WhatsApp Cyber Crime in Pakistan: Fraud, Blackmail, Threats, Hacking and Legal Remedies

WhatsApp has become part of everyday life in Pakistan. People use it for family conversations, business dealings, banking-related communication, property transactions, online shopping and professional work. Unfortunately, the same convenience has also made WhatsApp a common platform for fraud, blackmail, impersonation, threatening messages and other forms of cybercrime.

A person may receive a message demanding money, discover that someone has created a fake WhatsApp account in their name, lose access to their account after sharing a verification code, or be threatened with the release of private photographs.

The legal position is not that every dispute on WhatsApp is a cybercrime. The real question is what the person has done through WhatsApp.

Depending on the facts, a WhatsApp-related case in Pakistan may involve the Prevention of Electronic Crimes Act, 2016 (PECA), as amended, the Pakistan Penal Code, 1860 (PPC), the Electronic Transactions Ordinance, 2002, the Qanun-e-Shahadat Order, 1984, and the ordinary criminal procedure applicable to the offence.

Another important change is the authority responsible for PECA investigations. Older websites still advise victims to approach the FIA Cyber Crime Wing. Under the current legal framework, however, the National Cyber Crime Investigation Agency (NCCIA) is the federal agency responsible for inquiries, investigations and prosecutions relating to offences under PECA. NCCIA's own current guidance confirms this position under section 29 of the amended law.

This guide explains how the law applies to the most common WhatsApp cybercrime situations in Pakistan and what a victim should practically do.

What Counts as WhatsApp Cyber Crime in Pakistan?

WhatsApp is simply the medium through which the conduct takes place.

The offence depends on what the sender actually does.

Examples may include:

• threatening another person;
• repeatedly harassing or monitoring someone;
• blackmailing a person with private photographs or videos;
• demanding money through threats;
• deceiving someone into transferring money;
• running a fake investment scheme;
• taking over another person's WhatsApp account;
• using another person's identity;
• creating a fake account;
• impersonating someone to obtain money;
• circulating harmful or false material;
• using digital communications as part of extortion or fraud.

In practice, one WhatsApp incident can involve more than one offence.

For example, someone who creates a fake account in another person's name and asks that person's contacts for money may potentially raise issues of identity misuse, impersonation and electronic fraud at the same time.

WhatsApp Threats in Pakistan

Receiving a threatening WhatsApp message should not automatically be dismissed as an online argument.

The wording, intention and surrounding circumstances matter.

A threat may be sent through:

• a normal WhatsApp message;
• voice note;
• WhatsApp call;
• photograph;
• video;
• disappearing message;
• group message.

Under section 503 of the Pakistan Penal Code, criminal intimidation generally involves threatening injury to a person's body, reputation or property with the intention of causing alarm or forcing that person to do something they are not legally required to do.

Section 506 deals with punishment for criminal intimidation. The PPC provides a higher level of punishment for certain serious threats, including threats involving death or grievous hurt.

This means a message such as:

"Pay me or I will hurt you."

is legally different from an ordinary disagreement.

Similarly:

"Do what I say or I will send your private pictures to everyone."

may raise issues extending beyond criminal intimidation and potentially involve blackmail, extortion and PECA offences.

What Should You Do After Receiving a WhatsApp Threat?

Do not delete important evidence merely because the message is upsetting.

Preserve:

• the complete conversation;
• sender's number;
• profile name and photograph;
• date and time;
• voice notes;
• photographs or videos;
• WhatsApp call history;
• payment demands;
• bank or wallet information;
• messages sent to your relatives or colleagues.

If the threat appears to involve immediate physical danger, contact the police rather than relying solely on an online cybercrime complaint.

Where the threat is part of digital harassment, identity misuse, blackmail or another PECA offence, NCCIA may also have jurisdiction.

For a detailed explanation of how electronic material should be preserved, see our guide to digital evidence in cybercrime investigations.

WhatsApp Blackmail in Pakistan

Blackmail is one of the most common complaints involving WhatsApp, but not every blackmail case falls under exactly the same provision.

