This article deliberately does not print a table of years and rupee amounts against each section. PECA has been amended and the schedule of punishments is exactly the kind of detail that goes stale. What is stable, and more useful, is understanding which conduct falls where and what each side needs to prove or answer.
How the offences group
| Group | Conduct covered |
|---|---|
| Access offences | Unauthorised access to information systems and data |
| Interference offences | Damaging, altering or disrupting systems and data |
| Critical infrastructure | The same conduct against protected systems - heavier penalties |
| Electronic fraud and forgery | Deception for gain by electronic means |
| Identity crime | Misuse of another person's identity information |
| Dignity and modesty | Offences involving intimate images and reputational harm |
| Harassment and stalking | Cyberstalking, intimidation and repeated contact |
| Device and code offences | Malicious code, and tools made for committing offences |
Two aggravating themes run through the Act: conduct against critical infrastructure, and offences involving minors. Both attract materially heavier treatment than the same conduct in an ordinary context, and both change the seriousness of a matter substantially.
How penalties are structured
- Fines, imprisonment, or both, depending on the offence.
- Graduated severity - access offences sit below interference, which sits below critical infrastructure.
- Fraud and identity offences attract heavier treatment than simple unauthorised access.
- Offences involving minors are treated most seriously.
- Some offences are compoundable; others are not.
- Bailability varies by offence - take advice on the specific section.
Confirm the current text of the relevant section on Pakistan Code or through a lawyer before relying on any figure. PECA has been amended, and quoting a superseded penalty in a complaint or a defence is worse than quoting none.
What a complainant should understand
- Identify the conduct precisely - which of the groups above does it fall into?
- Preserve evidence immediately - screenshots with URLs and timestamps, message exports.
- Record every identifier - handles, numbers, accounts, transaction IDs.
- Report to the platform as well, for removal.
- File with the FIA cybercrime wing.
- Report to your bank in parallel where money moved.
- Expect to attend and give evidence.
See filing a complaint and what happens afterwards.
If you are the accused
- Instruct a lawyer before responding to any notice or summons.
- Take advice on bail promptly - bailability varies by section.
- Do not delete anything. Deletion after notice is its own problem.
- Do not contact the complainant without advice.
- Preserve your own devices and records, which may exonerate you.
- Establish who had access to the account or device.
- Do not give informal explanations to investigators without representation.
Shared accounts and devices are a genuine and frequent issue. Where a household or workplace device was used by several people, establishing who actually had access at the relevant time can be central - but that evidence degrades quickly, so raise it with a lawyer at once.
Offences against dignity and intimate images
These matters are among the most damaging to victims and among the most time-critical.
- Report immediately - to the FIA and to the platform.
- Preserve evidence before content is removed, including URLs and account details.
- Do not engage with the offender or pay any demand.
- Ask about removal and content blocking routes.
- Take advice on protective measures.
- Seek support - these matters carry a real personal toll.
Never pay a sextortion demand. Payment funds the operation and signals that more can be extracted; demands almost invariably continue. Report it instead - see reporting cyber harassment and hacked account recovery.
What PECA does not solve
| Situation | Position |
|---|---|
| Anonymous overseas offender | Identification is often not achievable |
| Records held by foreign platforms | Slow, through formal channels |
| Recovering money already moved offshore | Poor prospects |
| Ordinary defamation or content copying | Frequently a civil matter, not PECA |
| Commercial disputes dressed as fraud | Civil route is usually the right one |
| Late reporting | Evidence and funds are gone |
Where the conduct is a civil wrong rather than a PECA offence, the civil route is not a lesser outcome - it is the correct one. See content theft remedies.
Digital evidence: what actually holds up
PECA matters turn on electronic evidence, and how it was captured affects how much weight it carries.
- Full-screen captures showing the URL, account handle and timestamp, not cropped images.
- Native exports where a platform offers them, rather than photographs of a screen.
- The original device preserved rather than wiped or reset.
- Transaction records from the bank, with reference numbers.
- Contemporaneous notes of what happened and when.
- Third-party archives of public web pages.
- An unbroken account of who held the evidence and when.
The last point is worth understanding on both sides. Evidence that passed through several hands, was edited, or cannot be tied to a source is materially weaker - and a defence will say so.
Do not reset or factory-wipe a device involved in a complaint, whether you are complainant or accused. For a complainant it destroys the evidence; for an accused it looks like destruction of evidence and creates a separate problem on top of the original allegation.
Misuse of the complaint process
PECA complaints are sometimes filed to pressure someone in an unrelated dispute. If that is happening to you:
- Take it seriously anyway - a weak complaint still needs answering properly.
- Instruct a lawyer rather than trying to explain it away yourself.
- Assemble the context - the underlying dispute, the correspondence, the timing.
- Take advice on bail at once.
- Do not retaliate with a counter-complaint without advice.
- Preserve everything, including material that shows the wider dispute.
The timing of a complaint relative to an underlying commercial or family dispute is often the most telling context there is, and it is exactly what an unrepresented person fails to put before anyone. Set out the chronology properly, through a lawyer.
Frequently asked questions
What offences does PECA cover?
Unauthorised access and interference with systems and data, offences against critical infrastructure, electronic fraud and forgery, identity crime, offences against dignity and modesty, cyberstalking and harassment, and malicious code and device offences.
What are the punishments under PECA?
Fines, imprisonment or both, graduated by seriousness, with heavier treatment for offences against critical infrastructure, fraud and identity offences, and offences involving minors. Confirm the current text, as PECA has been amended.
Why does this guide not list the sentence for each section?
Because PECA has been amended and the schedule of punishments goes stale. Quoting a superseded penalty in a complaint or defence is worse than quoting none - confirm the current provision before relying on it.
What should a complainant do first?
Preserve evidence immediately with screenshots showing URLs and timestamps, record every identifier, report to the platform for removal, file with the FIA cybercrime wing, and report to your bank in parallel where money moved.
What should I do if I am accused?
Instruct a lawyer before responding, take advice on bail promptly as bailability varies by section, do not delete anything, do not contact the complainant, and preserve your own devices and records.
Someone is demanding money over intimate images. Should I pay?
No. Payment funds the operation and signals more can be extracted, and demands almost invariably continue. Report to the FIA and the platform immediately and preserve the evidence first.
Is every online wrong a PECA offence?
No. Ordinary defamation, content copying and commercial disputes are frequently civil matters. The civil route is not a lesser outcome in those cases - it is the correct one.
A PECA complaint has been filed to pressure me in another dispute. What now?
Take it seriously and instruct a lawyer. Assemble the underlying dispute, the correspondence and the timing - the chronology is often the most telling context, and it is what unrepresented people fail to put forward.
What digital evidence holds up?
Full-screen captures showing the URL, handle and timestamp rather than cropped images, native platform exports, the original device preserved, bank transaction records, contemporaneous notes and third-party web archives.
Should I reset my device?
No, whether you are complainant or accused. For a complainant it destroys the evidence; for an accused it looks like destruction of evidence and creates a separate problem on top of the original allegation.
Sources & official references
- PECA 2016 - the Prevention of Electronic Crimes Act
- FIA - cybercrime investigation and prosecution
- Supreme Court of Pakistan - judgments and case information