Then change banking, wallet, social-media and marketplace credentials. Sign out of unknown sessions, remove unrecognised devices, disable suspicious forwarding rules and enable two-factor authentication.

If an OTP, card number or CNIC image was exposed, tell the relevant institution exactly what was shared. Do not factory-reset the affected phone before preserving evidence or receiving appropriate guidance, unless continued access creates an immediate safety risk.

Step 4: Preserve the Original Digital Evidence

For online fraud evidence, before blocking or deleting, save the complete conversation with dates, times and account details. Take full screenshots, export chats where possible, preserve voice notes and retain original emails with headers. Write down profile, post, website and payment links separately because a screenshot may not preserve the underlying address.

The strongest record shows both the deception and the transfer it caused. Readers who need a broader explanation of originals, copies, expert evidence and modern-device material can consult Qanooni Dastak’s Qanun e Shahadat Order 1984 evidence guide.

Step 5: Build a Clear Money Trail

Collect the bank statement, debit alert, transaction ID, date, exact amount, beneficiary name, bank or wallet, IBAN or account number and any fake receipt. If several transfers occurred, list each one in a table. Do not combine them into one estimated figure.

A strong online fraud money trail is often the bridge between a convincing story and legally useful evidence. It can help the bank, investigator and court see where the funds moved and why the payment was made.

Step 6: Write a One-Page Chronology

Begin with the first contact and move forward by date and time. Explain what the person represented, why you believed it, what action you took, when money or data was transferred and how the deception was discovered.

Use facts rather than labels. “On 6 August at 3:10 p.m., the account sent a bank-logo message and asked for an OTP” is more useful than “a dangerous cybercriminal attacked me.” A clear chronology makes an online fraud complaint easier to understand and verify.

Step 7: File the Complaint With NCCIA

Under the current law, the National Cyber Crime Investigation Agency is the specialised investigation agency for PECA offences. Submit the online fraud incident through the official NCCIA form, save the confirmation and keep the reference number. The form asks for identity and contact details, city, a cybercrime category and a description of the incident.

NCCIA also publishes regional office details, the helpline 1799, and helpdesk@nccia.gov.pk. A telephone call can provide guidance, but it should not be mistaken for a written complaint. For a complete screen-by-screen filing and follow-up guide, read Qanooni Dastak’s Cyber Crime Online Complaint Pakistan article.

Step 8: Report the Scam Number or Link Through the Correct Route

Report the phone number to its mobile or telephone service provider first. PTA advises citizens to escalate an unresolved scam-number report through its complaint mechanism or helpline 0800-55055. This step may help block a number or device, but PTA is not a substitute for the bank’s payment response or NCCIA’s criminal investigation.

Also use the platform’s private reporting tool for a fake page, impersonating profile, phishing advertisement or malicious shop. Removing an online fraud page can protect other users, but preserve the URL and screenshot before the content disappears.

Step 9: Use the Banking Complaint Ladder

When online fraud causes a banking loss, a cybercrime complaint and a banking complaint perform different jobs. NCCIA investigates alleged criminal conduct. The bank examines the account, transaction and its own service obligations.

The State Bank’s SUNWAI portal routes complaints involving banks, microfinance banks and development finance institutions. SBP explains that the institution is the first forum, Banking Mohtasib Pakistan is the second forum and SBP handles certain cases. The Banking Mohtasib’s current procedure says a written bank complaint should be made first; if the bank does not resolve it within 30 days, a complaint may be lodged with the Mohtasib. An immediate bank decline can also affect the route.

Keep copies, not originals, of everything submitted. Do not wait 30 days to alert the bank about a fresh fraudulent transfer; the 30-day period concerns escalation of the unresolved grievance, not the first emergency report.

Step 10: Contact Police When the Facts Require It

Some online fraud incidents develop into physical threats. Call the police or emergency service if the offender threatens violence, knows the victim’s location, attempts physical entry, abducts someone, or commits another immediate offence outside the purely digital space. Tell NCCIA about the connected police report and tell police about the cybercrime reference so that the facts are not presented as unrelated stories.

If fake profiles, threats or blackmail are connected with employment authority, a workplace complaint may exist alongside the cybercrime route. Qanooni Dastak’s Harassment Complaint Pakistan guide explains why workplace, cybercrime and ordinary criminal proceedings should not be confused.

