We Tested Every Electricity Company's Website. Two Are Not Secure.

We opened the website of every electricity distribution company in Pakistan, one after another, and wrote down what came back.

Seven worked. Two failed their security certificate. One would not load at all. And the address widely circulated for a fourth does not exist.

What came back

We did not stop at the first failure. Each one was retried over plain http, without the www prefix, and on alternate domains before we concluded anything.

FESCO and QESCO: the site exists, the security does not

Both failed on the secure address and both loaded fine over plain http. That means the websites are running, but their security certificates do not validate.

In a browser, that is the page that says "Not secure", or throws a full warning screen you have to click past.

To be clear about what this is not: it is not evidence that either company has been hacked, and we are not suggesting that. An expired or misconfigured certificate is an administrative failure, not an attack.

The harm is subtler and worse. An official site that trains you to click past a security warning makes you easier to defraud later. A fake billing page produces exactly the same warning, and someone who has learned that warnings on government sites are normal will click through that one too, then type in a card number.

So we are not telling you to bypass the warning. We are telling you to use a different address.

HESCO would not load

HESCO returned server unavailable on the secure address, on plain http, and on the bare domain without www. Three attempts, three failures.

That is different from a site blocking us. A blocked request is refused; this one reported the server as unavailable. It was genuinely down when we checked, which does not mean it is down now.

TESCO's address is wrong everywhere

Search for the Tribal Electric Supply Company and you will be given tesco.com.pk. That domain does not resolve.

The working one is tesco.gov.pk. This is the same pattern we found with the Punjab vehicle portal, where a widely repeated address had simply stopped being the real one, and nobody updated the guides.

The address that worked throughout

There is a central bill portal, bill.pitc.com.pk, and it returned a normal response every time we tried it, including while individual company sites were failing.

1. Try the central bill site if your company's own page is broken.
2. Try plain http, which brought up both FESCO and QESCO.
3. Check .gov.pk against .com.pk, which is what TESCO turns on.
4. Never enter card details on a page showing a security warning, whoever it claims to be.

How to check a bill without any of them

If you are here because a bill needs checking today, the site is only one route and not always the fastest.

The reference number is the key to everything. It is printed on any previous bill, it does not change, and every route asks for it. Photograph one bill and keep it in your phone, and you never need to hunt for it again.

With that number you can use the central portal, your own company's site if it is working, or a banking app. Most Pakistani banking and wallet apps let you pull the bill and pay it in the same step, which sidesteps a broken utility website entirely and gives you a payment record the utility cannot dispute.

What none of these routes do is tell you whether the bill is correct. A reference number retrieves what the company says you owe. Checking whether the units billed match your meter is a separate job, and it is the one that actually catches errors.

Why we bothered

Every guide to checking a Pakistani electricity bill, including ours, hands you a list of company websites. None of them appear to have checked whether the sites actually work.

Nearly half of these had a problem on the day we looked. Two of them ask people to enter a reference number over a connection a browser flags as unsafe. That is worth knowing before you follow a list.

We have updated our own guide accordingly, and the working routes are in checking your electricity bill online.

This is the second time this exercise has produced something. The first, across about forty government domains, is in what we found testing Pakistan's government websites.

What this is not

A snapshot from one machine on one day, by automated request. It is not an uptime audit, and a site that failed for us may work for you.

What it does establish is that the certificate failures at FESCO and QESCO are configuration problems that have persisted long enough to be normal, and that at least one commonly published address is simply wrong.

Questions readers are asking

Why does FESCO's website say not secure?

Its security certificate does not validate on the secure address. The site loads over plain http. Use the central bill portal rather than clicking past a warning.

Is it safe to enter my details on those sites?

Do not enter card details on any page showing a security warning. A bill reference number is less sensitive, but the central portal is the better route.

Why won't the HESCO website open?

It returned server unavailable on every address we tried on 10 August 2026. That is a server problem at their end rather than anything you can fix.

What is TESCO's real website?

tesco.gov.pk. The commonly circulated tesco.com.pk does not resolve.

Is there one site for all electricity bills?

bill.pitc.com.pk is the central bill portal and it responded normally throughout our testing, including when individual company sites did not.

Does a failed certificate mean the company was hacked?

No. It usually means an expired or misconfigured certificate. The risk is that it teaches people to ignore browser warnings, which is what makes fake billing pages effective.