Online Fraud in Pakistan: What the Law Says and What Victims Should Do

Is Online Fraud a Cyber Crime Under Pakistani Law?

Yes, many forms of online fraud are cybercrimes in Pakistan.

The main provision is section 14 of PECA, dealing with electronic fraud. Broadly speaking, it covers the use of an information system, device or data, or electronic deception, for wrongful gain where the conduct causes or is likely to cause harm.

This can apply to situations such as:

• fake investment schemes;
• phishing;
• WhatsApp financial scams;
• OTP fraud;
• mobile-wallet scams;
• fake online stores;
• identity-based fraud;
• social-media scams.

But the internet being involved does not automatically make every dispute a cybercrime.

The important question is whether the evidence shows dishonest deception or another specific offence.

What Legal Action Can You Take After Online Fraud in Pakistan?

If you have lost money through an online scam, the first step is not to argue with the fraudster.

The first step is to preserve the evidence.

Keep:

• complete chats;
• phone numbers;
• email addresses;
• social-media usernames;
• payment receipts;
• bank statements;
• JazzCash or Easypaisa transaction IDs;
• beneficiary account details;
• screenshots;
• voice notes;
• website links;
• fake invoices;
• investment screenshots;
• job advertisements;
• prize messages.

For conduct falling under PECA, a complaint can be made to the National Cyber Crime Investigation Agency (NCCIA).

NCCIA currently accepts complaints through its official complaint form, Pakistan Citizen Portal, email and Cybercrime Reporting Centres. For formal investigation, its current guidance asks for a written application, CNIC copy and supporting evidence.

If money was transferred through a bank or mobile wallet, report the transaction to the financial institution at the same time.

Do not wait for the criminal investigation before contacting the bank.

How to Report Online Fraud in Pakistan

A strong online-fraud complaint should be simple and chronological.

Explain:

1. who contacted you;
2. how they contacted you;
3. what they claimed;
4. what they asked you to do;
5. how much money you sent;
6. where the money was sent;
7. what happened after payment;
8. what evidence you have.

For example:

“I was contacted through WhatsApp and offered an online investment. I transferred Rs. 150,000 to the account provided. When I requested withdrawal, I was asked to pay another Rs. 50,000 as a release fee. The complete chat, payment receipt and beneficiary account details are attached.”

That is much more useful than writing only:

“I have been scammed.”

NCCIA's official complaint system allows complainants to provide their identification, city, crime category and details of the incident.

What Is the Punishment for Online Fraud Under PECA?

Under the current PECA framework, electronic fraud under section 14 can carry imprisonment of up to two years, a fine of up to Rs. 10 million, or both.

The exact legal consequences can change where the same conduct also involves another offence.

For example, a fraud may also involve:

• electronic forgery;
• unauthorized access;
• identity misuse;
• cheating by personation;
• traditional cheating under the PPC.

This is why online fraud cases are often not limited to one section.

Punishment for Online Fraud in Pakistan

There is no single punishment for every online-fraud case.

The applicable punishment depends on how the offence was committed.

For example:

• Electronic fraud under PECA may carry imprisonment, fine, or both.
• Cheating by personation under PPC may apply where someone pretends to be another person.
• Cheating and dishonestly inducing delivery of property under PPC may apply where deception causes the victim to hand over money or property.

A case involving a hacked WhatsApp account used to ask contacts for money may therefore involve more than one offence.

The correct charge depends on the facts and evidence.

Online Fraud FIR Registration Process in Pakistan

For PECA offences, the present federal cybercrime investigation authority is NCCIA.

The current NCCIA guidance states that, under section 29 of the amended PECA framework, it is the authorized law-enforcement agency for inquiry, investigation and prosecution of offences under the Act.

Electronic fraud is treated as a cognizable offence under the current PECA framework.

That does not mean every complaint immediately becomes an FIR.

The complaint is first examined to determine whether the available facts disclose a criminal offence.

Where a cognizable offence is disclosed, the criminal process proceeds under the applicable PECA and CrPC framework.

The safest practical approach is to submit:

• a written complaint;
• CNIC copy;
• evidence;
• financial trail;
• identifying details of the suspected fraudster.

How to Build a Strong Legal Case Against an Online Fraudster

A strong fraud case is usually built around a clear transaction trail.