Step 11: Track the Case and Avoid a Second Scam

Keep one file containing the bank ticket, NCCIA reference, PTA or operator complaint, platform report and police entry. Record every follow-up date. Verify the identity and official contact of anyone asking for further information.

Online fraud victims are often targeted again by people promising guaranteed recovery, arrest or account tracing for a fee. No private person can honestly guarantee the result of an online fraud investigation or the return of money. Never share an OTP, password or remote access with someone claiming to be an investigator.

FIA or NCCIA: Which Portal Is Current?

The distinction is now clear in the consolidated Prevention of Electronic Crimes Act, 2016. Amended section 29 establishes NCCIA for inquiry, investigation and prosecution of PECA offences. It also provides that the former FIA Cyber Crime Wing ceased to exist and its cases, inquiries, staff and related matters transferred to NCCIA.

The FIA general complaint form remains online and covers several FIA categories. Its continued existence does not replace NCCIA’s specialised statutory role for cybercrime. Some older awareness pages still create confusion. For example, the Punjab Women Development Department cybercrime page links to the former NR3C/FIA route. Such pages may remain useful as awareness material, but a current online fraud report should start with NCCIA’s official channels.

Which Pakistani Laws May Apply to Online Fraud?

Online fraud can engage more than one legal provision in a single event. The following table is a public-awareness guide, not a charge sheet.

Provision	What it may cover in simple words	Maximum punishment stated in the current published text
PECA section 13	Electronic forgery, including unauthentic electronic data created or altered for fraud or an illegal claim	Up to 3 years, or fine up to Rs250,000, or both; higher consequences apply to critical infrastructure
PECA section 14	Use of a system, device or data, or deception/inducement, for wrongful gain where harm is likely	Up to 2 years, or fine up to Rs10 million, or both
PECA section 16	Obtaining, possessing, transmitting or using another person’s identity information without authority	Up to 3 years, or fine up to Rs5 million, or both
PPC sections 419 and 420	Cheating by personation and cheating that dishonestly induces delivery of property	Application depends on proof of the ingredients and the established facts
PECA section 45	Court-ordered compensation for damage or loss, without destroying an additional civil remedy	Compensation is discretionary; it is not an automatic refund on filing a complaint

Amended sections 29 and 30 deal with NCCIA and investigation powers. Sections 31 and 32 provide mechanisms for preservation of specified data and retention of traffic data within the statutory process. This is why quick reporting can matter: the ordinary victim should preserve what is under his or her control, while the authorised agency can pursue data through legal powers.

A victim does not need to guess every section. Describe the deception, digital method, loss and evidence accurately. Investigators, prosecutors and courts determine the appropriate offences. False exaggeration can damage a genuine claim.

A Sindh High Court Lesson: An Allegation Is Not a Money Trail

In Usman son of Samad v. The State, Criminal Bail Application No. 2276 of 2025, decided on 7 November 2025, the Sindh High Court considered a post-arrest bail request arising from an alleged online lottery scheme and a connected money-laundering case.

The prosecution alleged that victims in Pakistan and abroad had been induced to transfer funds through online platforms and that alleged proceeds were later linked with bank transactions and a Toyota Revo. The Court did not conduct the final trial. At the bail stage, it found that the record then available did not sufficiently trace the alleged cyber-fraud funds to the vehicle or deposits through a conclusive audit trail. It granted post-arrest bail on surety of Rs500,000 and expressly said that its observations were tentative and would not control the trial.

This was not an acquittal and it did not declare lottery scams lawful. Its practical lesson is that an online fraud allegation still requires proof: serious labels and large bank figures cannot replace a connected money trail. A useful investigation needs the victim’s payment, date, transaction reference, recipient account, surrounding communication and later movement of funds to be linked through evidence.

Court point	Practical lesson for a victim
An alleged predicate offence must be connected to the claimed proceeds	Preserve the exact transfer and the deception that caused it
Bank statements alone may not explain the criminal origin of funds	Identify the victim payment, beneficiary and transaction reference
Delay may weaken the immediacy of an allegation	Alert the bank and authority promptly
Bail observations are tentative	Do not report a bail order as a conviction or final innocence

The judgment makes the evidence checklist below more than administrative paperwork. It is the chain that may connect the screen, the victim, the payment and the suspected beneficiary.

Evidence Checklist for an Online Fraud Complaint

A strong online fraud complaint should connect the deception, the payment, the suspect’s visible identifiers and every report made afterward.

