A cousin of mine once spent an entire weekend trying to figure out where to report a fake Facebook account that was using her photos. She called the old FIA helpline number she found online, got bounced between departments, and eventually gave up out of pure frustration. That was two years ago. If she went through the same thing today, she’d hit the same wall for a different reason: the agency she was calling doesn’t even handle these complaints anymore.
That’s the first thing most people get wrong in 2026, and it’s worth clearing up before anything else.
Who Do You Actually Complain To Now?
Cyber crime in Pakistan is governed by the Prevention of Electronic Crimes Act (PECA) 2016, but the enforcement structure changed significantly under the PECA Amendment Act 2025, passed by the National Assembly on January 23, 2025. That amendment created the National Cyber Crime Investigation Agency (NCCIA) and gave it exclusive authority to investigate and prosecute digital offences, a power that used to sit with the FIA’s Cyber Crime Wing (NR3C).
1. The FIA Cyber Crime Wing no longer independently handles new complaints
2. Old FIA cybercrime channels now simply redirect submissions to the NCCIA, which costs you time
3. For practical purposes, “reporting cyber crime to the FIA” now means filing with the NCCIA
4. The NCCIA operates its own Cybercrime Reporting Centres (CCRCs) in major cities
What Else Changed Under the 2025 Amendments
The 2025 amendment didn’t just rename the investigating agency. It restructured a fair amount of how online conduct is regulated in Pakistan.
1. It created the Social Media Protection and Regulatory Authority (SMPRA), which can monitor, regulate, and order the removal of content it deems unlawful or offensive
2. It introduced a “fake news” offence that can carry up to three years imprisonment and significant fines
3. It kept Section 20, the electronic defamation provision, largely intact, allowing prison terms of up to three years for cases involving false statements that harm someone’s reputation online
Victims of online defamation are not limited to criminal complaints either. Many also pursue a parallel civil law claim for damages, which follows a different process and a different burden of proof than a criminal case under PECA.
These changes have not been without controversy. Human rights organizations and press freedom groups have argued that Section 20 has disproportionately been used against journalists and civil society figures, and courts, including the Islamabad High Court, have previously urged authorities to issue specific guidelines protecting journalists from its misuse. The government’s position is that the amendments were necessary to keep pace with the speed of the social media era and close gaps in the original 2016 law. Both sides of that debate are still actively playing out, including in a pending Supreme Court petition challenging Section 20 on free speech grounds.
What Actually Counts as Cyber Crime Under PECA
PECA covers a wide range of conduct, not just hacking. The offences people report most often include:
1. Unauthorized access to someone’s device, account, or data
2. Online financial fraud, including fake investment schemes and phishing
3. Identity theft and the creation of fake or impersonating profiles
4. Cyber harassment, stalking, and blackmail
5. Electronic defamation under Section 20
6. Spreading fake news under the newer Section 26-A
7. Child-related online exploitation, which is treated with particular severity
How to File a Complaint, Step by Step
If all your documentation is ready, this process moves faster than most people expect.
1. Gather your evidence before you start. Screenshots, transaction records, and profile links are far more useful collected calmly than scrambled together after the fact.
2. File through the NCCIA’s official complaint portal at complaint.nccia.gov.pk, or through the Pakistan Citizen Portal at web.citizenportal.gov.pk.
3. Alternatively, email your complaint to helpdesk@nccia.gov.pk, written clearly in English or Urdu.
4. For urgent matters, visit your nearest Cybercrime Reporting Centre in person. NCCIA headquarters is in Sector G-10/4, Islamabad, with regional CCRCs including one in Gulistan-e-Johar, Karachi, covering Sindh.
5. If you need guidance before filing, call the NCCIA helpline at 1799. It’s useful for advice and securing a compromised account, though it does not register a formal complaint or FIR on its own.
6. Once submitted, the NCCIA typically verifies a complaint within around 14 days before formal investigation begins, though serious matters are meant to see action started within 24 to 48 hours under current guidelines.
Complaints cannot be filed anonymously. You’ll need to provide your full name, CNIC number, and contact details as part of the verification process.
Evidence That Actually Strengthens Your Case
Vague complaints get deprioritized. Specific, well-documented ones move faster.
1. Uncropped, full-context screenshots that clearly show timestamps and the other party’s name or number
2. The direct profile URL of the account involved, so the NCCIA can request platform data if needed
3. For financial fraud, the full transaction ID or UTR number and the name of the bank or mobile wallet used
4. Exported transaction logs from your banking app, in PDF or CSV form
5. The complete, unshortened URL if a phishing link was involved
6. Original, unedited copies of any photos, videos, or messages you received
7. A clear, chronological written account of exactly what happened, in your own words
If your case involves serious financial loss or an active blackmail threat, it’s also worth informing your bank immediately, since accounts can sometimes be frozen faster than a criminal case can be built. Keep in mind that a PECA complaint does not automatically recover your money either. Pursuing the matter through civil law alongside your criminal complaint is often the more direct route to actually reclaiming lost funds.
Penalties You Should Know About
Punishments under PECA vary considerably depending on the specific offence and its severity.
1. General cybercrime offences can carry sentences ranging from three to ten years, along with fines that can reach into the millions of rupees for serious cases
2. Electronic defamation under Section 20 can carry up to three years imprisonment
3. Spreading fake news under Section 26-A can carry up to three years imprisonment plus a fine of up to Rs. 2 million
4. Offences involving children online are treated as aggravated and punished more severely
Final Thoughts
The legal framework itself, PECA, hasn’t disappeared or gotten weaker. What’s changed is who enforces it and how quickly you can expect a response if your complaint is well documented. If you take one thing from this guide, let it be this: stop looking for the FIA cybercrime portal, and go straight to the NCCIA instead. It will save you the exact weekend my cousin lost chasing a department that no longer handles these cases.