PECA Cybercrime Offences in Pakistan (2026): Explained with Penalties & Your Rights

Quick answer: The Prevention of Electronic Crimes Act, 2016 (PECA) punishes hacking, online fraud, identity theft, cyber stalking, defamation, and the non-consensual sharing of private images with prison terms ranging from months to 14 years and fines up to Rs 50 million. The 2025 amendments added Section 26A against deliberately spreading false information online. Victims can complain free of cost to FIA Cybercrime (helpline 1991) or online, and most complaints begin with screenshots, the offender's profile links, and your CNIC.

What Exactly Is PECA, and Does It Apply to You?

PECA — the Prevention of Electronic Crimes Act, 2016 — is Pakistan's main law against crimes committed through phones, computers, and the internet. It applies to anyone in Pakistan, citizen or not, and to offences committed against Pakistanis from abroad. In plain terms: if someone hacks your WhatsApp, steals money through a fake call, stalks you on Instagram, posts your private photos without permission, or spreads lies about you online, PECA is the law that names the offence and fixes the punishment.

Mere tajurbe me aksar log samajhte hain ke online harassment "chhoti baat" hai aur police kuch nahi karegi. That assumption costs victims their evidence and their case. PECA offences carry real jail time, and FIA's cybercrime desks register thousands of complaints every year. The law is on your side — but only if you act quickly and keep your evidence intact.

A short warning before we go further: PECA cuts both ways. The same Act that protects you from a stalker can punish you if you forward fake news, share someone's private photos, or post defamatory content. Understanding both sides of this law is the safest thing you can do for yourself.

Which Offences Does PECA Punish? The Sections That Matter Most

PECA has over two dozen offences. You don't need to memorise them all — but the ones below cover nearly every complaint a normal person will ever face.

Hacking and unauthorized access (Sections 3–8)

Section 3 punishes unauthorized access to an information system or data — for example, guessing someone's password and opening their email or Facebook. Punishment: up to 3 months imprisonment, a fine of up to Rs 50,000, or both.

Section 4 goes further: unauthorized copying or transmission of data. If the hacker didn't just peek but copied your photos, chats, or contacts, this applies. Punishment: up to 6 months or a fine of up to Rs 100,000.

Section 5 covers interference with or damage to an information system or data — deleting someone's files, corrupting a database, or planting ransomware. Punishment: up to 2 years or a fine of up to Rs 500,000.

Sections 6–8 deal with the same acts against critical infrastructure information systems — power grids, banking systems, government networks. The punishments jump sharply: 3 to 7 years and fines up to Rs 10 million. Most readers will never touch these sections, but they explain why hacking a bank's system and hacking a friend's Instagram are treated very differently.

Online fraud and cheating (Section 14)

Section 14 — electronic fraud — is one of the most-used sections in Pakistan. It punishes anyone who, with dishonest intent, uses an information system to deceive and cause damage or wrongful gain. The classic cases: a fake call from someone pretending to be your bank asking for your OTP, a fraudulent online store that takes payment and never delivers, or a "foreign lottery" scam on WhatsApp. Punishment: up to 2 years imprisonment or a fine of up to Rs 10 million, or both.

Here's a practical point many victims miss: you don't need to know the fraudster's real name. FIA's technical teams trace phone numbers, bank accounts, and IP addresses. File the complaint with whatever you have — screenshots of chats, the phone number, the bank account or Easypaisa/JazzCash number you sent money to.

Identity theft (Section 16)

Section 16 punishes the unauthorized use of identity information — using someone else's name, photo, CNIC details, or login credentials without permission. Creating a fake Facebook profile with a girl's photos to harass her? That falls here, often together with Section 24 (stalking) and Section 21 (modesty). Punishment: up to 3 years or a fine of up to Rs 5 million.

Defamation and dignity (Section 20)

Section 20 punishes offences against the dignity of a natural person — in everyday language, online defamation. Posting a false post that damages someone's reputation, sharing an edited video to humiliate a colleague, or running a smear campaign on Facebook can land here. The 2025 amendments kept the maximum imprisonment at 3 years but raised the fine ceiling to Rs 2 million.

Two things worth knowing. First, truth is a defence — if what you posted is true and published for the public good, Section 20 doesn't apply. Second, PECA isn't your only remedy: you can also file a civil defamation suit for damages. For a fuller look at the civil side, see our guide on social media defamation in Pakistan.

