PECA 2016 is the Prevention of Electronic Crimes Act, 2016, Pakistan's main law against crimes committed through phones, computers and the internet. It punishes hacking, electronic fraud, identity theft, online harassment, cyberstalking and the spreading of false information, with prison terms that run from a few months to 14 years depending on the offence. Since 2025, complaints under the Act are investigated by the National Cyber Crime Investigation Agency (NCCIA), which replaced the Federal Investigation Agency's Cyber Crime Wing. The law returned to the headlines in November 2026, when the NCCIA arrested 273 people in a raid on a call centre in Karachi accused of defrauding people abroad.

PECA is a federal law, formally Act No. XL of 2016, and it applies across all four provinces, Islamabad Capital Territory and, in relevant cases, to conduct committed outside Pakistan that targets people or systems inside the country. It works alongside the older criminal codes, the Pakistan Penal Code 1860 and the Code of Criminal Procedure 1898, so a single online incident can attract both a PECA charge and an ordinary criminal charge such as extortion or fraud. Almost every serious online problem in Pakistan, from a hacked account to a blackmail attempt, a fake profile or a fraudulent bank transfer, falls under this one statute.

What offences does PECA 2016 cover?

PECA groups electronic crimes into a few broad families. The most commonly reported are unauthorised access and hacking, meaning getting into an account, system or database without permission, covered by Sections 3 to 5; attacks on critical infrastructure such as banking, power or government systems, covered by Sections 6 to 8; cyber terrorism, meaning using electronic systems to spread terror or coerce the state, covered by Section 10; electronic forgery and fraud, meaning forging electronic documents or dishonestly obtaining money or data online, covered by Sections 13 and 14; and offences against a person, including harming someone's dignity, modesty or privacy through revenge content and doctored images, covered by Sections 20 and 21. Child sexual abuse material and cyberstalking, covered by Sections 22 and 24, are among the most seriously punished offences, and Section 26A, added by the 2025 amendment, covers spreading content known to be false that causes fear, panic or unrest.

The penalties, as summarised by the legal guide LegalPK, are indicative maximums, and several figures were revised by the 2025 amendment, so a court applies them to the facts of each case. Unauthorised access, copying or interference with data under Sections 3 to 5 carries up to two years' imprisonment and a fine. Unauthorised access to critical infrastructure under Section 6 carries up to three years and a fine of up to one million rupees. Cyber terrorism under Section 10 carries up to 14 years' imprisonment and a heavy fine, up to 50 million rupees. Electronic fraud under Section 14 carries up to two years and a fine of up to 10 million rupees. Offences against a person's dignity under Section 20 carry up to three years and a fine of up to one million rupees. Offences against the modesty of a person or a minor under Section 21 carry five to seven years and a fine of up to five million rupees. Child sexual abuse material under Section 22 carries up to seven years and a fine of up to five million rupees. Cyberstalking under Section 24 carries up to three years and a fine of up to one million rupees. Spreading false information under Section 26A carries up to three years and a fine of up to two million rupees.

Some PECA offences are bailable and others are not, and the position can turn on the specific section and the facts. Section 21, which covers photo blackmail, video blackmail, sextortion and intimate image threats, is non-bailable and non-compoundable, meaning the state continues the prosecution even if the victim later wants to withdraw. The same applies to the child protection sections. Other offences, including identity theft, defamation, cyberstalking and cyberbullying, are bailable, which affects the arrest procedure rather than whether the conduct is criminal.

What is the NCCIA and how do you report a cybercrime?

The National Cyber Crime Investigation Agency was set up under Section 51 of PECA and, since 2025, has replaced the FIA's former Cyber Crime Wing, known as the NR3C, as the body that registers and investigates cybercrime complaints nationwide. The FIA's wider work continues, but PECA complaints now go to the NCCIA. A complaint can be filed free of charge through the NCCIA portal at complaint.nccia.gov.pk, and the agency lists 1799 as its round-the-clock helpline. Complaints can also be made by email to the NCCIA helpdesk, through the Pakistan Citizen Portal, or in person at the nearest Cyber Crime Reporting Centre.

The first step is to preserve evidence before anything else: save screenshots, URLs, usernames, phone numbers, chat logs and transaction records, and do not delete the offending messages, because deleting a conversation destroys the evidence the investigation needs. A written complaint should state the complainant's name, address, CNIC number and contact details, and exactly what happened, with dates, and attach the CNIC and the evidence. The complainant should note the complaint number and follow the inquiry as it moves toward an FIR, the First Information Report that formally opens a criminal case, and then investigation and trial. A lawyer is not required to file a complaint, although legal help matters in serious or contested cases. Complaints generally require the complainant's identity and CNIC, so they cannot usually be made anonymously. PECA can also reach conduct aimed at people or systems inside Pakistan even where the offender is abroad, although enforcement then depends on cooperation between agencies.

What happened in the Karachi call centre raid?

The largest recent test of PECA came in Karachi in November 2026. The NCCIA says it arrested 273 people at a call centre operating as Voxtron Solutions from a building near Kavish Crown Plaza on Sharea Faisal, in the PECHS area of Karachi. The agency dates the raid to 4 November, although eyewitnesses told reporters that officers arrived on the evening of 3 November. Investigators seized 339 laptops, 152 mobile phones and four desktop computers, and the case is registered under six sections of PECA covering fraud, forgery, identity misuse and spoofing by electronic means.

