The verdict

A court has sentenced three people — two Pakistani nationals and one foreign national — to seven years' imprisonment each for an online investment fraud that cost a Pakistani citizen Rs19.391 million. The court also imposed combined fines of Rs250,000 on the three convicts.

The convictions followed an investigation by the Islamabad Circle of the National Cyber Crime Investigation Agency (NCCIA), Pakistan's dedicated cybercrime investigation body. An agency official said Sub-Inspector Shehroz Riaz investigated the case and presented the collected evidence during the legal proceedings. After reviewing the prosecution's case, the court imposed the seven-year prison terms and the fines.

This is one of the most significant recent enforcement outcomes against digital financial fraud in Pakistan — and it is worth understanding not just as news, but as a map: how the fraud worked, how a complaint became a conviction, what laws were involved, and what every reader should know to protect themselves.

How the fraud worked

According to the investigation, the scheme was an "online investment fraud" of a type that is becoming depressingly familiar:

  • The perpetrators approached the victim with what appeared to be an investment opportunity connected to a foreign private bank — a detail designed to sound prestigious, international and safe.

  • They used a fraudulent mobile application designed to resemble a legitimate banking platform. The app looked professional: it had the visual language of a real bank, presented the "investment arrangement" as genuine, and likely showed dashboards suggesting the victim's money was growing.

  • The victim, convinced by what the platform displayed, transferred substantial funds. The promised investment activity was not legitimate. The money was simply gone.

This is a pattern — not an isolated trick. Cybercrime investigators say criminals routinely imitate banks, licensed brokers and recognised financial institutions to make online investment offers look trustworthy. Fraudulent operators use professional-looking applications, fabricated account dashboards and promises of unusually high returns to convince users that their deposits are generating profits. Pakistan's securities regulator has repeatedly cautioned the public against unlicensed trading websites and mobile applications, warning about platforms that promote guaranteed or risk-free returns, impersonate legitimate financial businesses, and use social-media advertising or private messaging groups to attract victims.

The victim here lost Rs19.391 million — a life-altering sum. That scale is exactly what makes these schemes worth running: one convinced victim can finance the whole operation.

The NCCIA: who investigated, and how

The National Cyber Crime Investigation Agency (NCCIA) is Pakistan's specialised agency for cybercrime. It took over the cybercrime mandate from the Federal Investigation Agency's cybercrime wing, and its Islamabad Circle handled this case. Understanding how a case travels through the NCCIA shows why this conviction matters — and what you can do if it happens to you.

Step 1: The complaint

Every cybercrime case starts with a complaint. A victim of online fraud can:

  • Call the NCCIA helpline 1799;

  • Visit the nearest NCCIA circle office in person;

  • File a complaint through the NCCIA's online complaint portal.

The practical advice from investigators: complain promptly and preserve everything — screenshots of the app and dashboards, transaction receipts, bank transfer records, chat messages, phone numbers, and any links you received. Digital evidence is fragile; records get deleted, accounts get closed. The sooner a complaint is filed, the better the chances of tracing the money.

Step 2: Inquiry and FIR

After a complaint is received, the NCCIA conducts an inquiry to verify the facts. If the inquiry reveals a cognizable offence, an FIR (First Information Report) is registered. The FIR is the legal foundation of the whole case — it names the offence, the accused (so far as known) and the facts as they stand.

Step 3: Investigation

An investigation officer — in this case Sub-Inspector Shehroz Riaz — collects evidence: call records, bank transfer trails, device data, app forensics, and witness statements. In digital fraud cases, the investigation often involves tracking money flows through bank accounts and identifying the people behind devices and accounts. The officer then submits the case to the court with the collected evidence.

Step 4: Trial and verdict

At trial, the prosecution presents its evidence and witnesses; the defence gets its turn. The court in this case reviewed the prosecution's case and found it proved — resulting in seven-year prison terms for each of the three convicts and Rs250,000 in combined fines. A conviction like this, carrying real prison time for all three accused including the foreign national, sends a message that online fraud is not a low-risk crime.

The laws: what online investment fraud is punished under

An online investment scam like this one typically triggers two parallel sets of criminal law — the Prevention of Electronic Crimes Act 2016 (PECA) for the digital element, and the Pakistan Penal Code (PPC) for the fraud itself.

Under PECA 2016

  • Section 17 — Electronic forgery: creating or using forged electronic records, which covers a fake banking app and fabricated investment dashboards. Punishable with imprisonment and fine.

