Reporting Cyber Crime in Pakistan (2026 Legal Guide) — Rules & Requirements
About this article
Reviewed by the Commoner Law editorial team. Sources: pakistancode.gov.pk, Punjab/Sindh/KP/Balochistan provincial codes, Supreme Court of Pakistan, FBR, EOBI, SBP, NEPRA, OGRA, PMDC, FIA, and provincial Healthcare Commissions. Provincial variations cite Punjab/Sindh/KP/Balochistan Acts and ICT-specific ordinances. Written in plain English with everyday Urdu legal terms (FIR, qabza, khula, NTN, CNIC) for a general audience — this is educational content, not legal advice. Our editorial standards
What is this right?
The NCCIA is Pakistan's exclusive federal cybercrime investigator. The FIA's Cyber Crime Wing (and the National Response Centre for Cyber Crime, NR3C) was merged into the NCCIA on 3 May 2024 under Section 51 of the Prevention of Electronic Crimes Act 2016. The Prevention of Electronic Crimes (Amendment) Act 2025, enacted 29 January 2025, amended Section 30 of PECA to give the NCCIA exclusive investigative powers over Acts offences — police and FIA no longer investigate PECA matters.
Filing creates the criminal-case record under PECA. It does not, on its own, recover money — that runs in parallel through the bank under the SBP Electronic Fund Transfers Regulations 2018 and (if the bank refuses) through Banking Mohtasib Pakistan. The NCCIA reference number is, however, the spine of every downstream complaint: the bank, the Mohtasib, and any civil-court route will all ask for it.
When does it apply?
- Any cybercrime in Pakistan: online fraud, electronic forgery, account takeover, identity theft, blackmail, sextortion, or impersonation.
- An investment, crypto, or trading platform operated through Pakistani phone numbers, bank accounts, or social-media advertising.
- An unsolicited message asks for OTPs, banking details, or document copies on behalf of a Pakistani entity (NADRA, FBR, a bank, a courier, the police).
- A fake job offer, fake landlord, fake delivery-fee, or fake customs scam targeting Pakistani residents or overseas Pakistanis.
- Online harassment, cyberstalking, or non-consensual imagery — see also the Data Privacy & Digital Rights category.
Filing a Cybercrime Complaint with the NCCIA
- File the online complaint at nccia.gov.pk. The portal is the primary intake channel. You will need: complainant CNIC and contact details; suspect details if known; the nature of the offence (PECA sections if you can identify them); the channel through which it occurred; the financial loss; the timeline; and the evidence (screenshots, transaction SMS, voice recordings, URLs).
- Identify the right PECA sections. §13–14 (unauthorised access to information system); §15–16 (unauthorised copying / interference); §17 (unauthorised access to critical infrastructure); §18 (glorification of an offence); §20 (offences against dignity of a natural person); §21 (offences against modesty of a natural person and minor); §22 (child pornography); §24 (cyber stalking); §26 (spoofing); §26-A (false / fake information — added by the 2025 Amendment). Citing the section sharpens the investigation request.
- For ongoing harassment / threats, file under PECA §24 (cyber stalking) with the additional dignity / modesty sections if applicable. Cyberstalking under §24 is cognisable and the NCCIA will register an FIR where the facts disclose the offence. Section 24 covers using an information system to coerce, intimidate, harass, or take the photograph of a person without consent.
- For SIM-card scams and unwanted calls, file in parallel at PTA. Pakistan Telecommunication Authority complaint portal: complaint.pta.gov.pk. PTA helpline: 0800-55055. PTA has the operational power to direct telecom operators to block SIMs and shorten the scammer's reach.
- If the local police try to register an FIR under PECA, decline and direct them to NCCIA. After the 2025 amendment, Section 30 PECA gives NCCIA exclusive investigative powers under the Act; an FIR registered by ordinary police for a PECA offence is procedurally bad and may be quashed.
- Cross-reference the case numbers. NCCIA reference, PTA reference (if filed), and bank case reference belong in the timeline document. Banking Mohtasib will ask for the NCCIA reference when you escalate the money side.
What should you NOT do?
- Don't go to your local police station to file a PECA case. After 29 January 2025, Section 30 PECA gives NCCIA exclusive investigative powers. Police-registered PECA FIRs are open to legal challenge.
- Don't expect a personal investigator on a small case. Like national cybercrime intake systems in other jurisdictions, most reports feed pattern analysis rather than producing an individual case officer. The report's main value is unlocking the bank, Banking Mohtasib, and civil-court routes.
- Don't publish the scammer's details on Pakistani social media before NCCIA registers the case. PECA §20 (dignity), §21 (modesty), and the new §26-A (false / fake information) cover public commentary; evidence belongs to the official channel first.
- Don't pay 'recovery agents' charging an upfront fee. NCCIA, Banking Mohtasib, and the bank complaint process are all free. Anyone charging you to recover scammed funds is the next scam.
