Someone is blackmailing you with private photos. A stranger won't stop messaging you. A video defaming you is spreading on WhatsApp and TikTok. In Pakistan, these are not just moral wrongs — they are crimes, and since the 2025 amendments to the Prevention of Electronic Crimes Act, 2016 (PECA), there is a dedicated agency to investigate them: the National Cyber Crime Investigation Agency (NCCIA), which replaced the FIA's cybercrime wing.

This guide explains which PECA provisions cover blackmail, cyberstalking, and online defamation, and gives you a complete, fill-in-the-blank complaint template addressed to the NCCIA — with sections for your particulars, the accused's identifiers, a chronology of events, an evidence annexure list, a preservation request, and the prayer for FIR and investigation. It also covers the NCCIA's online complaint portal, what happens after you file, and how to preserve your evidence so it survives in court.

This is general legal information, not legal advice. For serious cases — especially where your safety is at risk — consult an advocate alongside filing your complaint.

The law: which provisions punish what

The 2025 amendments to PECA 2016 created the NCCIA as the investigating agency and added new offences. The provisions most relevant to victims of online abuse are:

  • Section 20 — offences against the dignity of a natural person. Transmitting information that harms the dignity of a person — the core provision for online defamation and character assassination. Punishable with imprisonment of up to 3 years, fine, or both.

  • Section 21 — offences against the modesty of a natural person (and minors). Covers sexually explicit or modesty-violating content transmitted electronically — the provision used against those who share or threaten to share private or intimate material. Punishable with imprisonment of up to 5 years.

  • Section 24 — cyberstalking. Repeatedly contacting, following, or monitoring a person electronically in a way that causes fear, distress, or apprehension — the provision for stalkers who won't stop messaging, calling, or tracking you online. Punishable with imprisonment of up to 3 years, extending to 5 years in aggravated circumstances.

  • Section 14 — electronic fraud. Cheating or dishonestly inducing someone through electronic means — used where blackmailers extract money, as in extortion-via-threat cases.

  • Section 16 — unauthorised use of identity information. Using someone else's identity, SIM, or credentials — relevant where the harasser impersonates you or operates fake accounts in your name.

  • Section 26-A — false or fake information (added by the 2025 amendment). Disseminating false or fabricated information online — relevant where defamatory campaigns are built on lies.

These are read alongside the Pakistan Penal Code: Sections 499/500 (defamation) and Section 506 (criminal intimidation) are routinely invoked together with PECA in NCCIA FIRs.

The law is not theoretical — it is being enforced. On October 12, 2026, the NCCIA in Islamabad arrested a man for blackmailing a woman and extorting Rs110,000 from her; the FIR was registered under PECA Sections 14 and 24 (reported by lhrtimes.com). The same day, the NCCIA in Abbottabad arrested a man for harassing a woman on WhatsApp using data stolen from her laptop; that FIR invoked PECA Sections 20 and 24 read with PPC Sections 506 and 109 (lhrtimes.com). And on October 17, 2026, Captain (retd) Muhammad Safdar filed an NCCIA complaint against a lawyer over an allegedly defamatory video, specifically asking for preservation of electronic evidence and metadata (reported by hrnww.com). The agency's Director General, Syed Ali Nasir Rizvi, appointed in September 2026, has announced a zero-tolerance operational push (lhrtimes.com, October 12, 2026).

Before you write: what the NCCIA needs from you

An NCCIA complaint succeeds or fails on specifics. Vague complaints ("someone is harassing me online") go nowhere. Before drafting, collect:

  1. Your particulars — full name, father's name, CNIC number, address, mobile number, email.

  2. The accused's identifiers — name if known; mobile numbers; WhatsApp numbers; Facebook/TikTok/Instagram/X handles; profile URLs; email addresses; any bank account or mobile-wallet details used for extortion payments.

  3. A chronology — dates and times of each incident, in order: first contact, threats made, money demanded or paid, posts published.

  4. Evidence — screenshots showing the full screen (with the URL or handle visible, plus date and time), original chat exports, call recordings if lawful, transaction slips or mobile-wallet receipts, the URLs of defamatory posts or videos.

  5. Witnesses, if any — people who saw the messages or posts.

Do not delete the chats, block-and-delete the evidence, or "clean up" your phone before filing. Deleted evidence is lost evidence.

The complaint template

Below is a complete complaint letter. Square brackets mark every blank to fill in. Address it to the Zonal Director of the NCCIA zone covering your area (or the NCCIA Cybercrime Circle), and keep a signed copy with the receiving stamp for your record.

