Hacking in Pakistan: PECA Law, Account Takeovers, Phone Hacking, Business Attacks and Legal Remedies

Facebook Account Taken Over and Used to Ask Friends for Money

This is more serious than simple unauthorized access.

A single incident can involve several offences.

Section 3 may apply to the unauthorized login.

Section 16 may become relevant if the person uses your identity information without authorization.

Section 14 may become relevant if the account is used to deceive people into sending money.

Section 16 currently provides imprisonment up to three years, a fine up to Rs. 5 million, or both for unauthorized use of another person's identity information. Section 14 electronic fraud can carry imprisonment up to two years, a fine up to Rs. 10 million, or both. Pakistan Code

The exact section depends on what the hacker did after gaining access.

Someone Hacked My Instagram Account: What Legal Remedy Is Available?

The practical response is similar.

First use Instagram's official recovery tools.

If you receive an email saying the account email address or password was changed, preserve that message before deleting anything.

Save:

• account username
• profile URL
• security emails
• login alerts
• changed email address
• changed phone number
• screenshots of unauthorized posts
• messages sent by the hacker

If the account was simply accessed without permission, Section 3 may be relevant.

If the hacker then impersonates you or uses your identity information, Section 16 may also become relevant.

If the account is used to collect money through deception, Section 14 may become relevant.

Why Instagram Security Emails Matter

A “password changed” or “email changed” notice can be very useful evidence because it may show when control of the account changed.

Do not rely only on screenshots of the hacked profile.

Preserve the complete security email, date, time and any device or location information shown.

If possible, keep the original email rather than forwarding or editing it.

WhatsApp Account Hacked and Used for Fraud

If the attacker only entered the account, Section 3 may be relevant.

If they impersonate you, Section 16 may become relevant.

If they use the account to deceive contacts into transferring money, Section 14 may also become relevant.

NCCIA currently identifies hacking, identity theft and financial fraud among the cybercrime categories it investigates, and its official complaint system lists helpline 1799. NCCIA

WhatsApp Account Cloned or SIM Swapped

People often use the word “cloned” for different problems.

Sometimes the issue is simply an unauthorized linked device.

Sometimes the attacker has gained control of the phone number itself through a SIM swap.

If you suspect SIM swapping, contact the telecom operator immediately.

Ask whether a replacement SIM or other change was issued without your authorization.

Secure the mobile number first because many other accounts may use that number for password recovery.

Then change passwords for:

• email
• banking apps
• social media
• cloud accounts

A stolen phone number can become the starting point for multiple account takeovers.

Someone Is Using My WhatsApp Account Without Permission

Preserve evidence before the account is fully recovered.

Useful material includes:

• screenshots of messages sent by the hacker
• linked-device information
• login alerts
• SIM replacement information
• messages from contacts
• payment requests
• wallet or bank details provided by the hacker

If money was requested from contacts, ask them to preserve their own chats and transaction information.

Their evidence may show what the attacker did after taking over your account.

Gmail Account Hacked: Can You Take Legal Action?

Yes, where the facts satisfy the requirements of PECA.

Unauthorized entry into a Gmail or other email account can fall under Section 3.

If the attacker copies or sends information from the account, Section 4 may become relevant.

If they delete, alter or damage data, Section 5 may apply.

If they use the account to commit financial fraud, Section 14 may also become relevant.

This is a better legal distinction than treating every email hack as automatically involving one single section.

Someone Logged Into My Social Media Without Permission

A login without permission can itself be legally significant.

Section 3 does not require the victim to first prove that money was stolen.

It focuses on dishonest unauthorized access to an information system or data. Pakistan Code

However, evidence still matters.

A security alert showing an unfamiliar login is useful, but it does not always identify the person responsible.

The investigation may need to connect:

• account logs
• device information
• IP records
• phone numbers
• other evidence

Password Stolen and Account Misused

A stolen password can lead to several different offences depending on how it is used.

