On 20 October 2026, the National Cyber Crime Investigation Agency (NCCIA) released its first performance report since Director General Syed Ali Nasir Rizvi took charge. The numbers tell a striking story: in one month, the agency received 5,176 cybercrime complaints and registered 4,491 inquiries — but only 272 cases became FIRs. It arrested 1,129 accused persons across the country and says it recovered Rs 105.3 million and returned it to victims.

If you have ever filed a cybercrime complaint in Pakistan — or are thinking of filing one — these figures raise the obvious question: what happens between your complaint and an FIR, and why do so few complaints become cases? This article walks through the PECA complaint journey, explains the numbers, and tells you what actually strengthens a complaint.

(A note on sources: the figures in this article come from the NCCIA's own performance report as published on 19–20 October 2026 and carried by Dawn and other outlets. One version of the report carried online gave the recovery figure as "PKR 10.53 million" — apparently a decimal-point typo; the majority of sources, including Dawn, report Rs 105.3 million, which is the figure used here.)

The Numbers, Explained

Start with the raw figures and what each stage means:

  • 5,176 complaints received — every report filed by a citizen: online, at an NCCIA reporting centre, or through the helpline.
  • 4,491 inquiries registered (86.8% of complaints) — the agency formally opened an inquiry file on nearly nine out of ten complaints. An inquiry is the preliminary stage: officers verify the complaint, collect basic evidence, and decide whether a cognizable cybercrime has been committed.
  • 272 FIRs (5.3% of complaints; 6.1% of inquiries) — only a small fraction crossed the threshold into a registered criminal case.
  • 1,129 arrests — notably, arrests outnumber FIRs by more than four to one. That is not a contradiction: a single FIR (for example, against a fraudulent call centre or a loan-app racket) can lead to dozens of arrests, as raids sweep up whole networks at once.
  • Rs 105.3 million recovered and returned to victims — the agency's claim for the month.

The headline statistic — 5.3% of complaints becoming FIRs — looks alarming at first glance. But it is less surprising once you understand what the inquiry stage is for.

The PECA Complaint Journey: Complaint → Inquiry → FIR

Pakistan's cybercrime law is the Prevention of Electronic Crimes Act, 2016 (PECA), and the NCCIA is the federal agency that enforces it. When you report a cybercrime, your complaint passes through three gates:

Gate 1: The complaint

You report the offence — online harassment, blackmail, financial fraud, fake social-media profiles, unauthorised access to your accounts, non-consensual intimate imagery, and the rest of PECA's catalogue. You can file through the NCCIA's online portal, visit a reporting centre in person, or call the helpline 1799.

At this stage, you are simply telling the agency what happened. Many complaints are incomplete: no screenshots, no transaction records, no URLs, no suspect identifiers. The agency logs them anyway — which is why the complaint count is the largest number.

Gate 2: The inquiry

An officer is assigned and opens an inquiry. This is the filtering and evidence-gathering stage. The officer will typically:

  • verify your identity and record your statement;
  • ask for digital evidence — screenshots, chat histories, call logs, bank transaction records, URLs, phone numbers;
  • trace the technical footprint where possible — IP addresses, account registration details, money trails;
  • determine whether the facts disclose an offence under PECA at all.

This is where most complaints stall or die. Common reasons: the evidence is too thin to identify anyone; the "offence" turns out to be a civil dispute (a business disagreement conducted over WhatsApp, for instance) rather than a cybercrime; the complainant stops cooperating; or the trail leads outside Pakistan's jurisdiction and the evidence needed is not obtainable.

An inquiry is not a case. No one is formally accused at this stage. It is the agency's way of asking: is there a crime here, and can we prove who did it?

Gate 3: The FIR

Only when the inquiry produces a cognizable offence with an identifiable suspect does the agency register a First Information Report. The FIR converts the matter into a formal criminal case: investigation with powers of arrest, seizure of devices, and eventual challan before the court.

The 6.1% conversion rate from inquiry to FIR tells you how demanding that threshold is. Cybercrime is, by nature, hard to attribute: fake accounts, spoofed numbers, VPNs, money mules, and servers abroad. An inquiry that cannot name the accused cannot become an FIR.

Why Most Complaints Never Become FIRs

The gap between 5,176 complaints and 272 FIRs is not, by itself, proof of failure. Several structural reasons explain it:

  1. Evidence problems. The single biggest killer of complaints. A victim of blackmail who deleted the chats, a fraud victim with no transaction receipt, a harassment complaint with no screenshots — without digital evidence, there is nothing to investigate.
  1. Jurisdiction problems. Many complaints involve offenders operating from abroad, or platforms that do not cooperate quickly. The NCCIA can only act within its legal reach.
  1. Non-criminal disputes. A significant share of "cybercrime" complaints are civil or family disputes wearing a digital mask — a partner who changed a shared account password, a business rival's bad review, a loan dispute argued over messages. These do not disclose PECA offences.
  1. Duplicate and frivolous complaints. Any high-volume reporting channel attracts them.
  1. Complainant dropout. Inquiries need the victim's continued cooperation — for statements, for device access, for court testimony later. Many victims disengage, especially in blackmail and harassment cases where stigma is involved.