Modesty, blackmail, and private images (Section 21)

Section 21 punishes offences against the modesty of a natural person and a minor — sharing, displaying, or transmitting sexually explicit images or videos of someone without consent, or blackmailing them with such material. This is the section behind most "photo/video leak" and sextortion cases. Punishment: up to 5 years or a fine of up to Rs 5 million; if the victim is a minor, up to 7 years.

If this is happening to you: do not pay the blackmailer, do not delete the chats, and go to FIA immediately. Mere tajurbe me aksar victims blackmailer ko paise de dete hain aur phir bhi photos delete nahi hotein. Payment never ends blackmail. A complaint does.

Cyber stalking (Section 24)

Section 24 punishes cyber stalking — repeatedly contacting, following, monitoring, or harassing someone online in a way that causes fear, distress, or apprehension. Dozens of threatening messages, fake accounts made to watch someone, tracking a woman's location through social media — all of it fits here. Punishment: up to 3 years or a fine of up to Rs 1 million.

Stalking cases need a pattern. Save everything: every message, every fake profile, every call log. One screenshot is a complaint; fifty screenshots are a conviction.

Hate speech and glorification (Sections 9 and 11)

Section 11 punishes hate speech — preparing or spreading information through an information system that advances interfaith, sectarian, or racial hatred. Punishment: up to 7 years or a fine, or both. Section 9 punishes the glorification of an offence — praising terrorism or terrorist acts online — with up to 5 years or a fine of up to Rs 10 million.

These sections are why you should think twice before sharing provocative religious or sectarian content "as a joke." The law doesn't care about your intent to be funny.

Terrorism-related offences (Sections 10 and 12)

Section 10 (cyber terrorism) punishes using information systems to advance terrorism — up to 14 years and a fine of up to Rs 50 million. Section 12 punishes recruitment, funding, and planning of terrorism through electronic means — up to 7 years. These are FIA and counter-terrorism territory, far beyond ordinary complaints, but they show how seriously the Act treats the top end of cybercrime.

The 2025 additions: Section 26A and the new regulator

In early 2025, Parliament amended PECA significantly. The headline change for ordinary citizens is Section 26A: whoever intentionally disseminates false or fake information through any information system, knowing (or having reason to believe) it is false, and likely to cause fear, panic, disorder, or unrest among the public, faces up to 3 years imprisonment or a fine of up to Rs 2 million.

Read that definition carefully — it has three locks, and all three must turn. The information must be (1) intentionally spread, (2) known or believed to be false, and (3) likely to cause public fear or unrest. Forwarding a rumour you genuinely believed is a different case from manufacturing a fake video of an "attack" to create panic. Still, the safest habit is simple: verify before you forward.

The same amendments created the Social Media Protection and Regulatory Authority, along with a complaint council and a tribunal, to regulate unlawful online content. Separately, cybercrime investigation functions have been moving to the National Cyber Crime Investigation Agency (NCCIA) — so if your local desk now says "NCCIA" instead of "FIA Cybercrime Wing," don't panic. Same complaint, same law, slightly reorganised machinery.

How Do You File an FIA Cybercrime Complaint? Step by Step

Filing costs nothing. There is no court fee, no stamp paper, no "chai pani" — anyone asking for money to register your complaint is running a scam of their own. Here is the real process:

Step 1 — Preserve your evidence first (same day). Before anything else, screenshot everything: the offending posts, profiles, chats, and call logs. Make sure each screenshot shows the date, time, URL or phone number, and the offender's profile. Record your screen if content might be deleted. Do NOT delete or block the offender yet — deleted chats are dead evidence. Timeline: 30 minutes of your time. Cost: zero.

Step 2 — File online or visit a reporting centre (Day 1). You have two routes. Online: the FIA Cybercrime reporting portal lets you submit a complaint from anywhere in Pakistan — fill in your details, describe the offence, and upload your screenshots. In person: visit a Cybercrime Reporting Centre in Islamabad (HQ), Karachi, Lahore, Peshawar, or Quetta. Bring your original CNIC and your evidence on a USB drive or printed. You'll give a written application addressed to the in-charge, describing what happened in your own words. Timeline: complaint registered the same day. Cost: zero. If you want the full walkthrough with screenshots of the portal, see our detailed FIA Cybercrime complaint guide.

Step 3 — Verification call and initial inquiry (Days 2–7). An inquiry officer usually calls to verify your complaint and may ask you to visit for a statement. They'll examine your device if needed — bring the phone or laptop on which the offence occurred. Timeline: typically within a week of filing. Cost: zero.

