Online shopping has become part of everyday life in Pakistan. People now buy clothes, mobile phones, electronics, cosmetics, household items and even high-value products through websites, Instagram stores, Facebook pages, WhatsApp sellers and online marketplaces.

Most transactions are genuine. The problem begins when a seller uses the internet not simply to sell a product, but to deceive the buyer.

A customer may pay in advance and receive nothing. A cash-on-delivery parcel may contain a cheap or completely unrelated item. A fake store may disappear after collecting payments. A phishing website may steal card details. In other cases, criminals target the seller by sending forged payment receipts, placing fake orders or hacking an e-commerce account.

Pakistani law treats these situations according to what actually happened. A genuine delivery problem is not the same as deliberate fraud.

Key Legal Distinction: A wrong size, delayed shipment or genuine quality dispute is not automatically a cybercrime. Where the evidence shows deliberate deception, electronic forgery, unauthorized access or dishonest financial gain, PECA and other relevant criminal laws may become applicable.

Readers dealing with broader scams can also review our guide to online fraud in Pakistan.

Key Takeaways

  • Not every failed online purchase is criminal fraud
  • Electronic fraud and electronic forgery can fall under PECA
  • Evidence should be preserved before pages, chats or transaction details disappear
  • Bank or wallet providers should be contacted quickly when money has been transferred
  • Consumer remedies and cybercrime proceedings can sometimes operate together
  • Fake COD parcels and forged payment receipts can affect both buyers and sellers
  • Hacked e-commerce stores can also create criminal and financial liability issues

What Is E-Commerce Fraud in Pakistan?

E-commerce fraud happens when the internet or another electronic platform is deliberately used to deceive a buyer, seller or business for wrongful financial gain.

It may involve:

  • fake online stores
  • false product listings
  • fake payment receipts
  • fraudulent social-media shops
  • non-existent products
  • impersonation of a genuine brand
  • stolen card information
  • phishing pages
  • unauthorized account access
  • fake cash-on-delivery orders

The important word is deception. A seller who makes an honest mistake and tries to correct it is in a very different legal position from someone who creates a fake store, takes money and disappears.

Is Online Shopping Fraud a Cybercrime Under PECA?

It can be. The main PECA provisions relevant to e-commerce fraud include section 13 relating to electronic forgery, section 14 relating to electronic fraud and in suitable cases section 16 dealing with unauthorized use of identity information.

Section 14 applies where a person, with the intention of wrongful gain, uses an information system, device or data or deceives another person in circumstances likely to cause damage or harm.

Electronic fraud may carry imprisonment of up to two years, a fine up to Rs. 10 million or both.

Section 13 may become relevant when electronic data is created, altered or manipulated so that false information is treated as authentic for fraudulent or legal purposes.

Ordinary electronic forgery may carry imprisonment of up to three years, a fine up to Rs. 250,000 or both.

Section 16 concerns unauthorized use of another person's identity information and may carry imprisonment of up to three years, a fine up to Rs. 5 million or both.

Legal Note: The correct PECA section depends on what the offender actually did. One online shopping scam may involve fraud alone while another may also involve electronic forgery, identity misuse or unauthorized access.

For a broader explanation of Pakistan's cybercrime framework, read our cyber crime in Pakistan guide.

Some online scams may also involve traditional offences under the Pakistan Penal Code depending on the facts.

Online Shopping Fraud in Pakistan: What Legal Action Can You Take?

A victim may have more than one legal remedy.

If the matter involves deliberate electronic deception, a PECA complaint may be made to NCCIA.

If the matter concerns defective goods, misleading trade practices, failure to honour a refund or breach of a consumer transaction, consumer remedies may also be available under the law applicable in the relevant province or territory.

If money has been transferred through a bank, debit card, credit card or mobile wallet, the financial institution should also be contacted immediately.

