Almost every serious online problem in Pakistan - a hacked account, a blackmail attempt, a fake profile, a fraudulent bank transfer, an abusive campaign - falls under one statute: the Prevention of Electronic Crimes Act 2016. This guide explains the main offences PECA creates, the penalties attached to them, and the practical steps to report a cybercrime so the state actually opens a case. If a crime has also caused you loss, you may have a parallel civil remedy - see our guides on defamation and recovering money through the courts.
What is PECA 2016?
The Prevention of Electronic Crimes Act 2016 (Act No. XL of 2016) is Pakistan's principal cybercrime statute. It defines a range of electronic offences, gives investigators powers to seize devices and obtain data, and sets out how offenders are tried. It works alongside the older criminal codes - the Pakistan Penal Code 1860 and the Code of Criminal Procedure 1898 - so a single online incident can attract both a PECA charge and an ordinary criminal charge such as extortion or fraud.
PECA is federal law and applies across all four provinces, Islamabad Capital Territory and, in relevant cases, to conduct committed outside Pakistan that targets people or systems inside the country.
Key offences under PECA
PECA groups electronic crimes into a few broad families. The most common offences people report are:
- Unauthorised access and hacking - getting into an account, system or database without permission (Sections 3 to 5).
- Attacks on critical infrastructure - targeting banking, power or government systems (Sections 6 to 8).
- Cyber terrorism - using electronic systems to spread terror or coerce the state (Section 10).
- Electronic forgery and fraud - forging electronic documents or dishonestly obtaining money or data online (Sections 13 and 14).
- Offences against a person - harming someone's dignity, modesty or privacy, including revenge content and doctored images (Sections 20 and 21).
- Child abuse material and cyber stalking - among the most seriously punished offences (Sections 22 and 24).
- False information - spreading content known to be false that causes fear, panic or unrest (Section 26A, added in 2025).
PECA offences and penalties at a glance
The table below summarises the offences most often reported and the maximum penalties commonly associated with them. Treat these as a guide only: several penalty figures were revised by the 2025 amendment and courts apply them to the facts of each case. Always confirm the current position with a lawyer before relying on a specific figure.
| Section | Offence | Indicative maximum penalty |
|---|---|---|
| S.3-5 | Unauthorised access / copying / interference with data | Up to 2 years and/or fine |
| S.6 | Unauthorised access to critical infrastructure | Up to 3 years and/or fine up to PKR 1m |
| S.10 | Cyber terrorism | Up to 14 years and/or heavy fine |
| S.14 | Electronic fraud | Up to 2 years and/or fine up to PKR 10m |
| S.20 | Offences against dignity of a person | Up to 3 years and/or fine up to PKR 1m |
| S.21 | Offences against modesty of a person / minor | Up to 5-7 years and/or fine up to PKR 5m |
| S.22 | Child sexual abuse material | Up to 7 years and/or fine up to PKR 5m |
| S.24 | Cyber stalking | Up to 3 years and/or fine up to PKR 1m |
| S.26A | Spreading false information (2025) | Up to 3 years and/or fine up to PKR 2m |
Bailable or not? Some PECA offences are bailable and others are not, and the position can turn on the specific section and the facts. If you or a family member is arrested, read our guides on bail procedure and pre-arrest bail, and speak to a lawyer immediately.
How to report a cybercrime to the NCCIA
Since 2025 the National Cyber Crime Investigation Agency (NCCIA) - set up under Section 51 of PECA - has replaced the FIA's former Cyber Crime Wing (NR3C) and now registers and investigates cybercrime complaints nationwide. You do not need to visit an office to start; most complaints can be filed online. Here is the typical route:
| Step | What you do |
|---|---|
| 1. Preserve evidence | Before anything else, save screenshots, URLs, usernames, phone numbers, chat logs and transaction records. Do not delete the offending messages. |
| 2. Write the complaint | Draft a clear application in English or Urdu stating your name, address, CNIC, contact details and exactly what happened, with dates. |
| 3. File it online | Submit through the NCCIA portal at complaint.nccia.gov.pk, by email to the NCCIA helpdesk, or via the Pakistan Citizen Portal. Attach your CNIC and evidence. |
| 4. Or go in person | Visit the nearest Cyber Crime Reporting Centre and hand in the written complaint with copies of your CNIC and evidence. |
| 5. Track and follow up | Note your complaint number, respond to any request for further evidence, and follow the inquiry as it moves toward FIR and investigation. |
If a complaint becomes a full criminal case, it follows the ordinary path of investigation and trial. Our guides on how an FIR is registered and the criminal trial process explain what comes next.
Evidence that makes a complaint stick
Cybercrime cases live or die on digital evidence. Under the Qanun-e-Shahadat Order 1984, electronic records are admissible, but they must be preserved properly. Strong complaints usually include:
- Full-screen screenshots showing the profile name, handle and date - not just the message text.
- The exact URL or link to the offending post, page or profile.
- Phone numbers, email addresses and account IDs used by the offender.
- Bank statements, transaction IDs or payment receipts for any financial loss.
- A short timeline of events in the order they happened.
Do not confront or negotiate with a blackmailer, and do not pay. Preserve everything and report. Deleting the conversation to "make it stop" destroys the evidence the NCCIA needs to act.
What the 2025 amendment changed
The 2025 amendment to PECA was significant and controversial. Its headline changes were:
- Section 26A - a new offence of knowingly spreading false or fake information likely to cause fear, panic or unrest, punishable by up to three years imprisonment or a fine of up to PKR 2 million.
- A new regulatory authority to oversee social media content and order takedowns.
- A Social Media Protection Tribunal to hear appeals against the authority's decisions.
Rights groups have criticised Section 26A as vague and open to misuse against journalists and critics. Because this area is politically sensitive and still developing, anyone facing a Section 26A complaint should get specialist legal advice quickly rather than acting on general commentary.
Key terms explained
| Term | What it means |
|---|---|
| PECA | Prevention of Electronic Crimes Act 2016 - the core cybercrime law. |
| NCCIA | National Cyber Crime Investigation Agency - the body that now investigates PECA offences. |
| NR3C | The FIA's former National Response Centre for Cyber Crime, replaced by the NCCIA. |
| FIR | First Information Report - the formal record that opens a criminal case. |
| CNIC | Computerised National Identity Card - required to file a complaint. |
Frequently asked questions
Do I need a lawyer to file a cybercrime complaint?
No - you can file with the NCCIA yourself, free of charge. A lawyer helps by drafting a precise complaint, presenting evidence correctly, following the investigation and representing you at trial, which matters in serious or contested cases.
Is the FIA still involved in cybercrime?
The FIA's Cyber Crime Wing has been dissolved and its cases transferred to the NCCIA. The wider FIA still handles other federal offences, but PECA complaints now go to the NCCIA.
How long does a cybercrime case take?
It varies widely. A simple inquiry may be resolved in weeks, while a contested case that goes to trial can take much longer. Preserving good evidence early speeds things up.
Can I report anonymously?
Complaints generally require your identity and CNIC so the agency can act and take statements. Your details are handled by the investigating agency rather than published to the public.
What if the offender is outside Pakistan?
PECA can reach conduct aimed at people or systems inside Pakistan even where the offender is abroad, though enforcement then depends on cooperation between agencies. Report it anyway so a record exists.