None of this means the system is working well. An 86.8% inquiry rate with a 6.1% FIR conversion suggests the front door is wide open but the corridor is very narrow. The agency's own report does not say how many of the remaining inquiries are still open, were closed for lack of evidence, or are pending technical data — and that transparency gap matters, because a complaint that sits in "inquiry" limbo for a year is, for the victim, the same as no action.

What the Arrests and Recovery Figures Tell You

The 1,129 arrests against 272 FIRs — roughly four arrests per FIR — is the signature of raid-based enforcement: call-centre busts, loan-app networks, organised blackmail rings. One good FIR against an organised operation produces many arrests. This is also where the Rs 105.3 million recovery comes from: frozen and seized funds returned to victims of financial fraud.

For an ordinary victim of an individual harasser or a one-off fraud, these aggregate numbers are cold comfort. Organised-crime enforcement and individual-victim justice are different things, and the report's headline figures blend them together.

What Strengthens Your Complaint: A Practical Checklist

If you are filing — or have filed — a cybercrime complaint, the difference between the 93.9% that stall and the 6.1% that become FIRs is, more often than not, evidence and persistence. Here is what to do:

  1. Preserve everything before you file. Screenshot the chats, the profile, the number, the transaction. Save URLs. Do not delete anything — deleted evidence cannot be recovered by the inquiry officer.
  1. Keep the transaction trail. For financial fraud: bank statements, mobile-wallet receipts, the exact account numbers or wallet IDs money went to, dates and amounts. Money trails are the most productive evidence in cybercrime inquiries.
  1. Record the timeline. Write down, in order, what happened and when. Inquiry officers deal with hundreds of files; a clear written account moves yours faster.
  1. Identify the suspect if you can — safely. A name, a number, a profile link, a CNIC from a transaction — anything that turns an anonymous complaint into an attributable one. Do not confront the suspect yourself.
  1. File promptly. Digital evidence decays: accounts get deleted, numbers get changed, CCTV overwrites. Delay is the enemy of attribution.
  1. Follow up in writing. Note your complaint or inquiry number. Visit or call for status. Ask specifically whether technical data (IP logs, account information) has been sought — that is often the bottleneck.
  1. Use the helpline and the open courts. The NCCIA's helpline is 1799, and the agency says it is launching open-court sessions (khuli kachehris) where citizens can raise grievances directly. Use them — visibility moves files.
  1. For blackmail and harassment: do not pay, and do not stay silent. Paying a blackmailer never ends the blackmail; it marks you as a payer. And silence is what offenders count on. PECA has specific provisions for blackmail and for the non-consensual sharing of intimate imagery — the law is on your side, but only if you invoke it.

The Bigger Question the Report Raises

The NCCIA's first-month report is, to its credit, a public accounting — many agencies publish nothing at all. But a serious performance conversation needs more than totals. How many of the 4,491 inquiries are still open? What is the average time from complaint to FIR? How many of the 272 FIRs led to challans, and how many to convictions? And what happens to the complainant whose inquiry is closed — is there a review mechanism?

Until those questions are answered, the honest summary of the NCCIA's first month under its new DG is this: the front door works — 5,176 citizens were heard — but the corridor from complaint to case remains very narrow. For victims, the practical lesson is unchanged: your evidence, your promptness, and your persistence decide which side of the 6.1% you land on.

Frequently Asked Questions

Q: I filed a complaint weeks ago and heard nothing. What should I do? A: A: First, confirm your complaint or inquiry number. Then follow up with the NCCIA reporting centre or helpline 1799 in writing — ask for the current status of your inquiry and whether technical evidence has been sought. If the inquiry has been closed, ask for the reasons in writing; you are entitled to know. Silence from the agency is not a decision — make them give you one.

Q: Does the NCCIA need an FIR to arrest someone? A: A: For cognizable offences under PECA, the registration of the FIR is what formally opens the criminal case and unlocks powers of arrest and investigation. That is precisely why the inquiry-to-FIR threshold matters so much — without crossing it, the agency's coercive powers stay sheathed.

Q: Someone is blackmailing me with my photos. Will filing a complaint make it worse? A: A: This is the fear that keeps most blackmail victims silent — and it is exactly what blackmailers exploit. In practice, filing a complaint is what starts the process of identifying the blackmailer and stopping the extortion. PECA criminalises blackmail and the non-consensual dissemination of intimate images. Preserve the evidence, do not pay, and file promptly; delay only gives the offender more leverage.

Q: Can I file a complaint if the offender is outside Pakistan? A: A: You can file — the NCCIA logs the complaint and opens an inquiry. But be realistic: cross-border cases depend on mutual legal assistance and platform cooperation, which are slow. Your complaint still matters (it builds the intelligence picture and may connect to a domestic network), but the prospects of a quick FIR and arrest are lower than in domestic cases.

Q: What is the difference between the NCCIA and the old FIA Cybercrime Wing? A: A: The NCCIA is the dedicated federal agency now responsible for cybercrime investigation and enforcement under PECA, succeeding the role previously performed by the FIA's Cybercrime Wing. If you previously dealt with the FIA Cybercrime Wing, the NCCIA is now the address for new complaints.

The Bottom Line

This article provides general legal information for readers in Pakistan and is not legal advice. For advice about your own situation, consult a qualified advocate.