Cybercrime, Online Fraud and Digital Evidence in Pakistan
Pakistan-law assessment for hacking, online fraud, harassment, impersonation, digital evidence, complaints, defence and lawful relief.
Pakistan-law guide
What to Do When an Online Account Is Hacked
Use an unaffected device or channel where possible, protect the connected email and phone, preserve login alerts and messages, use the platform’s official recovery process, notify a bank where payment loss is continuing, and obtain legal advice about complaint and preservation routes.
Confidential preliminary intake. Submission does not create a lawyer-client relationship or protect a deadline.
Published: · Last substantive update:
Information, not advice: This guide is general. Current instruments, facts, documents and jurisdiction must be checked for a specific matter.
Practical scope
First actions
- Protect immediate personal safety.
- Secure connected email, phone and unaffected accounts.
- Preserve access alerts, session records, messages, URLs and transaction evidence.
Practical scope
Avoid making it worse
- Do not pay someone who guarantees restoration.
- Do not share OTPs, recovery codes or passwords.
- Avoid wiping the only relevant device before evidence needs are considered.
Practical scope
Legal route
- Assess platform, bank, employer, contract, NCCIA and court routes according to the facts.
- No restoration, investigation or takedown outcome is guaranteed.
Connected routes
Related Pakistan-law services
Use the closest route for preliminary classification; the final scope depends on conflict checks, documents and written engagement.
Official primary sources
Legal and regulatory sources checked
These links support the general regulatory statements above. The operative instrument, facts and publication date must still be reviewed for a specific matter.
- NCCIA complaint guidance
- NCCIA complaint portal
- Pakistan Code — Prevention of Electronic Crimes Act, 2016, as amended
Last legally reviewed:
General information
Questions and careful answers
Should every device be reset immediately?
Containment is important, but indiscriminate wiping can remove useful records. A qualified technical professional may be needed for a business or serious incident.
Confidential next step
Request a matter-specific assessment.
Use the public routes only for general intake. Do not send passwords, OTPs, private keys, seed phrases, identity documents, intimate material, complete evidence files or confidential case records.
Website information is general and does not create a lawyer-client relationship. Legal work begins only after conflict checks, identity verification, agreed scope, fee confirmation, and written engagement. No investigation, recovery, licence, relief or other outcome can be promised.