NCCIA Criminal cyber fraud
Bank or Wallet Payment complaint
Consumer Remedy Refund or compensation
Platform or Courier Account or parcel complaint
Practical Rule: Cybercrime proceedings deal with criminal conduct. Consumer proceedings deal with buyer rights and compensation. Banking complaints focus on the disputed financial transaction. One route does not always replace another.

How to Report an Online Shopping Scam in Pakistan

Do not begin by deleting the seller's messages or repeatedly arguing with them. Start by preserving the evidence.

Then report the matter through the appropriate channel.

For a PECA matter, NCCIA accepts cybercrime complaints. A formal complaint should normally include a written application, identification details and supporting evidence.

NCCIA's complaint system currently lists the helpline number 1799.

If money has been transferred electronically, contact the bank or wallet provider at the same time. Do not wait for the cybercrime investigation before reporting the financial transaction.

What Evidence Should You Preserve After an Online Scam?

In an e-commerce fraud case, the digital conversation and financial trail are often more useful than a long accusation with no supporting records.

  • full screenshots of the seller's page or website
  • page and profile URLs
  • complete WhatsApp, Messenger or Instagram chats
  • order confirmation
  • product advertisement
  • payment receipt
  • bank transfer slip
  • transaction ID
  • beneficiary account number
  • IBAN where available
  • mobile wallet number
  • SMS payment alerts
  • parcel label
  • courier tracking number
  • photographs or video of the parcel
  • photographs of the item received
  • refund requests and seller responses

Keep the original conversation on the device where possible.

Do not crop screenshots in a way that removes the seller's account name, phone number, date, transaction information or surrounding context.

Our detailed guide on digital evidence explains how electronic material can become relevant in cybercrime proceedings.

I Paid an Online Seller but Never Received My Order. What Should I Do?

First determine whether there is a genuine delivery problem or evidence of fraud.

If the seller remains responsive and provides genuine tracking information, the matter may still be a commercial or consumer dispute.

The situation becomes more suspicious when the seller:

  • stops responding immediately after payment
  • blocks the buyer
  • removes the page
  • provides fake tracking information
  • uses different payment accounts for different customers
  • repeatedly asks for additional money

In those circumstances, preserve the evidence, contact the financial institution and consider a cybercrime complaint.

Seller Blocked Me After Payment. Can I File a Cybercrime Complaint?

Yes, where the surrounding circumstances suggest deliberate fraud.

Being blocked after payment may support the complaint, but it does not by itself prove criminal intention.

A stronger case may include evidence of a fake identity, non-existent goods, false payment instructions, fabricated courier information or repeated complaints from other buyers.

Can I Get My Money Back After an E-Commerce Scam?

Sometimes, but there is no automatic refund merely because a cybercrime complaint has been filed.

Contact the bank or mobile wallet provider as quickly as possible and report the transaction as fraudulent.

Depending on timing and the payment method, the financial institution may be able to investigate, trace or take steps regarding the transaction.

For scams involving mobile wallets, see our guide on JazzCash fraud.

Warning: A person who has already taken your money may ask for another payment for refund release, verification, tax or account unlocking. Do not send additional money unless the demand has been independently verified.

Is Sending the Wrong Product on Cash on Delivery a Fraud?

Sometimes yes and sometimes no. Intention matters.

If a seller accidentally sends the wrong size, wrong colour or another minor variation and offers an exchange, that is more likely to be a consumer dispute.

If a buyer orders a valuable product but deliberately receives stones, scrap material, paper or another worthless object, the facts may support an allegation of fraud.

What Should I Do After Receiving a Fake COD Parcel?

Do not throw away the packaging.

Preserve:

  • the parcel
  • shipping label
  • tracking number
  • invoice
  • product received
  • seller's contact information

Take clear photographs and, where possible, video of the parcel and contents.

Contact the courier quickly and report the suspected fraud. Ask whether the COD payment has already been settled to the merchant and what complaint procedure is available.

Can a Courier Company Be Responsible for an E-Commerce Scam?

Not automatically.

A courier usually transports the parcel and collects COD payment on behalf of the merchant.