The evidence should show:

what was promised → why you trusted it → what money you paid → where the money went → what the fraudster did afterwards.

Useful evidence includes:

• original phone;
• complete WhatsApp or social-media conversation;
• payment receipts;
• bank or wallet records;
• beneficiary account title;
• voice messages;
• fake investment dashboards;
• fake receipts;
• website links;
• emails;
• phone numbers;
• account usernames.

Avoid relying only on cropped screenshots.

Electronic evidence is much stronger where it is supported by financial records and the original conversation.

Can You Get Your Money Back After Online Fraud?

Sometimes, but recovery is not guaranteed.

If money has just been transferred, report the transaction to the bank or wallet provider immediately.

Speed matters because funds may still be traceable or subject to dispute procedures.

Pakistan's banking framework requires financial institutions to maintain fraud controls and complaint mechanisms. Under the applicable digital-banking liability framework, a financial institution can in certain circumstances be responsible for losses where it fails to take required timely remedial action after a fraud complaint.

That does not mean every online-fraud victim will automatically receive a refund.

Recovery depends on:

• how quickly the fraud was reported;
• where the money was transferred;
• whether the recipient account still holds funds;
• whether banking controls were followed;
• what the investigation establishes.

Phishing Scams in Pakistan

Phishing is one of the most common online-fraud methods.

A phishing scam usually begins with a fake:

• email;
• SMS;
• WhatsApp message;
• banking alert;
• courier message;
• website;
• social-media message.

The message may ask the victim to click a link and enter:

• username;
• password;
• OTP;
• PIN;
• debit-card details;
• CNIC information.

The page may look almost identical to a real bank or company website.

NCCIA specifically warns citizens not to click suspicious links or share financial details in response to unsolicited messages.

If the stolen information is later used to access an account or take money, electronic fraud and other PECA offences may apply.

OTP Fraud in Pakistan

OTP fraud usually works through urgency and impersonation.

The fraudster may claim:

• your bank account will be blocked;
• your wallet must be verified;
• a parcel cannot be delivered;
• a payment needs confirmation;
• your account is under investigation.

The victim is then asked to share a one-time password.

Once the OTP is disclosed, the fraudster may complete a transaction or take control of an account.

A bank, wallet company or legitimate authority should not need you to disclose your OTP to a caller.

NCCIA specifically advises the public never to share PINs, passwords or OTPs.

Mobile Wallet Fraud: JazzCash and Easypaisa Scams

Mobile-wallet fraud can happen through:

• fake customer-support calls;
• OTP requests;
• prize scams;
• fake payment links;
• account impersonation;
• “wrong transfer” stories;
• fraudulent verification calls.

If money is lost through a mobile-wallet scam, preserve:

• transaction ID;
• recipient number;
• account details;
• SMS confirmation;
• call history;
• chats;
• screenshots.

Report the transaction to the wallet provider immediately.

The payment confirmation message can become an important part of the financial trail, so do not delete it.

Fake Investment Schemes in Pakistan

Fake investment schemes often look convincing.

Fraudsters may use:

• WhatsApp groups;
• Telegram channels;
• Facebook pages;
• Instagram accounts;
• fake trading dashboards;
• cryptocurrency websites.

The scheme usually starts with a small payment.

The victim may even be shown an apparent profit.

After a larger investment is made, withdrawal becomes difficult or impossible.

The fraudster then asks for more money for:

• tax;
• withdrawal charges;
• verification;
• account activation;
• security deposit.

This is a major warning sign.

A genuine investment should be independently verified before money is transferred.

Online Shopping Fraud in Pakistan

Online-shopping fraud often involves a seller who takes payment for goods that never existed or were never intended to be delivered.

Common warning signs include:

• copied product images;
• newly created social-media pages;
• no verifiable address;
• advance payment only;
• pressure to pay quickly;
• refusal to use a traceable payment method.

If fraud is suspected, preserve:

• product advertisement;
• seller's number;
• social-media page;
• payment receipt;
• account number;
• chat history.

But remember: not every bad shopping experience is criminal fraud.

A late delivery or defective product may be a consumer dispute.

A criminal case becomes stronger where there is evidence that the seller was dishonest from the beginning.