If the password is used to enter the account, Section 3 may apply.

If personal identity information is then used without authority, Section 16 may become relevant.

If the account is used to deceive someone for financial gain, Section 14 may apply.

The password itself is therefore only part of the case.

The stronger complaint explains what the offender actually did after obtaining it.

Someone Is Trying to Hack My Account but Has Not Succeeded

Do not ignore repeated unauthorized login attempts.

Preserve:

• failed login emails
• OTP requests
• password reset messages
• new-device alerts
• suspicious recovery requests

Then change the password and enable two-factor authentication.

A failed login attempt is not automatically the same as a completed Section 3 offence, because the statutory offence requires unauthorized access to have been gained.

The legal treatment of an attempted offence can depend on the wider criminal law framework and the facts, so it is better not to describe every failed login alert as a completed hacking offence.

You can still report suspicious activity where there is a genuine and repeated threat.

Someone Hacked My Phone: How Do I Know?

A phone behaving strangely does not automatically prove hacking.

Battery drain, heat, pop-ups or slow performance can have ordinary technical causes.

More meaningful signs may include:

• unknown applications
• unexpected administrator privileges
• unrecognized linked accounts
• unexplained SMS activity
• password reset messages you did not request
• security alerts from unknown devices
• remote-control applications you did not install

Do not install random “spyware detector” applications simply because you suspect compromise.

If the matter is serious, preserve the device and seek competent technical examination.

Computer Hacking in Pakistan: How Does the Legal Process Work?

The process normally begins with a complaint and evidence.

NCCIA is the current federal agency responsible for investigation of PECA offences. Its official website lists cyber investigation, digital forensics and prosecution among its functions. NCCIA

A useful complaint should explain:

• what system was compromised
• when you discovered it
• what changed
• whether data was copied
• whether money was lost
• whether any suspect is known
• what evidence has been preserved

NCCIA's official complaint materials also state that a complaint proforma can be submitted with relevant supporting evidence to the appropriate office. NCCIA

Hacked Account Used for Financial Fraud

Suppose someone gains access to a Facebook account and starts asking the victim's contacts to send money.

The case may begin as unauthorized access.

It may then become identity misuse.

Once financial deception occurs, electronic fraud may also be involved.

This is why the correct legal analysis follows the conduct step by step rather than applying every PECA section automatically.

Unauthorized Access to a Computer or Mobile Phone

The same basic legal principles apply beyond social media.

A laptop, company server, smartphone, database or online account may all fall within PECA's concept of an information system or data, depending on the circumstances.

Section 3 focuses on unauthorized access.

Section 4 focuses on unauthorized copying or transmission.

Section 5 focuses on interference or damage.

These provisions form the basic legal structure for many hacking cases. Pakistan Code

Cyber Attack on a Business in Pakistan

A business cyberattack can be far more complex than an individual account takeover.

The first priority should usually be containment without destroying evidence.

A company may need to:

• isolate compromised systems
• secure administrator credentials
• preserve server logs
• preserve firewall records
• keep intrusion alerts
• record affected systems
• secure backups

Do not immediately wipe compromised servers unless there is a clear incident-response reason to do so.

The logs may contain the best evidence of how the attacker entered.

Why Businesses Should Preserve Logs Before Cleaning Systems

Once a compromised server is rebuilt, important evidence may disappear.

Useful records can include:

• login history
• IP addresses
• authentication failures
• file changes
• administrator actions
• network connections

PECA itself requires investigators dealing with seized digital systems to take measures to preserve integrity and chain of custody. Pakistan Code

The same principle is useful for businesses handling their own incident response.

Corporate Data Theft in Pakistan

Corporate data theft should not automatically be described as Section 5.

The correct section depends on the conduct.

If someone accessed the system without authorization, Section 3 may be relevant.

If they copied or transmitted company data without authorization, Section 4 may be particularly relevant.

If they damaged or interfered with the system, Section 5 may apply.