• CNIC and current contact details of the complainant.
• A one-page chronology with exact or honestly approximate dates and times.
• Full screenshots showing the account, number, date, time and conversation context.
• Exported chat and the original phone where reasonably available.
• Profile username, user ID, page link, advertisement URL and website address.
• Original emails with headers and login-security alerts.
• Voice notes, call logs and the number used for contact.
• Fake invoice, payment receipt, offer letter, licence, identity card or investment dashboard.
• Bank statement, card alert, transaction ID, amount, beneficiary title, IBAN/account number and wallet details.
• Bank, wallet, NCCIA, PTA, platform and police complaint references.
• Names of witnesses and a short note of what each person personally saw or heard.
• A numbered index that explains every file without altering the original.
• A secure backup separate from the affected device.

Never crop out useful context merely to make a screenshot look stronger. Do not edit the original file, invent a witness, create a later conversation or accuse an account holder only because money passed through an account. An account may be a mule account, a compromised account or one part of a wider chain. The investigation must establish responsibility.

A Clear Complaint Format You Can Adapt

Subject: Complaint regarding online fraud through [platform] and transfer of Rs[amount]

I, [full name], CNIC [number], resident of [address], state that on [date and time] I was contacted through [phone number, account, email or URL]. The person represented that [state the exact claim]. Relying on that representation, I transferred Rs[amount] on [date/time] through [bank/wallet] to [beneficiary title and account/IBAN/wallet], transaction ID [number].

I discovered the deception when [state what happened]. The account then [blocked contact/demanded another fee/disappeared/sent threats]. I reported the transaction to [bank/wallet] on [date/time] under reference [number].

I have preserved the complete conversation, advertisement/profile link, transaction record, beneficiary details, call log and other material listed in the attached index. I request lawful inquiry, preservation and examination of relevant digital and financial records, and action according to the established facts and applicable law.

Attachments: numbered chronology, screenshots/chat export, transaction proof, beneficiary details, bank complaint, and identity document.

Keep the wording factual. Do not paste passwords, PINs or OTPs into a complaint attachment. Ask NCCIA how highly sensitive material should be delivered securely.

How to Prevent Online Fraud Before Money Moves

Use a Ten-Minute Verification Rule

Urgency is the favourite weapon of online fraud. Pause for ten minutes. Call the relative, bank, seller or supplier through a number obtained independently—not the number supplied inside the suspicious message.

Verify the Beneficiary, Not Only the Screenshot

Read the account title shown by the official banking app before authorising payment. A logo, receipt image or WhatsApp name can be copied in seconds. For a business invoice change, confirm the new account through a known telephone contact.

Protect the Keys to Your Accounts

Never share an OTP, PIN, password, card security code, recovery phrase or screen-sharing access. Enable transaction alerts, use different passwords, keep software updated and review active sessions regularly.

Verify Investments Through the Regulator

Do not treat a celebrity video, social-media group or profit screenshot as a licence. Check the legal entity, regulator, licence category, withdrawal terms and named bank account. Guaranteed returns and pressure to recruit others are strong danger signs.

Create a Family Safety Code

Families can choose a private word or question for genuine emergencies. A cloned voice may sound convincing, but it may not know the family’s private verification method.

Teach Without Shaming

Older persons, students and first-time digital users should know that reporting quickly is more important than hiding a mistake. A calm family response preserves evidence and may stop a second payment.

Frequently Asked Questions

Final Word: Shame Protects the Scammer, Evidence Protects the Victim

Online fraud succeeds when urgency defeats verification and shame prevents reporting. The safest response is calm and documented: stop further payment, alert the financial institution, secure the accounts, preserve the original evidence and submit the facts to the correct authority.

For an online fraud victim, Pakistan now has a dedicated NCCIA complaint route, while banks, SBP, Banking Mohtasib, PTA and police perform different supporting roles. Using the correct forum does not guarantee recovery, but it prevents avoidable delay and builds a record capable of being investigated.

Share this guide with parents, students, shopkeepers, employees and overseas relatives. One warning received before a transfer may protect a family’s entire savings.

Disclaimer

This article provides general legal awareness and was reviewed against publicly available material on 8 August 2026. It is not a substitute for advice on a specific case. Applicable offences, banking remedies, jurisdiction, limitation and evidence depend on the facts. Seek advice from a qualified Pakistani lawyer where the loss is substantial, identity material is compromised, threats are involved or court proceedings may be required.