To, The Zonal Director, National Cyber Crime Investigation Agency (NCCIA), [Zone/Circle, e.g. Islamabad Zone / Lahore Circle] Subject: Complaint regarding blackmail, cyberstalking and online defamation under the Prevention of Electronic Crimes Act, 2016 — request for registration of FIR and investigation Respected Sir/Madam, I, [Your Full Name], son/daughter/wife of [Father's/Husband's Name], CNIC No. [CNIC Number], resident of [Complete Address], mobile No. [Mobile Number], email [Email Address], respectfully submit as under: 1. Particulars of the accused: Name (if known): [Accused's Name or "Unknown"]; Mobile/WhatsApp No(s).: [Numbers]; Social media handles: [e.g. TikTok: @___, Instagram: ___, Facebook profile URL: ___]; Email: [if known]; Other identifiers: [bank account / Easypaisa/JazzCash number used for extortion: ___]. 2. Chronology of events: [Write dated paragraphs, for example:] - On [date], at about [time], the accused first contacted me on [WhatsApp number / platform], claiming to possess [describe: private photographs / videos / personal data] belonging to me. - On [date], the accused threatened to [publish/share the material with my family / upload it on social media] unless I paid Rs. [amount] by [date], via [bank account / mobile wallet: details]. - On [date], I paid Rs. [amount] through [transaction reference], but the threats continued. - On [date], the accused published [describe the post/video] at [URL], which remains online and has been viewed/shared widely, causing grave damage to my dignity and reputation. - The accused continues to contact me repeatedly despite my objections, causing fear and mental distress. 3. Offences disclosed: The above facts disclose offences under Sections 14, 16, 20, 21 and 24 of PECA 2016 (as amended 2025), read with Sections 499, 500 and 506 of the Pakistan Penal Code [delete the sections that do not apply to your facts; your advocate will advise]. 4. Evidence annexed: I am attaching the following evidence, listed as annexures: - Annexure-A: Screenshots of threatening chats/messages, showing the sender's number/handle, with URLs and date-time visible (pages ___). - Annexure-B: URLs and screenshots of the defamatory posts/videos published online. - Annexure-C: Transaction slips / mobile-wallet receipts of payments extorted (Rs. ___ on ___). - Annexure-D: Copy of my CNIC and proof of address. - Annexure-E: [Any other evidence: call recordings, witness statements, etc.] The original device containing the chats is available for forensic examination. 5. Request for preservation of electronic evidence: I request that the Agency immediately issue directions for preservation of the electronic evidence — including the accused's account data, metadata, and the content at the URLs listed above — before it is deleted or altered, as provided under PECA. 6. Prayer: In view of the above, it is respectfully prayed that: (a) an FIR be registered against the accused under the relevant provisions of PECA 2016 and the Pakistan Penal Code; (b) a thorough investigation be conducted, the accused be identified/traced and proceeded against in accordance with law; (c) the defamatory/offending content be got removed/blocked through the competent forum; and (d) any other relief deemed just be granted. I shall be grateful for prompt action, as the offending content continues to spread and the threats continue. Yours faithfully, [Your Full Name] [Address, Mobile No., Email] Dated: [Date] Signature: _______________

Filing online: the NCCIA complaint portal

In addition to (not instead of) the written complaint, you can lodge your complaint through the NCCIA's online complaint portal. The portal accepts cybercrime complaints electronically and generates a tracking reference. Practical advice:

  • File online and submit the written complaint at the NCCIA circle — the written version with annexures carries the full evidentiary weight, while the portal creates a dated, trackable record.

  • Keep the portal's complaint/tracking number with your written complaint's receiving copy.

  • If you file online first, print the submitted complaint and attach it as an annexure to your written filing so both records are linked.

What happens after you file

Knowing the process removes the fear of it. After your complaint is received:

  1. Receipt and diary. Your complaint is entered in the record and you receive an acknowledgment (receiving stamp or portal tracking number). Keep this safe — it is your proof of filing.

  2. Preliminary enquiry. An enquiry officer examines your complaint and evidence, and may call you to record your statement and collect your device for forensic imaging. Cooperate fully and promptly.

  3. Technical analysis. The NCCIA traces numbers, handles, IP addresses, and account metadata, and seeks preservation and production of data from service providers under PECA's powers. This is the stage where your preservation request matters most — data deleted before preservation is often unrecoverable.

  4. FIR registration. If the enquiry discloses a cognizable offence, an FIR is registered under the relevant PECA and PPC sections — as in the October 2026 cases registered under Sections 14/24 and 20/24.

  5. Arrest and investigation. The accused may be arrested, devices seized, and forensic reports obtained. You may be asked for supplementary statements.

