One wrong click can empty a bank account. One stolen password can expose years of private messages. One fake WhatsApp profile can damage a relationship, business or reputation before the victim understands what happened.
Cyber Crime is no longer limited to expert hackers. In Pakistan, ordinary users face hacked accounts, fake investment offers, identity misuse, online blackmail, phishing links, banking fraud, stalking, intimate-image abuse and AI-assisted impersonation.
The first question should not be “How angry am I?” It should be: what happened, what proof still exists, which law may apply, and where should I report it?
This guide explains Cyber Crime in easy English, including PECA law, NCCIA reporting, Cyber Fraud, Cyber Scams, Cyber Crime Harassment, Electronic Crimes, Internet Crimes, Computer Crime, evidence, court decisions and Cybercrime Prevention.
Table of Contents
Cybercrime at a Glance
| Question | Quick Answer |
|---|---|
| Main federal law | Prevention of Electronic Crimes Act, 2016 |
| Major later changes | 2023, 2024 and 2025 amendments |
| Current PECA investigation agency | NCCIA |
| Official complaint route | NCCIA complaint portal and reporting centres |
| Common risks | Fraud, hacking, identity misuse, stalking and blackmail |
| Evidence to save | Chats, URLs, usernames, transaction IDs and original files |
| Does every online dispute become a crime? | No |
| Does a complaint guarantee an FIR? | No |
| Does reporting guarantee money recovery? | No |
| Latest major enacted PECA amendment | Amendment Act, 2025 |
The current consolidated PECA text includes later amendments and now expressly provides for NCCIA as the investigation agency.
What Is Cyber Crime and Why Does It Matter?
Cyber Crime means unlawful conduct in which a computer, mobile phone, online account, network, information system or digital data is used as the target, the tool, or both.
If someone enters your email without authority, the account is the target. If a fake seller uses social media to take payments, technology becomes the tool.
People also search for Electronic Crimes and Internet Crimes. These terms overlap in everyday language, but criminal responsibility in Pakistan depends on the exact ingredients of the applicable law.
PECA extends throughout Pakistan and also contains extra-territorial application in specified circumstances where conduct outside Pakistan affects a person, property, information system or data located in Pakistan.
Read the official PECA text on Pakistan Code
Computer Crime vs Cyber Crime: What Is the Difference?
Computer Crime usually describes offences directly involving computers, systems or data, such as unauthorized access, copying, interference or malicious code.
Cyber Crime is broader in ordinary use. It can involve phones, WhatsApp, social media, websites, digital payments, email and cloud accounts.
The label alone does not prove an offence. A failed online purchase, unpaid loan, rude message, business dispute or negative review does not automatically become a Cyber Offence merely because a phone or app was involved.
Investigators and courts must examine conduct, intention, evidence and the legal ingredients of the relevant provision.
List of Cyber Crimes You Should Recognise
A practical List of Cyber Crimes should reflect what people actually face. These 12 traps cover many common situations.
1. Hacked Accounts and Unauthorized Access
A person may lose access to Facebook, Instagram, WhatsApp, Gmail or a business account after a password is stolen or security settings are changed.
PECA sections 3, 4 and 5 separately deal with unauthorized access, unauthorized copying or transmission, and interference with information systems or data.
If an account is compromised, preserve login alerts, recovery emails and session records before wiping the device.
2. Cyber Fraud That Takes Your Money
Cyber Fraud can involve fake sellers, investment schemes, bogus customer support, online jobs, loan scams, false payment links or someone obtaining an OTP through deception.
Section 14 deals with electronic fraud where its statutory ingredients are established. The current text provides punishment of up to two years, a fine up to Rs10 million, or both.
If money has moved, contact the bank, card issuer or wallet provider immediately. A financial complaint and a criminal complaint can run on separate tracks, and neither automatically guarantees recovery.
3. Cyber Scams That Manufacture Trust
Many Cyber Scams depend less on hacking and more on urgency and trust.
A message may claim:
- your bank account will be blocked;
- a parcel requires payment;
- a relative urgently needs money;
- you have won a prize; or
- an investment will double quickly.
Modern Cybercriminals may copy logos, profile photographs, email addresses or voices. AI-assisted impersonation can make deception more convincing.
Verify urgent demands through a second trusted channel.
INTERPOL identifies online scams, ransomware, malware and business-email compromise among major cyber threats and warns that attackers continually change their methods.
4. Identity Theft and Fake Profiles
PECA section 16 addresses specified unauthorized obtaining, possession, transmission, sale or use of another person’s identity information.
The current law provides punishment up to three years, a fine up to Rs5 million, or both.
