Start with the allegation, then identify its elements
“Scam calling” is an everyday description, not a complete legal analysis. A proper assessment identifies what was said or done, which information system or data was involved, who authorised the activity and what the alleged participant knew or intended where the statute requires it. [1]
This matters because different provisions use different language. It would be wrong to say that every PECA offence requires exactly the same proof of dishonest intention. It would also be wrong to treat a customer’s complaint, an agent’s job title or possession of a dialler as automatic proof of all elements.
Build a chronology of the actual campaign. Separate the client’s instructions, the approved script, what agents communicated and what happened to customer information or payments. That sequence often reveals which legal question needs attention.
Electronic fraud and electronic forgery are not interchangeable
Section 14 addresses electronic fraud through its requirements concerning wrongful gain, systems or data, deception and the relevant risk of harm. A purported service offer used to induce a customer to part with money or sensitive information may require assessment under this provision. Do not assume that the analysis always ends merely because a particular transaction did not produce a completed financial loss. [1]
Section 13 concerns electronic forgery and its own statutory elements. Manipulated electronic records, false digital documents or other specified misuse may raise a different issue from a misleading sales conversation. A fabricated authorisation could become important even where a genuine business relationship existed elsewhere.
For compliance purposes, keep the offer truthful and the records authentic. Never invent purchase approvals, rewrite consent histories or backdate client instructions to make a disputed transaction appear authorised.
Unauthorised access, copying and interference
Sections 3, 4 and 5 address different forms of unauthorised access, copying or transmission, and interference, with the mental and factual elements specified in each provision. A lawful login for one task does not necessarily authorise every action available inside the platform. [1]
For example, an agent authorised to view a limited customer queue may not be authorised to export the entire CRM for a private campaign. A departing supervisor may not retain or reuse a client database simply because they once had access for work. These examples require factual analysis; they are not findings about any real employee.
Permissions should identify the task, dataset, permitted recipients and duration. Disable access through a controlled process when a role changes, while preserving relevant audit records. Do not destroy the access history merely to tidy the system after a dispute.
Identity information, impersonation and counterfeit sources
Section 16 concerns unauthorised obtaining, possession, transmission, sale or use of another person’s identity information. The permission question is therefore central. Purchasing a lead list or receiving it from a client does not, by itself, establish that every proposed use is authorised. [1]
Section 26 addresses spoofing through its particular requirements involving a counterfeit source and dishonest intention. Ordinary use of an overseas telephone number is not automatically equivalent to the offence. The analysis changes where an operation deliberately makes communications appear to originate from an institution or person without the necessary authority.
Customer-facing identity must be truthful. An agent may legitimately act for an identified client, but that arrangement should be real and properly documented. A contract cannot cure an instruction to pretend to be a bank, government office or unrelated technical-support provider.
Spamming and tools: examine purpose and use
Section 25 addresses spamming through its statutory categories and conditions; its direct-marketing provisions also address an unsubscribe option. It should not be reduced to the proposition that every promotional communication is criminal, nor to the opposite proposition that any purchased database may be contacted freely. [1]
Section 15 concerns devices and related conduct linked to use in an offence. A standard dialler, CRM or automation tool has legitimate uses. Its presence must be distinguished from evidence of prohibited purpose or deployment.
The same discipline applies to section 26A. Its public-information offence has specific elements relating to false or fake information and public fear, panic or disorder. It is not a convenient substitute label for every inaccurate sales statement. Analyse the alleged conduct under the provision that actually fits.
Three campaign examples that require different responses
Authorised support: a team handles account enquiries through a client-approved portal, using accurate identification and access restricted to its assigned work. The central controls are genuine authority, secure access and an auditable service scope.
Questionable marketing: a lead supplier cannot explain how numbers were collected, and agents are told to hide the seller’s identity. Pause the disputed elements, preserve supplier instructions and investigate consent, representations and destination-market rules. Do not declare the campaign safe because it has not yet produced a complaint.
Apparent deception: staff are instructed to invent an unpaid bill and obtain card details to “avoid disconnection”. The instruction raises serious potential fraud and identity-information issues. Preserve evidence and seek advice on stopping the conduct and handling any reporting obligation. [1]
These are hypothetical illustrations, not legal verdicts. Their purpose is to show why one generic “call centre compliance certificate” cannot answer every campaign risk.
Evidence should connect a person to a particular act
An owner, client, manager and agent may have different levels of authority and involvement. Relevant material can include script approvals, messages, training, role permissions, transaction records and the individual’s response when concerns were raised. Corporate status and employment are not substitutes for examining actual participation. [1]
Management should create escalation channels and record meaningful supervision. Employees should report questionable instructions through a safe documented route and obtain advice when personally implicated. No one should be asked to coordinate a false explanation, delete incriminating messages or sign a statement they do not understand.
A useful review ends with a specific decision: approve the documented lawful activity, correct a defined gap, or suspend a prohibited or unresolved practice. It does not end with an unsupported assurance that “everyone in the industry does it”.
Legal assistance for this issue
Legal Bridge LLP can review scripts, client instructions and allegations against the relevant PECA provisions. Pakistan-law advice should be coordinated with appropriately qualified foreign counsel where a campaign targets another jurisdiction.