The law depends on what the offender possesses, what they are threatening to do and what they want from the victim.

A blackmailer may threaten to:

• publish private photographs;
• share an intimate video;
• reveal private conversations;
• contact family members;
• damage the victim's reputation;
• make false allegations;
• send material to an employer;
• demand money in exchange for silence.

Where sexually explicit photographs or videos are involved, section 21 of PECA may become particularly important depending on the exact facts.

Other cases may also involve criminal intimidation, extortion, cyberstalking or identity-related offences.

The correct legal section should therefore be selected from the evidence rather than simply describing every case as "WhatsApp blackmail."

If Someone Is Blackmailing Me With My Pictures on WhatsApp?

If someone threatens to publish your photographs unless you pay money or meet another demand, do not assume that paying will end the problem.

In many blackmail cases, the first payment is followed by another demand.

Before blocking the offender, preserve:

• the threatening messages;
• original photographs or videos where relevant;
• sender's phone number;
• voice notes;
• payment demands;
• bank account details;
• JazzCash or Easypaisa details;
• usernames;
• URLs;
• dates and times.

If the material has already been posted somewhere, preserve the page address, account name and screenshots before requesting removal.

The evidence should show the complete sequence:

material held by offender → threat → demand → payment instructions → any payment made

That is usually much stronger than one isolated screenshot.

WhatsApp Extortion in Pakistan

Extortion is different from merely asking another person for money.

The important element is the use of fear to obtain money, property or something of value.

The Pakistan Penal Code deals with extortion beginning from section 383, while later provisions deal with situations involving fear of injury and more serious threats.

A typical WhatsApp extortion message might say:

"Send Rs. 100,000 or I will publish your photographs."

Another may say:

"Transfer the money today or I will harm your family."

The electronic nature of the communication does not prevent PPC provisions from applying.

Depending on the facts, PECA may apply alongside the PPC.

Blackmail and Threats Through WhatsApp Voice Notes

A voice note can be important evidence.

A threat does not become legally irrelevant merely because the offender spoke instead of typing.

If you receive a threatening WhatsApp voice message:

• keep the original voice note;
• preserve the surrounding chat;
• note the sender's number;
• retain the date and time;
• save related calls;
• preserve any payment demand.

Avoid repeatedly converting or editing the audio where the original remains available.

If the matter becomes part of an investigation, the original device and original message may carry greater evidentiary value than a copied audio file alone.

WhatsApp Fraud in Pakistan

WhatsApp fraud generally involves deception.

A fraudster may pretend to be:

• a relative;
• bank representative;
• courier company;
• business owner;
• government official;
• employer;
• investment adviser;
• friend using a new number.

Typical messages include:

"I changed my number. I urgently need money."

"Your parcel is being held. Pay this fee."

"Your bank account will be blocked."

"Send your OTP so we can verify your account."

"Invest today and receive guaranteed profit."

NCCIA itself warns citizens about online financial fraud, fraudulent links and fake investments promising quick returns.

Where electronic deception is deliberately used to obtain money or cause wrongful loss, the electronic-fraud provisions of PECA may become relevant.

Depending on how the fraud was carried out, the PPC provisions relating to cheating may also apply. If the scam involved a mobile-wallet payment, see our guide to JazzCash scams and fraud in Pakistan.

What Should You Do If You Sent Money to a WhatsApp Scammer?

Act quickly.

Do not continue sending money because the scammer promises that one final payment will release your funds.

Take these steps:

1. Stop further payments.
2. Contact your bank or payment service immediately.
3. Preserve payment receipts.
4. Save the complete WhatsApp conversation.
5. Record the scammer's number.
6. Keep bank account or mobile-wallet details. For JazzCash-specific fraud and recovery steps, see our JazzCash fraud guide.
7. Preserve websites, apps and usernames used in the fraud.
8. Lodge a complaint with NCCIA.

WhatsApp Investment Fraud in Pakistan

Investment fraud has become particularly common through WhatsApp groups.

The scam often looks professional.