A fake account may be used to borrow money, contact relatives or damage reputation.
Preserve:
- profile URL;
- username;
- screenshots;
- dates; and
- relevant messages.
A display name alone does not prove who controlled the account.
5. Cyber Crime Harassment and Stalking
Cyber Crime Harassment can include repeated unwanted contact, monitoring, threats, spying or harmful distribution of photographs or videos, depending on the facts.
PECA section 24 deals with cyberstalking. Enhanced rules also apply in specified circumstances involving minors.
If online conduct is linked with employment, a separate workplace-harassment remedy may also need consideration.
For work-related conduct, see Qanooni Dastak’s Harassment Complaint Pakistan guide.
6. Sextortion and Intimate-Image Blackmail
A person may be threatened that a private image or video will be shared unless money, further images, sexual favours or another benefit is provided.
PECA section 21 covers specified conduct involving sexually explicit material, intimidation and related abuse. The law contains stronger protections in specified cases involving minors.
Do not publicly repost intimate material merely to prove it exists.
Preserve the original threat, account identifier, phone number, complete conversation and any payment demand securely.
7. Malware and Ransomware
Malware can steal information, monitor users, damage data or create unauthorized access.
Ransomware may encrypt files or lock systems and demand payment.
Businesses should preserve logs and obtain competent cybersecurity support. Paying a ransom does not guarantee data restoration or prevent later misuse.
8. Electronic Forgery and Fake Receipts
A fake bank receipt, altered digital document or manipulated electronic record can create false confidence.
PECA section 13 deals with electronic forgery where its statutory ingredients are proved. For the basic offence, punishment may extend to three years, a fine up to Rs250,000, or both.
A screenshot marked “payment successful” is not the same as money appearing in the actual account.
Verify payment through the bank or wallet itself.
9. Spoofing and Phishing Pages
Spoofing makes a false source appear genuine.
A scammer may copy a bank website, business email, government page or login screen to steal credentials.
PECA section 26 addresses spoofing where a counterfeit source is dishonestly intended to appear authentic. The punishment may extend to three years, a fine up to Rs500,000, or both.
The FBI similarly warns that phishing and spoofing can use fake emails, websites, phone numbers or sender identities to obtain passwords or financial information.
FBI spoofing and phishing guidance
10. Cyberbullying Against Children
PECA includes section 24A on cyberbullying and also contains other child-protection provisions introduced through later amendments.
Parents should preserve relevant evidence before blocking an account where it is safe to do so.
For a detailed guide, read Qanooni Dastak’s Cyber Bullying in Pakistan article.
11. False or Fake Public Information
Section 26A was inserted by the 2025 amendment.
It addresses intentional dissemination, public exhibition or transmission through an information system of information that a person knows or has reason to believe is false or fake and that is likely to create fear, panic, disorder or unrest in the general public or society.
The maximum punishment stated is three years, a fine up to Rs2 million, or both.
This does not mean every mistake, criticism, disputed opinion or private lie automatically becomes an offence.
The exact statutory ingredients still matter.
12. Attacks on Critical Information Systems
PECA contains stronger provisions concerning unauthorized access, copying or interference involving critical infrastructure systems or data.
Separate provisions can apply to cyber terrorism where the additional statutory elements are established.
These matters are different from ordinary social-media disputes.
Labels such as “cyber terrorism” should therefore not be used casually.
Which PECA Sections Can Apply?
Pakistan’s principal federal framework for many Electronic Crimes remains PECA 2016, read with later amendments.
| Conduct | Section | Maximum for basic offence |
|---|---|---|
| Unauthorized access | 3 | 3 months and/or Rs50,000 |
| Unauthorized copying | 4 | 6 months and/or Rs100,000 |
| System/data interference | 5 | 2 years and/or Rs500,000 |
| Electronic forgery | 13 | 3 years and/or Rs250,000 |
| Electronic fraud | 14 | 2 years and/or Rs10 million |
| Identity misuse | 16 | 3 years and/or Rs5 million |
| Dignity offence | 20 | 3 years and/or Rs1 million |
| Cyberstalking | 24 | 3 years and/or Rs1 million |
| Spoofing | 26 | 3 years and/or Rs500,000 |
| False/fake public information | 26A | 3 years and/or Rs2 million |
These are simplified maximums for the stated basic provisions. Exact liability can change with the subsection, victim category, critical-infrastructure element, amendments, other laws and facts.
Facts should lead to the section—not the other way around.
What Changed in Cyber Crime Law by 2026?
The legislative history matters because older articles often describe only the original 2016 Act.
The consolidated statute records amendments made in 2023, including child-protection provisions. It also records the 2024 Telecommunication Appellate Tribunal amendment.