Step 4 — Technical investigation (Weeks 2–8). This is the slow part. The team traces numbers, IP addresses, fake profiles, and money trails; they may write to PTA, NADRA, banks, or social media companies for subscriber data. Straightforward cases (a local harasser using his own number) move fast. Anonymous or foreign-based offenders take longer. Realistic timeline: 2 to 8 weeks for the inquiry stage.

Step 5 — FIR and challan (if the offence is made out). When the inquiry confirms an offence, a formal case (FIR) is registered and the investigation proceeds like a regular criminal case — arrest where needed, seizure of devices, and finally a challan (charge sheet) before the designated court. If a parallel police FIR is relevant to your situation, our article on how to file an FIR in Pakistan explains that route too.

Step 6 — Trial before the designated court. PECA cases are tried by designated courts (Sessions judges designated by the High Courts). You, as the complainant, are a prosecution witness — keep your evidence and attend hearings. Convictions take time; persistence wins.

One caution: most PECA offences are treated as cognizable and non-bailable under the Act's Schedule, which is why offenders take these complaints seriously — and why you should too. Ask your lawyer to confirm the current position for your specific section.

What Documents Do You Need? The Checklist

Walk into the reporting centre (or the online portal) with these ready and your complaint will move twice as fast:

  • Your CNIC (original for in-person, copy for online) — the complaint must be in your own name
  • Written application describing the incident: who, what, when, how — in simple words, no legal language needed
  • Screenshots of the offending content with visible dates, times, URLs, and phone numbers
  • Profile links or usernames of the offender's accounts (Facebook, Instagram, TikTok, WhatsApp number)
  • Call logs if threats came by phone
  • Bank statement or transaction receipts (for fraud cases) — the account number you paid into, Easypaisa/JazzCash transaction IDs, dates and amounts
  • The device on which it happened — phone or laptop, for technical examination if required
  • SIM ownership proof if the number used is registered in your name (or a relative's)
  • Any prior complaints — if you already reported to PTA, the platform, or local police, bring copies

Photocopies of everything, plus one set kept at home. Mere tajurbe me aksar complainants apne original screenshots wala phone kho dete hain ya reset kar dete hain — keep a backup of your evidence in Google Drive or email it to yourself on day one.

What Mistakes Do Victims Usually Make? (Learn From Others' Losses)

Mistake 1: Deleting the evidence. The first thing most victims do is delete the abusive chats or block the harasser "to get peace." Then they file a complaint with nothing to show. Block after you've saved everything — not before.

Mistake 2: Paying the blackmailer. As said above, payment never ends extortion. It marks you as someone who pays. Every rupee you send is also a money trail you could have given FIA instead.

Mistake 3: Waiting months to complain. Digital evidence decays: numbers get changed, accounts get deleted, CCTV-like logs expire. A complaint filed in week one is worth ten filed in month six.

Mistake 4: Posting about the case publicly. Naming the accused on Facebook while your complaint is pending can backfire — it can become a Section 20 defamation complaint against you, and it alerts the offender to destroy evidence. Let the inquiry work quietly.

Mistake 5: Sharing OTPs and bank details with "FIA officers" who call you. Real FIA officers don't ask for your OTP on the phone. Fraudsters impersonate FIA, banks, and even army officers. Verify any such call by dialling the official helpline 1991 yourself.

Mistake 6: Filing in someone else's name. The complaint must be filed by the victim (or a blood relative with authority). A friend can't file for you, and a vague "on behalf of" application gets stuck at verification.

Real-Feeling Examples: How These Cases Actually Look

Ayesha, Lahore — cyber stalking (Section 24). Ayesha, a 24-year-old teacher in Johar Town, Lahore, broke off contact with a former classmate. He then created three fake Instagram accounts, messaged her 40–50 times a day, and showed up in the comments of every photo she posted. She saved every message with timestamps, noted the fake profile URLs, and filed at the Lahore Cybercrime Reporting Centre. The inquiry traced all three accounts to one phone number — his. The pattern of repeated contact is what made it stalking, not any single message.

Bilal, Karachi — WhatsApp hacking and fraud (Sections 3 and 14). Bilal, a shopkeeper in Saddar, Karachi, got a call from someone claiming to be from his bank's "head office," warning that his account would be blocked. He shared the OTP. Within an hour, Rs 85,000 was gone. He filed the same evening with screenshots of the caller's number and his bank statement showing the debit. FIA traced the receiving Easypaisa account. Lesson: he acted the same day, and the money trail was still warm.

