Why deepfakes create difficult legal questions
A synthetic voice can sound like a company's chief executive. A generated photograph may be inserted into a false profile, while a manipulated video can be circulated as supposed evidence of conduct that never occurred. Victims often ask whether the technology itself is criminal. The better question is what the accused is alleged to have done, with what knowledge or intention, and whether the facts meet the ingredients of an existing offence. Pakistani cybercrime law does not treat every AI-generated image as automatically unlawful. The possibility of manipulation also makes source verification and attribution indispensable.
Which authority investigates an AI-related cybercrime?
The National Cyber Crime Investigation Agency is the specialist federal investigation agency established under section 29 of the Prevention of Electronic Crimes Act, 2016, following the 2025 amendment. Its remit covers offences specified in that Act. It should not be confused with the Pakistan Digital Authority, whose role under the Digital Nation Pakistan Act, 2025, concerns digital and emerging-technology governance. Calling something an AI incident does not automatically give NCCIA jurisdiction. The allegation must be matched to a PECA offence, while civil remedies and other criminal laws may operate separately depending on the conduct.
Voice cloning and the fraudulent payment instruction
Imagine an accounts manager receiving a convincing voice note instructing payment to a new supplier account. The message appears to come from a director but was produced using a voice-cloning service. If dishonesty and deception are supported by the evidence, electronic fraud under section 14 and possibly electronic forgery under section 13 may be relevant. The inquiry must establish the apparent sender, origin, circumstances of creation, transfer details and the accused person's connection to the conduct. A familiar voice is not proof of authority. Businesses should independently verify payment-account changes through a pre-registered number and retain transaction approvals.
Impersonation, spoofing and stolen identity information
A fake social-media profile may use an AI portrait to represent itself as a bank officer, doctor, lawyer or company representative. Depending on the acts, sections 16 and 26 of PECA concerning identity information and spoofing may be relevant. A profile used to solicit money might also engage fraud provisions. However, a pseudonym or parody account does not automatically establish every offence. Evidence should include the exact URL and account handle, the representations made, conversations with recipients and any independent records linking the account to a person. The identity shown on the page cannot substitute for evidence of its operator.
Image abuse, dignity and sexually explicit deepfakes
False or manipulated images used to harm a person's reputation may call for examination of section 20 of PECA, but the specific statutory requirements must be established. Section 21 separately concerns specified offences against modesty and can become especially relevant where a person's image is superimposed or manipulated in sexually explicit material. The distinction matters because conduct, mental elements and applicable procedures differ. A victim should seek safe evidence preservation and prompt reporting without repeatedly forwarding harmful images. Where children are affected, specialised child-protection offences and safeguarding measures require immediate consideration, with minimal further circulation of material.
Section 26A and synthetic misinformation
The Prevention of Electronic Crimes (Amendment) Act, 2025, added section 26A dealing with intentional dissemination or transmission of false or fake information, where the person knows or has reason to believe it is false or fake and it is likely to create the specified public fear, panic, disorder or unrest. An AI-generated emergency announcement may present one sort of factual inquiry; an obvious parody or an accidental error presents another. Synthetic origin is not alone proof of intention or public consequences. Investigators must examine the particular wording, publisher's knowledge, context, audience and likely effects, while respecting constitutional safeguards on expression.
How a victim should preserve a deepfake
The initial task is preservation, not public argument. Save the original file as received, retain its name and available metadata, record the page address and handle where it appeared, and note when and by whom it was accessed. If possible retain original messages rather than only cropped screenshots. Do not modify the source file or erase the communication thread. A written chronology should distinguish observations from assumptions about authorship. In cases involving intimate imagery, storage and disclosure should be restricted to persons who need the material for protective or legal action. A complaint should identify the offence without making unsupported attribution claims.
The limits of AI detectors
Automated tools can estimate whether an image, audio clip or video exhibits characteristics associated with synthetic creation, but no single detector score should be equated with a judicial finding. Accuracy may vary with compression, language, lighting, platform processing and later alterations. False positives are particularly serious when reputations or criminal proceedings are at stake. A forensic assessment may need to consider original files, editing history, metadata, encoding, authentic comparison recordings, device access and corroborating testimony. Expert conclusions should explain their methodology, confidence and limitations rather than claiming absolute certainty from an opaque model.
Authenticity, chain of custody and authorship
A court may face several independent propositions: that a recording is altered, that it was transmitted, that a particular account transmitted it and that the accused knowingly created or circulated it. Proving one does not necessarily prove the others. Chain-of-custody records, integrity hashes, acquisition notes, communications history and contextual evidence assist the court in evaluating electronic material. The Qanun-e-Shahadat Order, 1984, and Electronic Transactions Ordinance, 2002, are relevant to the evidentiary framework. Defence counsel may legitimately challenge attribution or integrity, while prosecutors should avoid treating a visible username as conclusive evidence of the true human actor.
Banking, employment and corporate consequences
A deepfake may trigger a fraudulent transfer, a false employment accusation, a disrupted procurement process or a market-moving rumour. The organisation should quickly distinguish operational containment from the later legal determination of responsibility. Freeze or recall payments using verified bank procedures, secure approval records, preserve system logs and inform the appropriate internal risk and legal officers. Sector-specific notification duties, insurance requirements, employment processes and contractual notice clauses may also apply. A criminal complaint is not a substitute for recovery, preservation or an injunction where other remedies are required. The company should document the basis for every external allegation.
Legal routes for victims and accused persons
NCCIA's official complaint portal and reporting centres provide channels for suspected PECA offences. Platform reporting may help remove abusive content, while civil injunctions or claims can be considered when an independent cause of action exists. Removal from a platform does not constitute a criminal conviction. An accused person should obtain the particulars of the allegation, preserve relevant data and assess procedural remedies through counsel. The principles of due process and fair trial remain applicable even when a file looks convincing or a social-media accusation spreads rapidly. A safe response avoids harassment, retaliation and evidence destruction.
What readers and companies should remember
Treat high-impact voice or video instructions as requiring independent verification. Preserve original digital material and contextual records, not only screenshots. Do not assume that every synthetic creation is a PECA offence, or that a detector proves identity. Distinguish content-removal requests from criminal investigation, and the NCCIA mandate from wider digital governance. For a full account of NCCIA powers, read the NCCIA and cybercrime guide; for the wider regulatory framework consult the legal guide to artificial intelligence.
Official legal materials
The 2025 PECA Amendment Act, NCCIA complaint instructions and NCCIA's legal materials provide primary starting points. The Constitution, Qanun-e-Shahadat Order and the relevant statutory offence must also be considered. This publication provides general information rather than advice on a particular criminal complaint.
General information only. No advice is given on any particular matter.