  • Section 16 — Unauthorised use of identity information: using someone else's identity (for example, a real bank's branding) to commit fraud.

  • Section 18 — Electronic fraud / spoofing: using deception through electronic means to gain unlawful benefit — punishable with up to seven years' imprisonment and a fine. This is the section most directly aimed at schemes like this one.

  • Section 21 — Spoofing: unauthorised use of a communication network or device to deceive — punishable with up to five years' imprisonment.

  • Section 14 — Unauthorised access to information systems: hacking or breaking into systems, where that is part of the operation.

Under the Pakistan Penal Code

  • Section 420 — Cheating and dishonestly inducing delivery of property: whoever cheats and thereby dishonestly induces a person to deliver property can be punished with imprisonment of up to seven years and a fine. This is the classic provision for investment fraud — the victim was induced to transfer Rs19.4 million on false representations.

  • Section 406 — Criminal breach of trust: where money entrusted to someone is misappropriated.

  • Section 409 — Criminal breach of trust by a public servant, banker or agent: carries a heavier sentence (up to life imprisonment) where the offender was in a fiduciary position.

  • Section 34 — Common intention: where several people act together to commit an offence, each is liable as if they did it alone — relevant here, since three accused were convicted together for one scheme.

The seven-year sentence awarded in this case sits at the top end of what Sections 420 PPC and 18 PECA allow — a signal from the court about the gravity of a fraud worth nearly twenty million rupees.

Red flags: how to spot an investment fraud before you pay

The fake banking app in this case worked because it looked legitimate. Here is a checklist of warning signs — if you see even two or three, stop and verify before transferring a single rupee:

  1. Guaranteed or risk-free high returns. No legitimate investment guarantees high returns without risk. "Guaranteed profits," "double your money," "risk-free trading" — these phrases are the calling cards of fraud.

  2. Impersonation of a real bank or broker. The app resembled a foreign private bank's platform. Always check: does the institution actually offer this product? Call the bank through its official, published contact — never through numbers the "investment advisor" gives you.

  3. An app or link from an unknown source. Never download an investment app from a WhatsApp forward, Telegram link, social-media ad or email. Install financial apps only from official app stores, and even then, verify the developer's identity.

  4. Pressure and urgency. "Limited slots," "offer ends today," "your account will be closed" — urgency is a pressure tactic designed to stop you from thinking.

  5. Demands for passwords, PINs or one-time passcodes. No legitimate bank or broker will ever ask you to share your login password, ATM PIN or OTP. Anyone who does is a fraudster, full stop.

  6. Requests to pay through unusual channels. Fraudsters often route money through individual bank accounts, crypto wallets or payment apps rather than the company's official accounts.

  7. No verifiable regulatory status. Legitimate investment firms in Pakistan are licensed or registered with the relevant regulator (the securities regulator for brokers, the State Bank for banks). If the platform's regulatory status cannot be independently verified, walk away.

  8. Fake dashboards and "profits" you cannot withdraw. A classic pattern: the app shows your money growing, encourages you to invest more, and then blocks withdrawals with demands for "tax," "fees" or "verification deposits."

If you have been scammed: what to do right now

  1. Stop paying immediately. Do not send "withdrawal fees" or "taxes" to recover money — those are follow-on demands from the same fraudsters.

  2. Preserve everything. Screenshot the app, your account dashboard, all chats and messages, and save every transaction receipt and bank statement showing the transfers.

  3. Inform your bank at once. Ask your bank to flag or reverse the transactions if possible, and to preserve the transaction trail. Time matters — funds move fast.

  4. File a complaint with the NCCIA. Call 1799 or visit the nearest NCCIA circle office, with all your preserved evidence. Prompt complaints improve the chances of tracing transferred funds.

  5. Consider civil remedies too. A criminal conviction punishes the offender; getting your money back may require a separate civil claim for recovery. A lawyer can advise whether a suit for recovery of money is worth filing, including against any local assets or accounts identified during the investigation.

  6. Report the platform. If the fraud came through social media, report the account and ad to the platform as well — it helps shut the pipeline for the next victim.

Why this conviction matters beyond the three convicts

Convictions in cybercrime cases are hard to win. Digital evidence must be collected cleanly, money trails followed through multiple accounts, and accused persons — including foreign nationals, as here — brought before the court. A seven-year sentence for each convict, imposed after an NCCIA investigation, does three things:

  • It proves the system works. The complaint-to-conviction arc in this case is the answer to the common question "what is the point of complaining?" The point is this verdict.