The Prevention of Electronic Crimes (Amendment) Act, 2025, Act II of 2025 received presidential assent on 29 January 2025 and introduced major further changes.
As checked on 22 September 2026, the official Senate Acts list does not show a later PECA Amendment Act for 2026.
A separate private member’s proposal concerning sections 22 and 42 was passed by the Senate on 10 February 2026 and transmitted to the National Assembly.
That distinction is important:
A Bill is not an Act.
A proposal should not be described as current law until it completes the constitutional legislative process.
NCCIA or FIA: Where Should You Report Now?
Section 29 of the current PECA text establishes the National Cyber Crime Investigation Agency (NCCIA) for inquiry, investigation and prosecution of offences under the Act.
The statute also provides that, after NCCIA’s establishment, the former FIA Cyber Crime Wing ceases to exist and relevant cases, inquiries and other matters transfer to NCCIA.
NCCIA’s official FAQ currently identifies several complaint routes, including its complaint form, Citizen Portal, email and Cyber Crime Reporting Centres. It also describes verification requirements and a route for overseas complainants.
Official NCCIA complaint portal
For a full filing walkthrough, read:
Cyber Crime Online Complaint Pakistan
For a suspected PECA offence, preserve evidence first and use the current official route.
If there is immediate physical danger, contact police or emergency services. If money has just been transferred, contact the financial institution immediately as well.
A complaint does not automatically mean an FIR, arrest, conviction, content removal or recovery of funds will follow.
What Evidence Can Make a Complaint Stronger?
A digital case can become weaker because the victim deletes the material needed to explain what happened.
Preserve:
- complete chats;
- screenshots showing dates and usernames;
- full URLs;
- original emails;
- transaction IDs;
- bank or wallet complaint references;
- login alerts;
- original images, audio or videos;
- call logs;
- platform complaint confirmations; and
- a dated timeline.
Do not edit an original file merely to make it look cleaner.
Do not guess the identity of a Cybercriminal from a profile photograph alone.
Separate clearly what you know from what you suspect.
Pakistan’s evidence law can also become relevant when digital material reaches court. Authenticity, context, source and chain of custody can therefore matter.
Qanun-e-Shahadat Order 1984 Guide
Where Do You File If the Accused Is Elsewhere?
Internet Crimes can cross city and national borders.
A complainant may live in Lahore while the apparent phone number belongs elsewhere. A website may be hosted abroad. An overseas Pakistani may be targeted from Pakistan.
Do not assume that the location displayed on a profile decides jurisdiction.
NCCIA publishes its reporting-centre jurisdictions, while PECA itself has extra-territorial application in specified cases.
Where several locations, transactions or accused persons are involved, the correct forum can require case-specific examination.
Is There a Deadline to Report Cybercrime?
There is no safe basis for telling every victim that all Cyber Crime complaints share one universal 30-day or 90-day deadline.
Different proceedings and remedies can carry different limitation or procedural rules.
The practical rule is simple:
Report promptly.
Delay matters because money may move again, accounts may disappear and logs can be overwritten.
If a matter is already old, do not assume it is hopeless. Check the offence, remedy, forum and applicable limitation rule.
Cyber Crime Cases: What Pakistani Courts Show
Cyber Crime Cases show why digital attribution and properly preserved evidence can become decisive.
Nouman v State: Why Digital Trails Matter
In Nouman son of Muhammad Akram v State, Criminal Revision Application No. 197 of 2020, decided on 15 April 2025, the Sindh High Court reviewed a conviction involving fake Facebook profiles and objectionable material.
The record included IP information, SIM details, device material, login credentials and digital-forensic evidence. The High Court found that the combined technical and testimonial record linked the accused with the accounts and maintained the conviction.
The important lesson is not that any screenshot is enough. It is that account attribution, device evidence, forensic linkage and chain of custody can matter greatly.
Read the official Sindh High Court judgment
Muhammad Wajid Muneer: Bail Is Not Final Guilt
In Muhammad Wajid Muneer v The State etc., Criminal Miscellaneous No. 255 of 2025, the Islamabad High Court dealt with a post-arrest bail application in a case involving allegations of online-job impersonation and electronic fraud.
The court declined bail after examining the record and alleged repeat involvement, but expressly stated that its observations were tentative and would not determine final guilt or innocence at trial. (Islamabad High Court)
That distinction is crucial:
a complaint, FIR, arrest or bail order is not a final conviction.
Read the official Islamabad High Court order
Cybercrime Prevention: 10 Habits That Cut Risk
Cybercrime Prevention is usually easier than recovering money, private data or control of a stolen account.
- Use a different strong password for every important account.