  6. Challan and trial. On completion, the investigation report (challan) is submitted to the court designated to try PECA offences, and the trial proceeds. Your evidence — properly preserved from day one — is what the prosecution will rely on.

Timelines vary with the complexity of tracing and the workload of the circle; follow up politely but regularly on your tracking number, and keep a written record of every visit and direction.

How to preserve evidence so it holds up

  • Screenshot properly: capture the full screen showing the sender's number or handle, the message content, and the phone's date-time. For posts, capture the URL bar or profile link in the same screenshot.

  • Screen-record videos or stories that may be deleted — stories vanish in 24 hours.

  • Export chats (WhatsApp's email-chat feature) in addition to screenshots; keep the original phone untouched and available for forensic examination.

  • Save transaction proof: bank transfer receipts, mobile-wallet SMS confirmations, and screenshots of the recipient account details.

  • Note metadata: dates, times, and the sequence of events in a written diary while memory is fresh — this becomes your chronology.

  • Do not edit or crop evidence in ways that remove context; courts and forensic examiners distrust altered images.

  • Back up everything to a second location (a separate drive or secure cloud), in case the phone is lost, damaged, or seized.

Frequently Asked Questions

Q: Can I file an NCCIA complaint if I don't know who the harasser really is? A: Yes. Many cybercrime complaints begin with "unknown accused" identified only by a number, handle, or URL. Tracing the real identity behind anonymous accounts is precisely the NCCIA's technical job — through metadata, IP records, and service-provider data. What you must provide is every identifier you have: numbers, handles, profile URLs, screenshots, and the chronology. The October 2026 Abbottabad case, where harassment came through WhatsApp using stolen laptop data, shows how investigations proceed from digital traces to a named accused.

Q: The blackmailer says he'll delete everything if I pay. Should I pay and stay quiet? A: No — paying almost never ends blackmail; it proves you will pay again, and the threats typically escalate. The October 12, 2026 Islamabad case is instructive: the victim was extorted of Rs110,000 and the blackmailer was still arrested under PECA Sections 14 and 24. Preserve the payment receipts (they are evidence of the extortion), stop paying, and file your complaint. If you fear for your safety, tell the NCCIA and consult an advocate immediately.

Q: Are screenshots alone enough as evidence? A: Screenshots are a starting point, not the whole case. They are most persuasive when they show the sender's identifier, the full content, and date-time; when backed by the original device available for forensic examination; and when supported by metadata and service-provider records the NCCIA obtains during investigation. That is why the template asks for a preservation request and offers the original device — forensic imaging of the phone corroborates what the screenshots show.

Q: What is the difference between complaining to the NCCIA and filing a police FIR? A: Since the 2025 PECA amendments, the NCCIA is the specialised agency for electronic crimes, replacing the FIA's cybercrime wing. A regular police station can still register offences under the Pakistan Penal Code (such as Sections 499/500 defamation or 506 intimidation), but PECA offences — cyberstalking, electronic fraud, online defamation under Section 20 — are the NCCIA's domain, with its forensic and data-preservation powers. In practice, NCCIA FIRs invoke PECA and PPC provisions together, as seen in the October 2026 cases.

Q: How long does the NCCIA take to act on a complaint? A: There is no fixed statutory timeline in the research for this guide; it depends on the complexity of tracing, the volume of cases at the circle, and how complete your evidence is. Complaints with clear identifiers, preserved devices, and transaction records move faster. File both online and in writing, keep your tracking number, follow up regularly, and respond immediately whenever the enquiry officer calls you — delay on the complainant's side is the most common cause of stalled enquiries.

Q: Can I withdraw my complaint later if we settle? A: Criminal cases, once an FIR is registered, belong to the State — a complainant cannot simply "take back" an FIR the way a civil suit can be withdrawn. Some offences are compoundable (settleable with court permission) and courts can consider compromise at the trial stage, but the investigation, once launched, proceeds on its own track. File only when you are serious, and discuss settlement implications with your advocate before any compromise.

The Bottom Line

Blackmail, cyberstalking, and online defamation are crimes with dedicated provisions — PECA Sections 14, 16, 20, 21, 24, and 26-A, read with PPC 499, 500, and 506 — and a dedicated agency, the NCCIA, to investigate them. The October 2026 arrests show the law being enforced in real time. If you are a victim: preserve everything before it disappears, write a specific complaint with identifiers, chronology, and annexed evidence, ask expressly for preservation of electronic data, file both online and in writing, and follow up. Silence rewards the harasser; a well-documented complaint puts the machinery of the law on your side.

This document provides general legal information for readers in Pakistan and is not legal advice. For your specific case, please consult a qualified advocate.