  • It raises the cost of fraud. Prison time for everyone involved — Pakistanis and the foreigner alike — makes recruitment into such schemes riskier.

  • It creates a deterrent record. Courts cite previous sentences; prosecutors point to them; and fraudsters read them too.

But enforcement alone cannot keep up. Fraudulent applications can be created and distributed quickly, and prevention remains essential. The effectiveness of the fight against online investment fraud depends on sustained enforcement alongside public awareness — which is why the red-flag checklist above is arguably the most important part of this article.

Frequently Asked Questions

Q: What is the NCCIA and how do I contact it? A: The National Cyber Crime Investigation Agency (NCCIA) is Pakistan's dedicated agency for investigating cybercrime, including online fraud, hacking, identity theft and harassment. It took over the cybercrime role previously handled by the FIA's cybercrime wing. You can reach it on its helpline 1799, visit the nearest NCCIA circle office (there are circles in major cities, including the Islamabad Circle that investigated this case), or file a complaint through its online complaint portal. Keep all evidence — screenshots, receipts, chat records — when you file.

Q: What punishment can online investment fraud carry in Pakistan? A: Several. Under the Prevention of Electronic Crimes Act 2016, electronic fraud and spoofing can carry up to seven years' imprisonment plus fines. Under the Pakistan Penal Code, cheating (Section 420) carries up to seven years' imprisonment and a fine, and criminal breach of trust carries even longer sentences in some cases. Where several people act together, Section 34 PPC makes each one liable for the whole scheme. In this case the court awarded seven years to each convict plus Rs250,000 in combined fines — at the top of these ranges.

Q: I sent money to a fraudulent investment app. Can I get it back? A: It is difficult but not impossible, and speed matters. Inform your bank immediately and file an NCCIA complaint with all your transaction records — prompt complaints improve the chances of tracing transferred funds before they are dissipated. During the criminal case, courts can order fines and compensation. For recovery of the actual money, you may also need to file a civil suit for recovery against the accused and any identified accounts or assets. A lawyer can advise on the best route in your specific case.

Q: How do I check whether an investment platform is legitimate? A: Verify independently, never through the platform's own claims. Check whether the company is licensed or registered with the relevant regulator — the securities regulator for brokers and investment firms, the State Bank for banks. Call the institution through its officially published contact details, not numbers provided by whoever is pitching you. Search for the platform's name alongside words like "fraud," "complaint" and "scam." And remember the regulator's standing warning: beware platforms that promise guaranteed returns, impersonate legitimate businesses, and advertise through social media or private messaging groups.

Q: Are foreign nationals involved in online fraud punished in Pakistan? A: Yes. Pakistani courts have jurisdiction over offences committed in Pakistan (or targeting victims in Pakistan) regardless of the accused's nationality, and foreign nationals are routinely prosecuted and convicted — as this case shows, with the foreign convict receiving the same seven-year sentence as the two Pakistanis. After serving their sentences, foreign convicts are typically deported.

Q: What is the difference between the NCCIA and the FIA's cybercrime wing? A: The FIA's cybercrime wing was Pakistan's original cybercrime investigator. The NCCIA was established as a separate, dedicated agency to take over and strengthen the cybercrime investigation mandate, with its own structure of circle offices (such as the Islamabad Circle). For practical purposes, if you are a victim of cybercrime today, the NCCIA — helpline 1799 — is the agency to approach.

The Bottom Line

Three people are going to prison for seven years each because one victim's complaint was investigated properly. That is the whole story in one line — and it is why this verdict belongs on the front page of every legal publication in the country. The NCCIA's Islamabad Circle, with Sub-Inspector Shehroz Riaz presenting the evidence, turned a fake banking app and Rs19.391 million in stolen money into a conviction with real prison time for two Pakistanis and a foreign national, plus Rs250,000 in fines.

For readers, the case carries two messages. The first is for potential victims: the red flags listed above — guaranteed returns, fake apps, pressure tactics, demands for your OTP — are not exotic. They are the exact playbook used in a fraud worth nearly twenty million rupees. Learn them, and share them with family members who are less familiar with digital finance. The second is for actual victims: complain, and complain fast. The evidence you preserve in the first hours — screenshots, receipts, transaction records — is what an investigator turns into a court case. The NCCIA's helpline is 1799. Use it.