The distinction that matters: conduct, not the headset
A customer-support desk and a fraudulent operation may both use laptops, headsets and a customer relationship management system. Equipment therefore tells only part of the story. The meaningful questions concern the caller’s authority, the truth of the offer, the source of customer information and what happens to payments. PECA creates specific offences; it does not make the business label “call centre” an offence. [1]
A genuine company can nevertheless have a compliance problem. For example, an otherwise authentic campaign may operate from an unregistered branch or through telecommunications arrangements requiring correction. That should be examined seriously, but it must not be casually equated with proof of electronic fraud. Conversely, a company’s registration cannot legalise a deliberately deceptive campaign.
This distinction protects both sides of responsible enforcement: genuine businesses need predictable rules, while customers need protection against fraud hidden behind corporate paperwork.
What lawful outsourcing looks like in practice
Customer support, order processing, administrative assistance, genuine appointment setting and authorised technical support are examples of services that may be provided lawfully. Medical billing and outbound marketing require additional care because the activity can engage destination-market rules and sensitive information. The service name is a starting point, not a legal conclusion. [1] [2]
A defensible operation should have an identifiable client, a written service description and instructions that staff can explain without concealing the real purpose of the campaign. Its sales claims should correspond to an actual product or service. Its access to client systems and customer records should have an adequate legal and contractual basis.
Consider a support team answering warranty enquiries for an authorised retailer. The retailer contract, approved script, system permissions and invoices should tell the same commercial story. A mismatch between those records and what agents actually say deserves investigation before more calls are made.
Four separate compliance questions
Business structure: identify the legal operator. A company’s SECP obligations differ from those of another lawful business form. Incorporation is not the only possible structure, and a trading name alone does not identify the contracting party. [4]
Tax registration and reporting: establish the applicable FBR and, where relevant, provincial obligations. An NTN is not proof that every return or payment obligation has been met. Avoid assuming that every export-related receipt is automatically tax-free. [5]
Voice operations: PSEB publishes a call centre registration process and guidance on legal voice operations, provisional status, branches and IP whitelisting. Check the actual location and configuration, not merely the name on an old certificate. [2] [3]
Campaign conduct: examine customer-facing representations, permissions, data handling and payment processes. A failure in this fourth category is not cured by success in the first three. PECA liability turns on the applicable offence and evidence. [1]
When a campaign crosses into criminal exposure
Electronic fraud, electronic forgery, unauthorised identity-information use and spoofing are distinct statutory questions. Investigators must identify the relevant provision and evidence rather than treating them as interchangeable labels. Depending on the allegation, intention, authorisation, deception, likely harm and the individual’s participation may be central. [1]
Warning signs include instructions to falsely claim affiliation with a known organisation, take payment for a fictitious service, use another person’s identity information without authority, or conceal unauthorised access. These are prompts for immediate assessment, not a substitute for proving an offence.
A questionable campaign should be paused and reviewed without destroying its records. Management should preserve the client instructions and ask who approved the disputed practice. Quietly rewriting the script while deleting the earlier version can damage the business’s ability to explain what happened.
Registration helps demonstrate legitimacy, but is not immunity
A PSEB certificate is relevant to regulatory status. It does not decide whether a particular transaction was deceptive, whether a database was lawfully acquired or whether an employee knowingly participated in an offence. NCCIA’s PECA mandate is not displaced merely because the investigated entity is registered. [1] [2]
The stronger approach is to maintain a coherent evidence file: current registration records, client identity checks, contracts, campaign approvals, invoices and banking records, together with access and training records where appropriate. Keep documents contemporaneously rather than assembling backdated explanations after a notice arrives.
The objective is not to accumulate impressive-looking paperwork. It is to make the actual business understandable and verifiable. An unsupported contract that contradicts the calls being made may be less useful than a straightforward, accurate account of a limited service.
A practical example: genuine business, imperfect records
Suppose a Lahore support company has a real overseas client and receives payment for completed work, but has recently moved offices. Its PSEB record and whitelisted IP information still reflect the previous premises. This is a hypothetical example, not a reported case.
The sensible response is to establish which update or approval is required, preserve the move chronology and correct the discrepancy through the proper process. Management should also check whether operations at the new site can continue under the existing status. It should not claim that a genuine client makes location requirements irrelevant. Equally, the location discrepancy alone does not answer every element of a fraud allegation. [3] [1]
This is why registration advice and criminal-law assessment should be coordinated but not confused.
What owners should do this week
Assign one person to reconcile the business entity, office addresses, PSEB status and calling infrastructure. Ask each campaign manager to produce the signed client instruction, current script and explanation of how leads were obtained. Match a sample of invoices to actual work and receipts.
Then record gaps honestly, with an owner and completion date for each corrective action. Prioritise possible deception or unauthorised access over cosmetic policy changes. Introduce a reporting route through which an agent can raise a questionable instruction without being told to conceal it.
For the detailed follow-through, this series separates registration, raids, employee responsibility and foreign-market compliance into individual guides. A business is best protected by genuine lawful conduct supported by reliable records, not by a promise that no agency can ever investigate it.
Legal assistance for this issue
Legal Bridge LLP can review Pakistan-side corporate and cybercrime exposure together, so a registration problem is not mistaken for the answer to a criminal allegation. Any representation requires a separate engagement.