Its responsibility depends on the circumstances, contractual terms and applicable law.

Even where the courier is not responsible for the fraud, its records may be valuable because they can contain:

  • sender details
  • booking information
  • tracking history
  • COD settlement information

Can Sponsored Facebook or Instagram Shopping Ads Be Scams?

Yes.

A sponsored advertisement only means that someone paid to advertise. It does not mean the seller has been legally verified or that the product is genuine.

Scam pages may use:

  • copied business logos
  • professional product videos
  • fake reviews
  • countdown timers
  • very large discounts
  • fake customer comments

If your case started through Facebook, our guide on Facebook cyber crimes explains hacking, fake profiles, online fraud and related legal remedies.

How Can I Identify a Fake Online Store?

No single warning sign proves that an online shop is fraudulent, but several warning signs together should make a buyer cautious.

  • unrealistic discounts
  • recently created social-media account
  • copied product photographs
  • disabled comments
  • no verifiable business address
  • no meaningful refund or return policy
  • advance payment only
  • personal bank account receiving business payments
  • pressure to pay immediately
  • no independent customer history

An NTN, business address or landline may help with verification, but the absence of one feature alone does not automatically prove criminal fraud.

What Should I Do if I Entered My Card Details on a Fake Shopping Website?

  1. Contact your bank or card issuer immediately
  2. Block or secure the debit or credit card
  3. Check for pending transactions and unfamiliar charges
  4. Change any password that was reused elsewhere
  5. Secure online banking if those credentials were also entered
  6. Preserve the phishing website URL and screenshots

Small unfamiliar transactions can sometimes be used to test whether stolen card details are active, so review the transaction history carefully.

Is a Fake Payment Receipt a Cybercrime?

It can be.

Suppose a buyer edits a bank transfer screenshot to show that payment has been made when no money has actually reached the seller.

That fabricated electronic record may raise issues under section 13 relating to electronic forgery.

If the false receipt is then used to deceive the seller into handing over goods, section 14 relating to electronic fraud may also become relevant.

Fake JazzCash or Easypaisa Receipt: What Should a Seller Do?

Do not release goods simply because a customer sends a payment screenshot.

Confirm that the money has actually reached the wallet or bank account.

If the receipt appears fake:

  • save the screenshot
  • save the sender's phone number
  • preserve the complete conversation
  • keep the order information
  • verify the actual transaction history

What Is the Difference Between Online Shopping Fraud and a Consumer Dispute?

This is one of the most important distinctions in online shopping cases.

Consumer Dispute

Usually involves a real seller and a genuine transaction where something went wrong.

  • late delivery
  • wrong size
  • defective product
  • refund disagreement
  • warranty problem

Criminal Fraud

Usually involves deliberate deception or dishonest conduct.

  • fake shop
  • non-existent product
  • seller disappearing after payment
  • fake payment receipt
  • deliberately worthless COD parcel
  • impersonation of a real business
Key Distinction: An unhappy customer is not automatically a cybercrime victim. The criminal element normally comes from deliberate deception, forgery, impersonation, unauthorized access or dishonest financial gain.

Can I File Both a Consumer Complaint and a Cybercrime Complaint?

Potentially, yes.

The two remedies deal with different legal issues.

A PECA complaint focuses on criminal cyber conduct.

Consumer remedies may focus on defective goods, misleading trade practices, refund rights and compensation under the law applicable in the relevant province or territory.

It is therefore better to say that parallel remedies may be available rather than assuming that every online shopping case belongs before one single forum.

What Legal Action Can an E-Commerce Business Take After Hacking?

Buyers are not the only victims of e-commerce cybercrime.

Online sellers may face hacked admin accounts, stolen customer information, unauthorized changes to payment details and fraudulent orders.

If an e-commerce system or administrator account is accessed without permission, PECA provisions concerning unauthorized access and related conduct may become relevant.

