Someone makes a fake account with your name and your photos. A blocked number keeps texting you from new numbers. One law deals with all of this in Pakistan.
It is the Prevention of Electronic Crimes Act 2016, known as PECA. It covers hacking, fraud, harassment, stalking, and crimes against children. Here is what it says.
What is PECA 2016?
PECA is the short name for the Prevention of Electronic Crimes Act 2016, passed by Parliament as Act XL of 2016. It applies to the whole of Pakistan, covers every Pakistani citizen wherever they are, and anyone who commits an act abroad that affects a person, property, or system inside Pakistan.
Hacking and data crimes (sections 3 to 8)
Section 3 is the basic hacking offence. Getting into a system or data without permission carries up to three months in jail or a fine up to Rs 50,000. Copying or transmitting data without permission (section 4) carries up to six months or Rs 100,000. Interfering with a system or data (section 5) carries up to two years or Rs 500,000.
Sections 6 to 8 cover the same acts against critical infrastructure, like banking or power systems. Hacking them carries up to three years or Rs 1 million, copying their data up to five years or Rs 5 million, and interfering with them up to seven years or Rs 10 million.
Cyber terrorism and hate speech (sections 9 to 12)
Section 9 punishes glorifying terrorism: up to seven years or Rs 10 million. Section 10 is cyber terrorism, hacking attacks on critical systems to create fear or panic: up to fourteen years or Rs 50 million. Section 11 is hate speech, spreading information that advances interfaith, sectarian, or racial hatred: up to seven years or a fine.
Electronic forgery and fraud (sections 13 to 15)
Section 13 is electronic forgery, creating fake data or documents through a system so they look authentic. It carries up to three years or Rs 250,000, and up to seven years or Rs 5 million when it involves critical infrastructure.
Section 14 is electronic fraud, using a system to deceive someone for wrongful gain. It carries up to two years or a fine up to Rs 10 million.
Identity theft (section 16)
Section 16 covers using someone else's identity information without permission, including your name, photos, or CNIC number. Obtaining, selling, or using it carries up to three years or Rs 5 million. If a fake account uses your identity, you can apply to the Social Media Protection and Regulatory Authority (SMPRA) to have it secured, blocked, or destroyed.
Offences against dignity and modesty (sections 20 and 21)
Section 20 protects your reputation and privacy. If someone publicly posts information they know is false, and it harms your reputation or intimidates you, the punishment is up to three years or Rs 1 million. The Islamabad High Court struck down the reputation part of this section in 2022, and it remains unsettled. See online defamation in Pakistan.
Section 21 is the one about intimate images. It covers putting your face onto explicit content, sharing real photos or videos of you without consent, and threatening you with sexual images. It carries up to five years or Rs 5 million. If the victim is a minor, up to seven years and a fine. A repeat offender against a minor faces ten years.
Section 21 is non-bailable and non-compoundable. The accused cannot get bail easily, and the case cannot be settled quietly.
Crimes against children (sections 22, 22A to 22C)
Section 22 covers child sexual abuse material. Producing, sharing, or possessing such material carries imprisonment of fourteen to twenty years and a fine of at least Rs 1 million.
Section 22A covers online grooming, building trust with a minor through a system with intent to commit sexual abuse. It carries five to ten years and a fine of Rs 500,000 to Rs 10 million. Sections 22B and 22C cover the commercial sexual exploitation of children and using systems to kidnap or traffic a minor, each carrying fourteen to twenty years.
Cyberstalking and cyberbullying (sections 24 and 24A)
Section 24 is cyberstalking: repeatedly contacting someone who has said no, spying in a way that causes fear or distress, or sharing a photo without consent to harm someone. It carries up to three years or Rs 1 million, and up to five years or Rs 10 million for a minor victim.
Section 24A is cyberbullying, sending messages, pictures, or videos to harass, threaten, or target someone. Bullying a child carries one to five years and a fine of Rs 100,000 to Rs 500,000.
The 2025 amendment: what changed
In January 2025, Parliament passed the Prevention of Electronic Crimes (Amendment) Act 2025. Three changes matter most.
First, a new regulator. The Social Media Protection and Regulatory Authority (SMPRA) regulates platforms and handles complaints about fake information. Under section 2C, a person harmed by fake information can apply, and SMPRA must pass an order within twenty-four hours.
Second, a new offence. Section 26A punishes knowingly spreading false or fake information likely to cause fear, panic, or unrest. It carries up to three years or a fine up to Rs 2 million. Rights groups have criticised it as vague and open to misuse.
Third, a new investigation agency. The National Cyber Crime Investigation Agency (NCCIA) replaced the FIA Cyber Crime Wing. Complaints now go to the NCCIA, and a new Social Media Protection Tribunal hears appeals against the regulator.
Which offences are bailable?
Section 43 divides PECA offences into two groups. Most offences are bailable, compoundable, and non-cognizable. The accused can get bail, the case can be settled, and the agency needs a complaint to act.
But sections 10, 21, 22, 22A, 22B, and 22C are non-bailable, non-compoundable, and cognizable. No bail as a matter of right, no private settlement, and the agency can act directly.
Where to report a cybercrime
Cybercrime complaints are filed with the NCCIA. You can file online at the NCCIA complaint portal with your CNIC and your evidence. It is free and you do not need a lawyer. For the full process, see our guide on filing a cybercrime complaint step by step.
Lost money to a scam? See where to complain about online fraud. Someone shared your private images? See the law that protects you from revenge porn.
Chatbots like ChatGPT are not banned in Pakistan. See is ChatGPT legal in Pakistan for what the law covers.
What to do if you are a victim
- Save everything. Screenshots, URLs, usernames, chat logs, transaction IDs. Do not delete the messages. Never pay a blackmailer. Paying does not stop it.
- File the complaint with the NCCIA and note your complaint number. If the content is on a social media platform, apply to SMPRA to have it removed or blocked.
For more plain language guides on the law in Pakistan, browse the Lexiber blog or start at the Lexiber home page.
Ask Lexiber free in English or Urdu. It shows you the exact section behind every answer.