The victim may be invited into a group where people appear to discuss:

• stocks;
• cryptocurrency;
• forex;
• commodities;
• online trading;
• investment signals.

A supposed expert may regularly share profitable trades.

Other group members may post screenshots claiming they made large returns.

The victim is then encouraged to deposit a small amount.

At first, the account may even show a profit.

Once trust develops, the fraudster asks for a larger investment.

The problem normally appears when the victim attempts to withdraw the money.

Suddenly, further payments are required for:

• tax;
• verification;
• account activation;
• commission;
• security deposit;
• withdrawal fee;
• compliance clearance.

These additional payments can themselves be part of the fraud.

How Does a WhatsApp Investment Group Scam Build Trust?

The usual pattern is:

Invitation → conversation → social proof → small investment → fake profit → larger investment → blocked withdrawal → further demands

One of the most effective techniques is fake social proof.

Group members may write:

"I deposited Rs. 200,000 yesterday and received Rs. 350,000 today."

But those accounts may be connected with the same people operating the fraud.

A large WhatsApp group does not prove that an investment is genuine.

Neither does:

• a professional website;
• screenshots of profits;
• testimonials;
• certificates sent by the promoter;
• screenshots of supposed withdrawals.

Investment opportunities should be verified independently.

WhatsApp Account Hacked in Pakistan

A WhatsApp account may be taken over when a victim:

• shares the registration code;
• scans a fraudulent QR code;
• links an unknown device;
• loses control of the SIM;
• gives access to a compromised device.

If you suddenly lose access to your WhatsApp account, act immediately.

WhatsApp's current guidance says the user can re-register the phone number and enter the six-digit registration code received by SMS or phone call. Re-registering the number logs out another person who may be using the account.

After recovery:

• check Linked Devices;
• log out unfamiliar devices;
• secure your email account;
• enable additional account protection;
• change important passwords where necessary;
• tell family and colleagues not to trust suspicious messages sent during the compromise.

WhatsApp recommends regularly checking linked devices and allows users to log out unknown sessions.

Never share your WhatsApp verification code with anyone.

WhatsApp Account Cloning and Fake Accounts

People often use the term "WhatsApp cloning" for two different situations.

Someone has accessed your real WhatsApp account

In this situation, account recovery and checking linked devices should be the immediate priority.

Someone has created another account pretending to be you

Here, the offender may use:

• your photograph;
• your name;
• your business identity;
• similar wording from your profile;
• another mobile number.

Take screenshots before the profile disappears.

Ask people who received messages from the fake account to preserve their original conversations as well.

Where another person's identity information is used without authority, PECA provisions relating to identity information may become relevant.

If the offender then asks other people for money, the matter may also involve fraud or cheating by personation.

Someone Is Using My Name on WhatsApp to Ask People for Money

This situation can involve several legal issues at the same time.

The offender may be:

1. misusing your identity;
2. impersonating you;
3. deceiving your contacts;
4. attempting to obtain money.

Do not collect only screenshots forwarded to you.

Where possible, ask affected contacts to preserve the original WhatsApp conversation on their own devices.

That can help establish exactly what was sent, from which number and at what time.

Defamation Through WhatsApp

Not every insulting WhatsApp message amounts to criminal defamation.

A legal assessment has to consider:

• the actual words used;
• whether they were communicated to other people;
• whether the statement is factual or opinion;
• whether it is false;
• the surrounding context;
• the intention;
• available legal exceptions or defences.

The Pakistan Penal Code contains criminal-defamation provisions, while PECA may also become relevant to certain knowingly false electronic communications where the statutory conditions are met.

A WhatsApp group message can be especially important because it has been communicated to multiple people.

Preserve the full conversation, not merely one sentence.

Which Laws Apply to WhatsApp Cybercrime in Pakistan?

There is no single provision covering every WhatsApp offence.

Several laws may operate together.

Prevention of Electronic Crimes Act, 2016, as amended

PECA is Pakistan's main federal cybercrime law.

Depending on the conduct, it can become relevant to matters involving:

• electronic fraud;
• identity misuse;
• cyberstalking;
• certain reputation and privacy offences;
• sexually explicit material;
• other offences involving information systems.