If they used stolen information to commit fraud, other provisions may also become relevant.

This distinction is important because “data theft” can involve several different acts.

Employee Stole Company Data: Is It Cybercrime?

Possibly.

Employee cases are more complicated because the person may originally have had legitimate access.

Suppose an employee was authorized to view a customer database as part of their job.

That does not necessarily mean they were authorized to copy the entire database onto a personal drive and send it to a competitor.

The legal question becomes:

What access was authorized, and what conduct went beyond that authorization?

A company should preserve:

• access-control records
• employment role
• system logs
• file transfer records
• USB activity
• email records
• NDA or confidentiality terms

The technical evidence should be compared with the employee's actual permission level.

Employee Access Versus Unauthorized Access

This is one of the most important distinctions in corporate hacking cases.

A person can have permission to enter a system but still lack permission to copy, transfer, delete or misuse particular data.

Therefore the case should not be reduced to:

“He had the password, so it was authorized.”

Authorization has a scope.

The evidence should show what the employee was permitted to do and what they actually did.

Ransomware and Hacking

Ransomware can involve several PECA issues.

A ransomware attacker may:

• gain unauthorized access
• copy data
• encrypt or damage data
• deploy malicious code
• demand payment

Depending on the facts, Sections 3, 4, 5 and 23 may become relevant, along with other laws where extortion or financial demands are involved.

A victim should preserve the ransom note, wallet address, affected files and relevant system logs.

What if a Hacker Changes My Bank or Payment Details?

This can be particularly serious for businesses.

An attacker who enters a company account and changes payment instructions may redirect genuine customer payments.

Preserve:

• original account details
• unauthorized new account details
• change history
• email notifications
• administrator logs
• customer communications

If deception is used to obtain money, Section 14 electronic fraud may become relevant in addition to the underlying unauthorized access. Pakistan Code

Why IP Addresses Do Not Automatically Identify the Hacker

An IP address can be useful.

But it does not automatically prove who was sitting behind the device.

An IP may belong to:

• a household
• office
• public Wi-Fi network
• VPN
• proxy
• mobile network

Investigators usually need additional records to attribute activity to a particular person.

This is why technical evidence should be interpreted carefully.

Can NCCIA Trace a Hacker?

NCCIA has cyber investigation and digital forensic functions and may obtain evidence through lawful investigative procedures. NCCIA

But no agency can honestly guarantee that every hacker will be identified.

Attribution depends on what records exist, whether they can lawfully be obtained, whether they have been preserved and how effectively the attacker concealed their identity.

Why Fast Reporting Matters

digital evidence in cyber crime cases can disappear.

Logs may be overwritten.

Accounts may be deleted.

Platforms may retain information only for limited periods.

PECA provides for expedited preservation of data where an authorized officer considers it reasonably required for a criminal investigation and at risk of being modified, lost or destroyed. Pakistan Code

This is one reason victims should preserve their own evidence and report serious incidents without unnecessary delay.

How to File an NCCIA Complaint for Hacking

A strong complaint should be chronological and specific.

Explain:

1. 01
   what account, device or system belonged to you
2. 02
   when you last had normal control
3. 03
   what unauthorized activity you noticed
4. 04
   what was changed, copied or deleted
5. 05
   whether your identity was misused
6. 06
   whether money was requested or stolen
7. 07
   what evidence you have

NCCIA currently lists hacking and unauthorized access as cybercrime categories and provides complaint reporting through its portal and helpline 1799. NCCIA

How to Protect Your Accounts From Hacking

Most account takeovers do not require a movie-style technical attack.

Many begin with:

• reused passwords
• phishing links
• stolen OTPs
• fake login pages
• compromised email
• SIM swapping

Use a unique password for important accounts.

Enable two-factor authentication.

Do not give OTPs or recovery codes to anyone.

Review active sessions regularly.

Keep the recovery email account especially secure.

Your email is often the key to resetting every other password.