The business should immediately:

  • secure administrator accounts
  • reset compromised passwords
  • preserve server logs
  • preserve login alerts
  • remove unknown sessions
  • secure payment credentials
  • inform the payment provider if financial details were altered
For Businesses: Do not destroy logs while trying to clean a hacked website. Login records, server logs and account-change history may become important digital evidence.

For technical background, see our guide on digital forensic tools.

Someone Hacked My Online Store and Changed My Bank Details

This is particularly serious because the attacker may redirect legitimate customer payments.

Preserve:

  • old payment details
  • new unauthorized payment details
  • administrator login records
  • security emails
  • account-change history
  • customer complaints
  • transaction records

Secure the platform immediately and inform the payment provider.

Where the facts disclose a PECA offence, the incident may also be reported to NCCIA.

What if an Online Store Leaks My Personal Information?

This issue requires careful legal treatment.

Pakistan does not have one simple PECA provision that automatically applies to every e-commerce data leak.

The legal position depends on how the information was obtained, how it was disclosed and how it was later used.

If information is used for impersonation, fraud, unauthorized access, stalking or another offence, separate legal provisions may become relevant.

Preserve evidence showing:

  • what information was exposed
  • where the information appeared
  • who appears to have disclosed it
  • how the information was later misused

Can NCCIA Investigate Fake Online Stores?

Yes, where the facts disclose an offence under PECA.

NCCIA is the federal cybercrime investigation agency responsible for PECA inquiries, investigations and prosecutions.

This does not mean every delivery or refund dispute becomes a criminal investigation.

There must still be facts suggesting criminal cyber conduct.

How to File an NCCIA Complaint for an E-Commerce Scam

A useful complaint should be factual and chronological.

Explain:

  • when you found the seller or store
  • what you ordered
  • what the seller promised
  • how much money you paid
  • where the payment was sent
  • what happened after the payment

Attach:

  • CNIC copy
  • screenshots
  • chat records
  • payment receipts
  • seller account details
  • website or profile URLs
  • courier records
  • parcel photographs
Practical Rule: A strong complaint should tell a clear story. Who contacted you, what was promised, how the payment was made, what went wrong and what electronic evidence supports your version.

What Should You Do Immediately After an E-Commerce Scam?

The first few hours can matter.

  1. Stop sending additional money
  2. Preserve the seller's page, profile and messages
  3. Contact the bank or wallet provider
  4. Save transaction IDs and beneficiary details
  5. Preserve parcel and courier information
  6. Report the seller or account to the relevant platform
  7. File an NCCIA complaint when criminal deception is involved
  8. Consider the available consumer remedy where appropriate

If the scam was conducted through WhatsApp, our guide on WhatsApp cyber crime explains the related legal issues.

How E-Commerce Businesses Can Reduce Cyber Fraud

Fraud prevention is not only the buyer's responsibility.

Online sellers should also strengthen their accounts and payment systems.

  • enable multi-factor authentication
  • restrict administrator access
  • use separate business accounts
  • verify payments before dispatch
  • maintain reliable order logs
  • monitor unusual login alerts
  • keep regular backups
  • train staff to recognise phishing
  • never rely only on payment screenshots

Conclusion

E-commerce fraud in Pakistan is not limited to fake websites. It can begin with a Facebook advertisement, an Instagram shop, a WhatsApp seller, a cash-on-delivery parcel, a phishing checkout page or a forged payment receipt.

The law looks at what actually happened.

A genuine mistake or refund disagreement is different from deliberate deception.

Where an online buyer or seller intentionally uses electronic means to obtain money or property through fraud, PECA may become relevant. Section 14 deals with electronic fraud, section 13 deals with electronic forgery and other provisions may apply where identity misuse or unauthorized access is involved.

For a victim, the practical approach is straightforward. Preserve the evidence, contact the financial institution quickly, keep the complete transaction trail and use the legal forum that fits the actual problem.

A strong e-commerce fraud complaint should answer five questions:

Who was involved? What was promised? What payment was made? What deception occurred? What evidence proves it?