The exact section depends on the evidence and allegations.

Pakistan Penal Code, 1860

Traditional criminal offences do not stop applying simply because WhatsApp was used.

PPC provisions may become relevant to:

• criminal intimidation;
• extortion;
• cheating;
• cheating by personation;
• defamation;
• related offences.

PECA itself provides for the application of the Pakistan Penal Code where it is not inconsistent with PECA.

Code of Criminal Procedure, 1898

The CrPC governs important parts of criminal procedure, investigation and trial in Pakistan.

The exact procedure depends on the nature of the offence, whether a special law applies and which authority has jurisdiction.

PECA is a special law, so its investigation and procedural provisions also need to be considered alongside the general criminal procedure.

Qanun-e-Shahadat Order, 1984

The law of evidence becomes important when WhatsApp messages, screenshots, voice notes, photographs, videos or device records are produced in legal proceedings.

The central issues commonly include:

• authenticity;
• relevance;
• integrity;
• authorship;
• continuity of evidence.

Electronic Transactions Ordinance, 2002

The Electronic Transactions Ordinance gives legal recognition to electronic records.

An electronic record should not lose legal recognition merely because it exists in electronic form.

This is important for emails, messages, transaction records and other digital communications.

NCCIA and WhatsApp Cybercrime Complaints

For a present-day PECA offence, NCCIA is now the relevant federal cybercrime investigation agency.

NCCIA's official FAQ states that, under section 29(1) of the PECA Amendment framework, NCCIA is authorized for inquiries, investigations and prosecutions.

NCCIA currently allows complaints through:

• its online complaint system;
• Pakistan Citizen Portal;
• email;
• Cybercrime Reporting Centres.

For a formal complaint, its current guidance lists a written application, CNIC copy and supporting evidence.

The agency's official complaint portal also lists 1799 as its helpline and provides office information across Pakistan.

NCCIA or FIA: Which Agency Handles Cybercrime in 2026?

This causes considerable confusion because thousands of older articles still refer to the FIA Cyber Crime Wing.

That information reflects the older system.

For offences investigated under PECA today, NCCIA is the designated federal cybercrime agency.

FIA remains a federal law-enforcement agency and may still be relevant where an offence falls within its separate jurisdiction or another lawful investigative mechanism applies.

The important point is that a current guide should not tell every WhatsApp cybercrime victim to file a complaint with the former FIA Cyber Crime Wing.

How to File a WhatsApp Cybercrime Complaint With NCCIA

A complaint should be factual and chronological.

Explain:

• who contacted you;
• when contact started;
• what the person said;
• what they demanded;
• what money or information you provided;
• what happened afterwards;
• whether there are continuing threats.

Attach supporting evidence.

Useful documents can include:

• CNIC copy;
• screenshots;
• exported conversation;
• voice notes;
• phone numbers;
• payment receipts;
• account numbers;
• mobile-wallet details;
• URLs;
• usernames;
• transaction records.

NCCIA's official portal provides online complaint registration, while its formal complaint guidance refers complainants to Cybercrime Reporting Centres for investigation-related processing.

How to Write a Strong Cybercrime Complaint

Avoid emotional accusations that do not explain what actually happened.

Instead of writing:

"This man is a dangerous cybercriminal who has destroyed my life."

write something like:

"On 18 September 2026, I received a WhatsApp message from the number stated below. The sender demanded Rs. 200,000 and stated that my private photographs would be forwarded to my family if I did not pay. Copies of the messages and voice notes are attached."

That tells the investigator:

date + platform + accused identifier + threat + demand + evidence

A clear timeline can make a complaint much easier to understand.

How to Preserve WhatsApp Evidence Properly

A strong cybercrime case often depends on evidence preservation.

Where possible, keep:

• the original phone;
• complete chat;
• sender's number;
• screenshots;
• voice messages;
• photographs and videos;
• call logs;
• account information;
• group details;
• transaction records;
• bank alerts;
• related emails and SMS.

