Financial fraud in Pakistan now moves at the speed of a mobile app. A single phishing link, a cloned SIM, or a leaked OTP can drain an account in minutes. The good news is that Pakistani law gives victims a clear, layered response - but almost every remedy depends on how quickly you act. This guide walks you through the immediate legal steps, the regulators and laws that protect you, and how to recover your money.
The first hours: freeze the money trail
Speed decides whether funds can be intercepted. The moment you spot an unauthorised debit, phishing loss, or scam transfer, do the following in order:
- Call your bank's helpline and ask them to block your card, freeze the account or suspend digital banking access immediately.
- Give written intimation to the bank the same day - email or a branch letter stating the transaction is unauthorised. This written notice is what preserves your right to compensation.
- Preserve every trace of evidence: SMS alerts, transaction IDs, screenshots, the fraudster's number or IBAN, and any chat or call logs. Do not delete anything.
- Change passwords and PINs for banking, email and any linked accounts, and reset your SIM if a number was compromised.
Why the written notice matters: a bank generally cannot freeze funds on its own initiative without a court order or a directive from a regulator such as the NCCIA or NAB. Your prompt written complaint is what triggers the bank's duty to act and to block the beneficiary account.
Who you report to, and for what
Pakistan splits fraud reporting across several bodies. Sending your complaint to the right one avoids weeks of delay:
| Type of fraud | Where to report | Governing law |
|---|---|---|
| Online scam, phishing, hacked account, OTP fraud | NCCIA (helpline 1799 / online portal) | PECA 2016, Section 14 |
| Unauthorised bank debit, card skimming, service failure | Your bank, then the Banking Mohtasib | SBP rules; Banking Companies Ordinance 1962 |
| Cheating, fake investment, offline swindle | Local police - register an FIR | PPC Section 420 |
| Dishonoured cheque given to defraud | Police / court | PPC Section 489-F |
| Loan or finance dispute with a bank | Banking Court | Financial Institutions (Recovery of Finances) Ordinance 2001 |
Note the 2026 change: the FIA Cyber Crime Wing has been replaced by the autonomous National Cyber Crime Investigation Agency (NCCIA), which now handles cyber-enabled financial fraud. Filing an NCCIA complaint is free.
Reporting cyber fraud to the NCCIA
Most modern financial fraud is cyber-enabled, so the NCCIA is your primary criminal reporting route. Prepare a complete file before you submit:
| Document | Why it is needed |
|---|---|
| CNIC and contact details | Identifies you as the complainant |
| Bank statement showing the debit | Proves the loss and its exact timing |
| Screenshots of messages, links, or fake pages | Establishes the fraudulent method |
| Fraudster's phone number, IBAN or account title | Lets investigators trace the beneficiary |
| Written description of the incident | Forms the basis of the inquiry and any FIR |
Under Section 14 of PECA 2016, electronic fraud carries up to two years imprisonment or a fine of up to PKR 10 million, or both. Well-preserved digital evidence such as WhatsApp chats and screenshots is often decisive in these cases.
Getting the bank to compensate you
For unauthorised transactions, your money-back route runs through the bank first and the Banking Mohtasib second. The State Bank of Pakistan's BPRD Circular 04 of 2023 requires banks and microfinance banks to compensate customers for fraudulent or unauthorised digital transactions, provided the customer reported promptly and did not act negligently (for example, by sharing an OTP willingly).
The escalation sequence is strict, so follow it in order:
- Step 1 - Complain to the bank in writing and keep the acknowledgement. The bank has 45 days to respond.
- Step 2 - Escalate to the Banking Mohtasib if the reply is unsatisfactory or none arrives, within a further 45 days. The Mohtasib has jurisdiction over fraudulent or unauthorised withdrawals and debit entries.
- Step 3 - Pursue civil or banking-court recovery if the sum is large or the bank is at fault for delay.
Bank liability for delay: if a bank receives your complaint and delays blocking the beneficiary account, it can be held liable to compensate you for the resulting loss. This is exactly why same-day written notice is so powerful.
When to register an FIR
An FIR (First Information Report) is the formal start of a criminal case. Register one where there is a clear cognisable offence - a fake investment scheme, an impersonation scam, a dishonoured cheque issued to cheat you, or a large organised fraud. Offline cheating is charged under PPC Section 420, and a cheque dishonestly issued and bounced falls under PPC Section 489-F, which our guide to cheque bounce cases explains in detail. For cyber fraud, the NCCIA registers the FIR under PECA once its inquiry establishes an offence.
Recovering your money
Recovery usually comes through one of three channels, and they can run in parallel:
- Bank reversal / SBP compensation - fastest where you reported promptly and the beneficiary account was frozen in time.
- Banking Mohtasib award - free, and effective for service failures and unauthorised debits.
- Court recovery - a civil suit for the sum, or a Banking Court claim under the Financial Institutions (Recovery of Finances) Ordinance 2001 where a financial institution is involved.
Read our companion guides on recovering money lost to online fraud and filing banking complaints with the Mohtasib for the step-by-step mechanics of each route.
Frequently asked questions
What is the very first step after financial fraud?
Call your bank the same hour to block the card and freeze the account, then send written notice of the unauthorised transaction. Prompt written intimation protects your right to compensation.
Where do I report online fraud in Pakistan?
To the NCCIA, which replaced the FIA Cyber Crime Wing in 2026 - via its online portal or helpline 1799. Bank service failures go to the Banking Mohtasib.
Will the bank refund my money?
Under SBP BPRD Circular 04 of 2023, banks must compensate customers for unauthorised digital transactions where you reported promptly and were not negligent, such as by sharing an OTP.
What is the punishment for electronic fraud?
Section 14 of PECA 2016 provides up to two years imprisonment or a fine of up to PKR 10 million, or both. Offline cheating is charged under PPC Section 420.
How long does the Mohtasib process take?
The bank gets 45 days to respond; if unsatisfactory, you file with the Mohtasib within a further 45 days. Most cases resolve within a few months.
Can I claim my money back through court?
Yes - through a civil suit or a Banking Court claim under the Financial Institutions (Recovery of Finances) Ordinance 2001 where a bank is involved.