Imran, Peshawar — fake profile and blackmail (Sections 16 and 21). Someone made a Facebook profile using Imran's cousin's photos and began demanding money from her contacts, threatening to post edited pictures. She did not pay. Her brother filed the complaint with the fake profile's URL and screenshots of the threats. The account was traced and taken down during the inquiry. The family kept quiet on social media throughout — no public posts, no warnings to the blackmailer.

Sana, Islamabad — online shopping fraud (Section 14). Sana ordered a branded handbag worth Rs 22,000 from an Instagram page with 40,000 followers. The page vanished after payment. She filed online with the page's URL (archived screenshots), the JazzCash transaction ID, and the chat history. Many such pages are run from the same few numbers — your complaint may join an existing investigation and strengthen it.

Frequently Asked Questions

Can I file a cybercrime complaint online from anywhere in Pakistan? Yes. The FIA Cybercrime online reporting portal accepts complaints from every city — you don't need to travel to Islamabad, Karachi, Lahore, Peshawar, or Quetta. Upload your CNIC copy, describe the incident, and attach screenshots. You'll get a complaint number for tracking, and the inquiry officer will call you for verification.

Someone is blackmailing me with my photos. What should I do first? Don't panic, don't pay, and don't delete anything. Screenshot every threat with the sender's number or profile visible, save the images they're using against you, and file your complaint the same day — online or at the nearest reporting centre. Section 21 punishes this with up to 5 years in prison, and quick complaints get the fastest technical tracing.

I shared my bank OTP with a fraudster. Can PECA help me get my money back? PECA punishes the fraudster under Section 14 (up to 2 years, fine up to Rs 10 million), and FIA can trace where your money went — but recovery isn't guaranteed, especially if it was withdrawn quickly. Your best shot is filing within hours with your bank statement and the fraudster's number, and simultaneously asking your bank to flag the transaction.

Can I be punished for forwarding a WhatsApp message? You can, if the message is deliberately false and likely to cause public fear or panic — that's Section 26A (up to 3 years, Rs 2 million fine). Ordinary forwarding of news or opinions isn't an offence. The practical rule: if a message claims something alarming and you can't verify it, don't forward it. Thirty seconds of checking beats three years of explaining.

What is the punishment for defaming someone on Facebook under PECA? Section 20 provides up to 3 years' imprisonment or a fine of up to Rs 2 million, or both, after the 2025 amendments. Truth published for the public good is a defence. Remember the victim can also sue you separately in a civil court for damages — one careless post can mean two cases.

The harasser used a fake account. Can FIA still trace them? Usually, yes — fake accounts still leave trails: the phone number or email used to register, the IP address, the device, and linked payment accounts. FIA writes to PTA, NADRA, and the social media companies for this data. It takes longer than tracing a real number, but anonymity online is thinner than most offenders think.

How long does an FIA cybercrime inquiry take? Simple cases with a local offender and clear evidence: a few weeks. Cases needing data from foreign social media companies or banks: two to three months or more. File early, respond promptly when the inquiry officer calls, and keep your evidence organised — complainants who go silent slow their own cases down.

Is it really free to file a complaint? Completely free — no fee at the reporting centre, no fee on the portal, no stamp paper. You'll only spend money if you hire a private lawyer to draft applications or follow the trial, which is optional at the complaint stage. Anyone demanding payment to "register" your complaint is a fraudster; report them on 1991.

What if the FIA doesn't act on my complaint? First, follow up with your complaint number — delays are often about workload, not refusal. If you're genuinely being ignored, you can approach the Sessions court or the High Court: a writ petition can seek directions for proper investigation. Keep copies of everything you've filed; courts take a documented paper trail seriously.

Can I withdraw my cybercrime complaint later? This is tricky. Most PECA offences are non-compoundable under the Act's Schedule, meaning the state prosecutes them and you can't simply "take the case back" the way you might in a minor dispute. Think of filing as a serious step, not a pressure tactic — file when you genuinely want the offender punished.

The Bottom Line

PECA is one of the strongest consumer-protection tools an ordinary Pakistani has — most people just don't know it exists until they need it. Save your evidence, file early, file free, and let the law do what it was written to do. And stay on the right side of it yourself: verify before you forward, never share anyone's private images, and think twice before posting in anger. If a cybercrime has already happened to you or someone in your family, the worst option is doing nothing. The second worst is waiting.