The legal framework
Section 16 of the Prevention of Electronic Crimes Act 2016 makes it an offence to obtain, sell, possess or transmit another person's identity information without authorisation, and gives the victim the right to apply to the authority for the securing, destruction or blocking of that information. SIM-related fraud is handled alongside the telecom regulator.
The Prevention of Electronic Crimes Act criminalises the unauthorised use of another person's identity information, and the Federal Investigation Agency's cybercrime wing investigates, taking complaints through an online portal and regional offices. Investigations are slow and recovery rates low, so the value of reporting lies mainly in documenting the misuse for the banks and telecom operators you will have to deal with.
Key points
| Statute | PECA 2016 section 16, unauthorised use of identity information |
|---|---|
| Victim right | Application to have the information secured, destroyed or blocked |
| Enforcement | National Cyber Crime Investigation Agency (NCCIA), successor to the FIA Cybercrime Wing (2025) |
| SIM verification | Check the SIMs registered against your CNIC using the PTA verification service |
| Banking | State Bank rules require banks to investigate unauthorised transactions |
| Documents | NADRA for CNIC issues |
| SIM limit | A limited number of SIMs may be registered against one CNIC |
| Blocking | Unrecognised SIMs can be blocked through the operator or the regulator |
| Bank duty | Institutions must investigate reported unauthorised transactions |
In practice
- Check which SIMs are registered to your CNIC and have unknown ones blocked.
- File a complaint with the National Cyber Crime Investigation Agency (NCCIA), in writing, with all evidence attached.
- Inform your bank in writing and ask for a formal investigation reference.
- Contact NADRA if your CNIC has been misused.
- Check the SIMs registered against your CNIC and block any you do not recognise.
Where to go
- National Cyber Crime Investigation Agency (NCCIA).
- PTA SIM information system.
- NADRA regional offices.
Worth knowing
SIM cards registered against a stolen CNIC are a common route into bank accounts: the SIM check is the first thing to do, and it takes minutes. SIM cards registered against a stolen CNIC are the standard route into bank accounts. The check takes minutes and is free.
Frequently asked questions
How do you report to the cybercrime wing?
Through the Federal Investigation Agency's online complaint portal or at a regional cybercrime office, with copies of everything — screenshots, transaction records, the CNIC used. Keep the complaint number; banks and mobile operators will ask for it before reversing or blocking anything.
What should you do in the first hour?
Call your bank and freeze the affected accounts and cards, change the passwords on your email first and then on everything linked to it, and turn on two-factor authentication. Take screenshots of everything before anything is deleted. Then report to the police and keep the reference number: banks, lenders and telecom operators will ask for it before they reverse anything.
Official sources and links
- Government of Pakistan — official government portal