About Scams, Fraud & Money Recovery in Pakistan
Pakistan's scam-recovery system reorganised in 2024. The National Cyber Crime Investigation Agency (NCCIA) was formally established on 3 May 2024 under Section 51 of the Prevention of Electronic Crimes Act 2016 and replaced the Cyber Crime Wing of the FIA. Section 30 of PECA was amended in 2025 to give the NCCIA exclusive powers to investigate cybercrime under the Act — meaning complaints that used to go to the FIA's NR3C are now NCCIA cases. For the money side, the State Bank of Pakistan's Electronic Fund Transfers Regulations 2018 (issued under sections 3 and 26 of the Payment Systems and Electronic Fund Transfers Act 2007) require banks to refund unauthorised electronic transfers and place the burden of proof on the bank, not the consumer. If the bank refuses, the Banking Mohtasib Pakistan resolves the dispute for free under the Federal Ombudsmen Institutional Reforms Act 2013 and Part IVA of the Banking Companies Ordinance 1962; the order is binding on the bank if no representation is filed within 30 days.
For life-threatening emergencies in Pakistan, dial 15 (Police), 1122 (Rescue), or 115 (Edhi ambulance). The pages below cover the first 24 hours, filing with NCCIA, and recovering money from the bank.
Frequently asked questions
Why isn't the FIA the cybercrime agency anymore?
On 3 May 2024 the federal government established the National Cyber Crime Investigation Agency (NCCIA) under Section 51 of the Prevention of Electronic Crimes Act 2016. The FIA's Cyber Crime Wing was merged into NCCIA and all cases were transferred. The Prevention of Electronic Crimes (Amendment) Act 2025 then amended Section 30 PECA to give NCCIA exclusive investigative powers over PECA offences — meaning the FIA and provincial police no longer investigate cybercrime under the Act.
What if the scammer is overseas?
File the NCCIA complaint anyway. The bank-side recovery under the SBP Electronic Fund Transfers Regulations 2018 operates on your Pakistani bank regardless of where the scammer sits. International prosecution depends on mutual legal assistance treaties and rarely produces individual recovery, but the NCCIA reference supports the bank case and the Banking Mohtasib escalation.
What is the difference between NCCIA and PTA?
NCCIA is the criminal-investigation agency under PECA. PTA — Pakistan Telecommunication Authority — is the telecom and online-content regulator under the Pakistan Telecommunication (Re-organisation) Act 1996 and PECA. PTA has the operational power to direct telecom operators to block SIMs, take down unlawful online content, and act on user complaints about service quality. Most scam victims file both: NCCIA for the criminal record, PTA for blocking the channel.
Does Pakistan have a free legal-aid helpline for scam victims?
Not at the national consumer-rights level the way the UK's Citizens Advice or India's Consumer Helpline exists. The State Bank of Pakistan's Consumer Protection Department oversees bank complaints; Banking Mohtasib Pakistan resolves bank disputes for free; provincial Bar Councils and Legal Aid Societies handle pro-bono representation in limited categories. For Pakistani scam victims, the unpaid path is: bank → Banking Mohtasib → civil court, with NCCIA running the criminal track in parallel.
What is the reporting cyber crime to the nccia (successor to fia cyber crime wing) right in Pakistan?
The NCCIA is Pakistan's exclusive federal cybercrime investigator. The FIA's Cyber Crime Wing (and the National Response Centre for Cyber Crime, NR3C) was merged into the NCCIA on 3 May 2024 under Section 51 of the Prevention of Electronic Crimes Act 2016. The Prevention of Electronic Crimes (Amendment) Act 2025, enacted 29 January 2025, amended Section 30 of PECA to give the NCCIA exclusive investigative powers over Acts offences — police and FIA no longer investigate PECA matters.Filing creates the criminal-case record under PECA. It does not, on its own, recover money — that runs in...
When does reporting cyber crime to the nccia (successor to fia cyber crime wing) apply?
Any cybercrime in Pakistan: online fraud, electronic forgery, account takeover, identity theft, blackmail, sextortion, or impersonation.An investment, crypto, or trading platform operated through Pakistani phone numbers, bank accounts, or social-media advertising.An unsolicited message asks for OTPs, banking details, or document copies on behalf of a Pakistani entity (NADRA, FBR, a bank, a courier, the police).A fake job offer, fake landlord, fake delivery-fee, or fake customs scam targeting Pakistani residents or overseas Pakistanis.Online harassment, cyberstalking, or non-consensual imagery...
How do I report a cybercrime in Pakistan after the FIA Cyber Crime Wing was abolished?
File the online complaint at nccia.gov.pk. The portal is the primary intake channel. You will need: complainant CNIC and contact details; suspect details if known; the nature of the offence (PECA sections if you can identify them); the channel through which it occurred; the financial loss; the timeline; and the evidence (screenshots, transaction SMS, voice recordings, URLs).Identify the right PECA sections. §13–14 (unauthorised access to information system); §15–16 (unauthorised copying / interference); §17 (unauthorised access to critical infrastructure); §18 (glorification of an offence);...
What mistakes should I avoid with reporting cyber crime to the nccia (successor to fia cyber crime wing)?
Don't go to your local police station to file a PECA case. After 29 January 2025, Section 30 PECA gives NCCIA exclusive investigative powers. Police-registered PECA FIRs are open to legal challenge.Don't expect a personal investigator on a small case. Like national cybercrime intake systems in other jurisdictions, most reports feed pattern analysis rather than producing an individual case officer. The report's main value is unlocking the bank, Banking Mohtasib, and civil-court routes.Don't publish the scammer's details on Pakistani social media before NCCIA registers the case. PECA §20...