WhatsApp Account Hacking and Financial Fraud

WhatsApp account hacking can lead directly to financial fraud.

A fraudster may take control of a person's account and then message their relatives or friends:

“I need money urgently.”

Because the message comes from a familiar account, the victim may trust it.

The conduct may involve:

• unauthorized access;
• identity misuse;
• cheating by personation;
• electronic fraud.

If this happens, the account owner should:

• recover the account;
• check linked devices;
• warn contacts;
• preserve login alerts;
• save fraudulent messages.

Social Media Account Hacking

Unauthorized access to Facebook, Instagram or another social-media account can itself become a cybercrime.

If the account is then used to:

• obtain money;
• impersonate the owner;
• contact friends;
• steal information;
• commit another fraud,

additional offences may apply.

Preserve the login emails, security alerts, suspicious sessions and any messages sent by the attacker.

Fake Job Scams in Pakistan

Fake job scams usually involve a job offer followed by a request for payment.

The fraudster may ask for:

• registration fee;
• interview fee;
• training charges;
• medical fee;
• visa charges;
• security deposit.

Some scammers copy the branding of a real company.

Before paying anything, verify the employer independently.

If there was never a genuine job and the offer existed only to obtain money, the conduct may amount to electronic fraud and cheating.

Keep the job advertisement, offer letter, messages and payment record.

Prize and Lottery Scams in Pakistan

Prize scams usually start with a message saying:

“Congratulations. You have won.”

The victim is then asked to pay:

• tax;
• registration charges;
• processing fee;
• courier fee;
• verification fee.

If you never entered a competition, treat the message with extreme caution.

A fabricated prize used to obtain payment may amount to electronic fraud.

A simple rule is:

do not pay money to receive an unsolicited prize.

Identity Theft in Pakistan

Identity theft can involve misuse of:

• CNIC information;
• photographs;
• phone numbers;
• bank information;
• online accounts;
• login credentials.

The stolen identity may then be used to:

• impersonate the victim;
• obtain money;
• open fake accounts;
• deceive contacts;
• create fraudulent profiles.

PECA contains specific provisions relating to unauthorized use of another person's identity information.

If identity theft also results in financial fraud, additional offences may apply.

Preserve evidence showing both:

how the identity was misused and what the offender did with it.

What Evidence Is Most Important in an Online Fraud Case?

The best evidence usually tells the complete story.

Try to preserve:

• the first contact;
• the false representation;
• the payment request;
• the transaction;
• beneficiary account details;
• later excuses;
• further demands;
• refusal to return money.

Keep original electronic evidence whenever possible. For technical preservation and examination, see our guide to digital forensic tools for cybercrime investigation.

Do not edit screenshots.

Do not delete chats after taking a screenshot.

Do not factory-reset a phone that may contain important evidence.

A clear digital and financial trail can make the case much easier to investigate.

What Should You Do Immediately After an Online Banking Scam?

If money has been taken through online banking:

1. Contact the bank immediately.
2. Block compromised cards or digital channels.
3. Report the transaction as fraudulent.
4. Preserve SMS and email alerts.
5. Save account statements.
6. Change compromised passwords.
7. File the relevant cybercrime complaint.
8. Keep the beneficiary information.

Banks and microfinance banks in Pakistan are required to maintain controls against digital-banking fraud and timely complaint handling.

Can a Fraud Case Still Exist If You Sent the Money Yourself?

Yes.

Many fraud victims transfer money voluntarily.

The issue is why they transferred it.

If a person sends money because they were deliberately deceived by a false investment, fake job, false identity or fraudulent business offer, the fact that they clicked “send” themselves does not automatically remove criminal liability.

Fraud often works by persuading the victim to act voluntarily on false information.

How to Avoid Online Fraud in Pakistan

Most online fraud relies on urgency, trust and lack of verification.

A few precautions can prevent many scams:

• never share OTPs;
• do not disclose PINs or passwords;
• verify unusual payment requests independently;
• avoid unknown links;
• check account names before transferring money;
• verify investment companies before paying;
• confirm job offers through official channels;
• review bank activity regularly;
• use two-factor authentication where available.

NCCIA's current cyber-safety guidance emphasizes the same basic habits: protect personal information, avoid suspicious links and use trusted sources.