Selling a SIM Without Verification or Changing a Phone IMEI Is a Crime in Pakistan: Up to 3 Years Under PECA

Short answer: Under Pakistan's Prevention of Electronic Crimes Act (PECA), 2016, selling a SIM without verifying the buyer is a crime, with up to three years in prison or a fine of up to Rs 500,000, or both. Changing or re-programming a phone's IMEI and then using or selling it carries up to three years or Rs 1 million.

These two rules sit right next to each other in the Act. Section 17 is about SIM sellers. Section 18 is about the unique number inside every phone. Both exist to stop untraceable SIMs and cloned phones, which are tools of fraud, extortion and phone theft.

We read the Act and its 2023 and 2025 amendments on PTA's website on 13 October 2026. The PDF is a scan, and we read sections 16 to 18 and 43 closely. This is general information, not legal advice. If you are accused of an offence, speak to a lawyer.

Section 17 punishes selling a SIM without checking the buyer

Section 17 covers anyone who sells or gives a SIM card, re-usable identification module, or UICC without first obtaining and verifying the subscriber's antecedents, in the way PTA approves. The punishment is up to three years, or a fine up to Rs 500,000, or both.

The section also names the eSIM-era items: a "universal integrated circuit card" or any module that authenticates a user to the network, for phones and tablets. A 2025 amendment replaced the word "Authority" with "Pakistan Telecommunication Authority" in this section, so PTA is the body whose approved method counts.

In practice, the approved way is the biometric check at a franchise or service centre. Our page on PTA's SIM biometric verification explains it, and the guide to new SIM card rules lists the current limits.

Section 18 punishes changing a phone's unique identifier

Section 18 covers anyone who, without authority, changes, alters, tampers with or re-programs the unique device identifier of any communication equipment, including a cellular or wireless handset, and then starts using or marketing the device. The punishment is up to three years, or a fine up to Rs 1 million, or both.

The Act explains that a unique device identifier is an electronic identifier that is unique to a communication device. For a phone, that is the IMEI. Changing it hides a stolen or blocked phone, or lets one phone pose as another.

All amounts are the "may extend to" maximums written in the Act. A court decides the actual sentence.

Know how these offences are handled in court

Section 43 says most PECA offences are non-cognizable, bailable and compoundable, which means police cannot arrest without a warrant and an accused can settle. It makes an exception for Section 17: that offence is cognizable by the investigation agency on a written complaint by the Authority.

The investigation agency is now the National Cyber Crime Investigation Agency (NCCIA), set up by the 2025 amendment of Section 29. Section 18 is not in the list of serious offences that are non-bailable, so it falls under the general rule. We did not check how courts have treated either section.

If NCCIA takes your phone in any case, know your rights. Our page on what to do if NCCIA takes your phone sets them out.

Protect yourself as a buyer or phone user

The risk to ordinary people is not only from sellers. A SIM issued on your CNIC without you can be used for fraud, and a phone with a changed IMEI can get blocked. The steps below keep you safe.

1. Buy SIMs only from a franchise or service centre where your own thumb is scanned.
2. Never give your CNIC copy for a "free" SIM. Section 16 also punishes selling or using identity information without permission.
3. Check which SIMs are registered on your CNIC using the PTA check, and report any you do not know with the steps in how to report an unknown SIM.
4. Check a phone's IMEI before you buy, as shown in how to check an IMEI number.
5. Walk away from any seller who offers to "fix" a blocked phone by changing its IMEI.

If your phone was blocked because of a cloned or duplicate IMEI that you did not change, follow the guide to fixing a duplicate or cloned IMEI.

Section 16 adds a remedy for people whose identity is misused

Section 16(2) says a person whose identity information is obtained, sold, possessed, used or sent can apply to the Authority for it to be secured, destroyed, blocked or stopped from transmission. The Authority can take the measures it thinks right.

The 2025 amendment defines the Authority in PECA as the Social Media Protection and Regulatory Authority. We could not confirm from PTA's site how a person applies under Section 16(2) today, so we do not give a form or a link for it.

Common questions

What is the punishment for selling a SIM without verification in Pakistan?

Section 17 of PECA allows up to three years in prison, or a fine up to Rs 500,000, or both. The seller must verify the subscriber's antecedents in the way PTA approves.

Is changing a phone's IMEI illegal?

Yes. Section 18 punishes unauthorised changing or re-programming of a device's unique identifier and then using or marketing it, with up to three years or a fine up to Rs 1 million.

Can I be punished if I only bought a phone with a changed IMEI?

Section 18 covers the person who changes the identifier and starts using or marketing the device. We did not verify how courts treat an innocent buyer, so avoid such phones and check the IMEI first.

Who investigates these offences?

The National Cyber Crime Investigation Agency (NCCIA) is the investigation agency under PECA after the 2025 amendment. We did not read NCCIA's complaint channels, which refused our request.

Does this law cover eSIM?

Section 17 names SIM cards, re-usable identification modules and UICCs, and any module that authenticates a user to the network. We did not check how PTA applies it to eSIM profiles.

What if someone used my CNIC to get a SIM?

Check your SIMs on your CNIC, report the ones you do not know, and block them. Section 16 also punishes using another person's identity information without permission.

How we verified this

What we checked, where we read it, and what we could not confirm.

Last checked on 13 October 2026, Pakistan time. We read the Prevention of Electronic Crimes Act, 2016 (sections 15 to 18 and 43) and the 2025 amendment on PTA's website. The 2016 file is a scan, so figures were read from a text copy and should be checked against the original gazette before use in a legal matter. We did not read NCCIA's complaint pages or any court judgment.