- Turn on multi-factor authentication.
- Secure the email used for password recovery.
- Keep phones, browsers and apps updated.
- Verify urgent money requests through another channel.
- Never disclose an OTP, PIN or banking password.
- Check the full domain before logging in.
- Keep secure backups of important information.
- Reduce unnecessary information on public profiles.
- Teach children and older relatives how Cyber Scams create urgency.
INTERPOL recommends careful verification of suspicious digital content and identity, while the FBI recommends checking URLs and enabling multi-factor authentication. (Interpol)
These sources explain threat methods; they do not replace Pakistani law or NCCIA reporting.
Mistakes That Can Weaken an Online Crime Case
A victim can be genuinely wronged and still damage the evidence through avoidable mistakes.
Do not:
- delete chats before preserving them;
- publicly circulate intimate material;
- edit original files or screenshots;
- accuse someone only from a display name;
- keep paying a blackmailer expecting certainty;
- delay contacting a bank after financial loss;
- use unofficial complaint websites;
- assume every complaint becomes an FIR; or
- call every online dispute a PECA offence.
Secure the account, preserve the original trail, record dates, use the correct authority and describe facts without exaggeration.
FAQs About Cyber Crime in Pakistan
1. What is Cyber Crime in simple words?
Cyber Crime is unlawful conduct involving a computer, phone, online account, network or digital data as the target or tool. Examples may include hacking, electronic fraud, identity misuse, stalking, blackmail, spoofing and certain unlawful online communications. The relevant legal section depends on what happened and what can be proved.
2. What is the most common Cyber Crime in Pakistan?
There is no sound basis for declaring one offence the single most common Cyber Crime nationwide without current official national statistics covering all reporting channels. Complaints can involve financial fraud, harassment, hacked accounts, identity misuse and other harms. International agencies also identify phishing and social engineering as significant risks.
3. Where can I report Cyber Crime in Pakistan?
For a suspected Cyber Crime under PECA, the current federal investigation agency is NCCIA. Its official website provides complaint and reporting-centre information. If there is immediate physical danger, police or emergency assistance may be needed first. For recent financial loss, contact the bank or wallet provider promptly as well.
4. Is FIA still handling Cyber Crime complaints?
The current PECA framework establishes NCCIA for inquiry, investigation and prosecution of offences under the Act. Older articles may still mention the FIA Cyber Crime Wing because it was the previous institutional arrangement. Current reporting should be checked against official NCCIA instructions.
5. Is online fraud always a Cyber Offence?
No. Cyber Fraud may fall under PECA section 14 where its ingredients are present, but a failed business transaction, unpaid debt or contractual disagreement is not automatically criminal fraud. Deception, intention, evidence and the nature of the transaction must be examined first.
6. Can WhatsApp harassment become Cyber Crime?
Yes, depending on what happened. Repeated unwanted contact, stalking, threats, identity misuse or intimate-image blackmail may engage different PECA provisions. One rude message or personal disagreement is not automatically Cyber Crime Harassment. The actual facts and statutory ingredients matter.
7. What evidence should I save after Cyber Crime?
Save complete chats, account links, URLs, usernames, original emails, transaction IDs, login alerts, voice notes, images, videos and bank or wallet records. Keep a dated timeline. Avoid editing original material. A screenshot may help, but context and digital attribution can still be important.
8. Can NCCIA guarantee recovery of stolen money?
No. Reporting quickly may support an investigation or attempts to trace transactions, but a Cyber Crime complaint cannot guarantee recovery. The outcome may depend on timing, the transaction trail, banking action, available records and the investigation.
Conclusion: Save the Proof Before the Screen Changes
Cyber Crime often succeeds because the victim is rushed, frightened, embarrassed or made to trust the wrong person.
The safest response is controlled and evidence-based.
Stop further loss. Preserve the digital trail. Secure compromised accounts. Contact the financial institution where money is involved. Use the correct official reporting channel. Avoid public accusations where identity has not been proved.
Pakistan’s law now addresses many Electronic Crimes, including unauthorized access, Cyber Fraud, identity misuse, stalking, intimate-image abuse, spoofing, cyberbullying and false or fake public information.
But no legal label replaces proof.
A username can disappear. A message can be deleted. Money can move again.
Preserve the evidence before the screen changes, and let the facts guide the next lawful step.
Disclaimer
This article provides general legal-awareness and digital-safety information. It is not case-specific legal advice and does not guarantee an FIR, arrest, prosecution, conviction, content removal or financial recovery.
Cybercrime law, portals, institutional arrangements and procedural rules can change. For an active matter, check the current official law and obtain advice based on the complete facts and record.