Report a Cyber Problem in Pakistan: PKCERT or NCCIA, and Which One Takes Your Case

Short answer: Report fraud, blackmail, harassment and fake accounts that target you personally to NCCIA, the National Cyber Crime Investigation Agency. Report attacks on organisations, networks, websites and systems, such as malware, defacement and data breaches, to PKCERT, the National CERT. PKCERT's own incident form says crimes against individuals are not its job. If money moved, call your bank first.

Two Pakistani bodies sound alike and sit in the same part of the government. People send a blackmail complaint to the wrong one, wait a week, and lose time they do not have. A two minute read now saves that.

On 12 October 2026 we opened PKCERT's incident reporting page, its form, its contact details, its Report Malware page and its advisories index. We also tried its link for reporting a phishing address. What we found is below, including what did not work.

PKCERT handles incidents on systems and organisations

PKCERT's form is for cybersecurity incidents affecting organisations, networks, systems or critical infrastructure. Its page names malware infections, website defacements, data breaches, denial of service attacks, unauthorised system access and other suspected cyber attacks.

PKCERT is the Pakistan Computer Emergency Response Team. It analyses threats, coordinates the response and helps affected organisations. It also publishes advisories, such as the one in our check of Chrome synced passkeys on Windows.

Think of it as a fire brigade for networks and systems. It does not investigate a person who is blackmailing you or a scammer who took your money.

NCCIA takes crimes against individuals

PKCERT's page says the form is not meant for cyber crimes against individuals, such as online fraud, financial scams, harassment, blackmail and fake social media accounts. It says these fall under the National Cyber Crime Investigation Agency (NCCIA) and should be reported to NCCIA directly.

That is the clearest official statement we have found on who does what. NCCIA's own websites refused automated requests on 12 October 2026, so we did not read its channels. The steps, the portal and the in person verification are explained in the guide to reporting a cybercrime in Pakistan.

For blackmail with private photos, the specific safety steps are in the page on reporting online blackmail. For a loan app that threatens you, use the page on reporting loan app harassment.

PTA and your bank handle numbers and money

A scam number belongs to a telecom operator and PTA regulates it. We read PTA's helpline 0800-55055 on its website on 12 October 2026. Reporting the number helps get it blocked, and the page on PTA's complaint app with OTP login explains the in app route.

Money is the bank's job first. Banks and wallets can place a hold in the first hours, and they hold the logs. The numbers are in the list of bank helpline numbers, and the State Bank's refund rules are in the page on claiming a digital fraud refund.

The right order for a scam where money left your account is: bank, then PTA for the number, then NCCIA for the crime. Doing them in parallel is fine, but never put the bank last.

What we found on PKCERT's pages on 12 October 2026

PKCERT's incident form had these steps and limits when we opened it. We did not submit anything, because that would send a false report.

• The form asks for the incident type, with options "Individual/Personal Incident" and "Organizational Level Incident".
• It asks for name, phone and email, then when the incident started, whether confidentiality, integrity or availability was affected, and a short description.
• The page also gives an email, cert@pkcert.gov.pk, and PKCERT's UAN is +92 51 1111 62378 in the site footer.
• The Report Malware page said "coming soon".
• The link to report a phishing address, https://pkcert.gov.pk//report-phishing, returned a "Not Found - 404" page for us.

The form lists an individual option, yet the note above it says crimes against individuals belong with NCCIA. We read that as the form being usable for a personal device incident, such as malware on your own PC, but not for fraud or blackmail. That reading is ours, so if in doubt, email PKCERT and ask.

Prepare these five things before you report

Any agency will ask the same few questions. A short note you wrote before you call saves time and keeps your story consistent.

1. Write down what happened, with dates and times in order.
2. Save screenshots, numbers, links, transaction IDs and chat exports.
3. Note the amount lost and the bank or wallet account it left from.
4. Keep your CNIC and phone number ready.
5. Do not delete the messages, even if they are upsetting.

Common questions

Is PKCERT the same as NCCIA?

No. PKCERT is the National CERT and handles incidents on systems and organisations. NCCIA investigates cyber crimes, including crimes against individuals.

Where do I report online blackmail in Pakistan?

To NCCIA. PKCERT's own incident form says blackmail, fraud and harassment against individuals fall under NCCIA.

Can I report a phishing website to PKCERT?

PKCERT lists a Report a Phishing URL option. On 12 October 2026 the link we tried returned a 404 page, so email cert@pkcert.gov.pk if it still fails.

Does PKCERT help individuals at all?

It publishes advice and advisories for the public, and its form has an option for individual or personal incidents. Fraud and harassment are not its role.

Who should I tell first if money is gone?

Your bank or wallet, immediately. They can hold or trace a transfer faster than any agency. Then report the number to PTA and the crime to NCCIA.

How we verified this

What we checked, where we read it, and what we could not confirm.

Last checked on 12 October 2026, Pakistan time. We read PKCERT's incident reporting page and form and its advisories index. PTA's helpline came from the footer of PTA's website. NCCIA's websites refused automated requests, so we did not read its channels or helpline. Pages and links can change, so check each one before you rely on it.