According to the agency, staff rang people overseas while pretending to be foreign banks or debt validation firms, offering to check their outstanding debts. The NCCIA says it has reasonable grounds to believe the real aim was to collect Social Security numbers and payment card credentials, then use them for unauthorised payments through merchant accounts, with the takings sent home through accounts held by firms and money-transfer services. The agency has not said which foreign banks or customers were impersonated, how much money moved, or when charges will be formally framed. Additional Director Shahzad Akbar said more than 100 of those held are women and 42 are minors, and that by his estimate about 350 scam call centres operate in Karachi, with Voxtron ranked among the top three. He also said it was the first case in which ordinary employees were named alongside the owner, because earlier cases charged owners only, and their relatives then reopened under new company names with the same staff.

At a hearing the same day, nine main suspects were sent to the NCCIA for two days of further questioning. Lawyers for the accused said more than 70 of the detainees were juveniles and more than 80 were women, and that the charges allow bail. The magistrate agreed for women and under-18s, who can go home on surety bonds of 5,000 rupees each, subject to age verification through NADRA records, while everyone else went to jail on judicial remand. By 11 November a court had granted bail to the last nine suspects as well, at 200,000 rupees surety each, after the earlier 264 had been released. The Sindh Home Department turned the call centre itself into a sub-jail, so that is where the 273 were held. An arrest is not a finding of guilt, and the investigation is continuing.

How big is the crackdown behind the raid?

The Karachi raid was part of a wider enforcement drive. The NCCIA reported that in 53 days of activity across the country it arrested 1,749 suspects and recovered 149.8 million rupees, receiving 10,386 complaints, initiating 6,672 inquiries and registering 442 cases. Action against suspected illegal call centres accounted for 59 raids, 43 cases and 973 arrests. The operations extended from Islamabad, Rawalpindi, Lahore, Karachi, Faisalabad and Abbottabad to other cities, and covered suspected illegal call centres, online financial fraud, identity misuse, harassment and offences targeting women and children. The figures describe reported enforcement activity and recoveries rather than completed court outcomes, and individual operations cannot simply be added to the 53-day totals, because the agency has not published a case-by-case reconciliation identifying overlaps.

The drive has also drawn criticism. The Pakistan Software Houses Association, P@SHA, said on 9 November 2026 that NCCIA teams had raided legitimate software houses and call centres without showing warrants, held staff for hours, and seized laptops, servers and mobile phones even when investigators found nothing unlawful. The association, which puts Pakistan's IT exports at a record 4.6 billion dollars, asked for court warrants to be shown at the start of every search of a registered IT firm, for checks against Pakistan Software Export Board and P@SHA registration before action, and for a joint grievance panel. Defence counsel in the Karachi case also argued that the raid was conducted without the permission required under Section 33 of PECA. The NCCIA had not replied to P@SHA's statement at the time of reporting, and the tension between a crackdown on fraud and protection for legitimate businesses is now part of the public debate around the law.

What did the 2025 amendment to PECA change?

The 2025 amendment to PECA was significant and controversial. Its headline change was Section 26A, a new offence of intentionally disseminating false or fake information through any information system, knowing or having reason to believe it is false, and likely to cause fear, panic, disorder or unrest among the public, punishable by up to three years' imprisonment or a fine of up to two million rupees. The amendment also created a new regulatory authority to oversee social media content and order takedowns, and a Social Media Protection Tribunal to hear appeals against the authority's decisions. Rights groups have criticised Section 26A as vague and open to misuse against journalists and critics, and anyone facing a Section 26A complaint is advised to get specialist legal advice quickly rather than acting on general commentary.

The amendment also matters for the Karachi case, because it is the framework under which the NCCIA now operates as a standalone agency rather than as a wing of the FIA, and because it raised some of the fines attached to existing offences. Anyone relying on a specific penalty figure should confirm the current position with a lawyer, because the law has been amended more than once and courts apply the figures to the facts of each case.

Frequently asked questions

Do I need a lawyer to file a cybercrime complaint in Pakistan? No. A complaint can be filed with the NCCIA free of charge through complaint.nccia.gov.pk, with a CNIC and digital evidence. A lawyer helps by drafting a precise complaint, presenting evidence correctly and representing the complainant at trial, which matters in serious or contested cases.

Is the FIA still involved in cybercrime? The FIA's Cyber Crime Wing has been dissolved and its cases transferred to the NCCIA. The wider FIA still handles other federal offences, but PECA complaints now go to the NCCIA.

How long does a cybercrime case take? It varies widely. A simple inquiry may be resolved in weeks, while a contested case that goes to trial can take much longer. Preserving good evidence early speeds things up.

Can I report a cybercrime anonymously? Complaints generally require the complainant's identity and CNIC so the agency can act and take statements. Details are handled by the investigating agency rather than published to the public.

What should I do if someone is blackmailing me with photos online? Do not pay and do not delete the messages. Save screenshots showing the profile name, handle and date, keep the URLs and phone numbers used, and report to the NCCIA. Photo blackmail falls under Section 21 of PECA, which is non-bailable and carries up to five years' imprisonment, or seven years where the victim is a minor.