Avoid:

• deleting the chat;
• editing screenshots;
• cropping out the sender's identity;
• changing contact names unnecessarily;
• factory-resetting the device;
• installing random recovery software.

An exported chat may be useful as an additional record, but the original device and original conversation can still be important.

For more detail, read Digital Evidence in Cybercrime Investigations and Court Proceedings.

If forensic extraction or recovery becomes necessary, see Digital Forensic Tools for Cybercrime Investigation.

Can WhatsApp Messages Be Used as Evidence in Pakistani Courts?

Yes, WhatsApp communications can potentially form part of the evidence in a Pakistani case.

But a screenshot should not automatically be treated as conclusive proof.

The court or investigating authority may need to consider:

• whether the message is genuine;
• who controlled the number;
• whether the screenshot was altered;
• whether the conversation is complete;
• whether the original device is available;
• whether other evidence supports the communication.

Pakistan's electronic-transactions framework recognizes electronic records, and the law of evidence provides the wider framework for proving electronic material.

Can Deleted WhatsApp Messages Be Recovered?

Sometimes.

But there is no guarantee.

Recovery may depend on:

• whether another participant still has the message;
• whether a backup exists;
• how recently it was deleted;
• the operating system;
• phone usage after deletion;
• available forensic artifacts.

If an important conversation has been deleted, avoid installing multiple unknown recovery applications.

Continued use of the device can change or overwrite recoverable data.

For a serious matter, professional forensic examination may be more appropriate.

Does WhatsApp Reporting Automatically File an NCCIA Complaint?

No.

These are completely separate processes.

Reporting inside WhatsApp

This asks WhatsApp to review the account under its own platform rules.

Filing with NCCIA

This asks a Pakistani law-enforcement agency to investigate alleged criminal conduct.

Reporting the account in WhatsApp does not automatically start a criminal case in Pakistan.

Similarly, filing an NCCIA complaint does not itself guarantee that WhatsApp will remove or ban an account.

How to Reduce the Risk of WhatsApp Fraud and Account Theft

Basic precautions prevent many incidents.

Never share verification codes

A genuine support representative does not need your WhatsApp registration code.

Check Linked Devices

WhatsApp itself recommends regularly reviewing linked devices and logging out anything you do not recognize.

Use additional account security

Enable the additional security options available in your current WhatsApp version.

Verify unusual money requests

If a relative suddenly messages from a new number requesting money, call them independently before transferring anything.

Do not trust investment screenshots

A screenshot showing profit is not proof that an investment exists.

Do not click unknown links

A message that looks like a parcel notification, bank warning or government notice can still be fraudulent.

When Should You Contact the Police as Well as NCCIA?

Not every cybercrime should be treated as an online-only problem.

Contact the police where there is an immediate risk such as:

• threats of physical violence;
• threats against family members;
• stalking near your home or workplace;
• attempts to abduct or physically harm someone;
• an ongoing emergency.

The presence of WhatsApp messages does not prevent ordinary criminal law or police jurisdiction from becoming relevant.

Conclusion

WhatsApp cybercrime in Pakistan is not limited to hacked accounts or suspicious links.

The same platform can be used for fraud, blackmail, extortion, impersonation, identity misuse, harassment, investment scams and criminal threats.

The law does not treat every WhatsApp dispute in the same way. The correct legal remedy depends on what actually happened.

PECA may apply where the conduct involves electronic offences. The Pakistan Penal Code may apply to criminal intimidation, cheating, extortion and other traditional offences. Electronic records can also become important evidence under Pakistan's wider evidentiary framework.

For PECA-related cybercrime, NCCIA is now the relevant federal investigation agency, replacing the older practice of directing every complaint to the FIA Cyber Crime Wing.

For victims, the most important practical rule is:

Do not delete the evidence.

Preserve the conversation, secure the account, stop further payments where fraud is involved, contact the financial institution quickly, and file the appropriate complaint.

A cybercrime case is usually easier to investigate when the evidence tells a clear story:

who contacted you → what they did → what they demanded → what happened next → what evidence proves it.