Pakistan's NCCIA arrestes 212 Cybercrime Suspects including Chinese nationals

ISLAMABAD, 23 September 2026, Pakistan’s National Cyber Crime Investigation Agency detained 212 people in coordinated raids on three illegal call centres in the capital, officials said, in one of the agency’s largest single-day operations this year against organised online fraud targeting victims abroad.

The Islamabad unit of the NCCIA struck centres in Sectors E-11 and G-10 over a 24-hour period ending Tuesday, a spokesperson said. Those taken into custody included Pakistani and Chinese men and women. A case has been registered and questioning is continuing.

Investigators said the centres were used for international fraud built around Google-related scams and so-called “low-dating” schemes, operations in which operators approach foreign targets online, often through search ads, messaging apps or staged romantic contact, then extract money. Preliminary findings, according to the agency, point to links with networks in India and Brazil.

Officers recovered a large stock of equipment: 306 mobile phones, 383 computers and CPUs, and 299 monitors and laptops. The haul is typical of industrial-scale call-centre fraud, where dozens of operators work in shifts from scripted desks rather than from isolated phones.

The NCCIA framed the raids as part of a wider drive against organised cybercrime run from Pakistani cities but aimed at people in other countries. It has not publicly named the companies, landlords or alleged organisers behind the three Islamabad sites, nor said how much money the network is suspected of moving.

A pattern of call-centre raids

The Islamabad operation follows two other high-profile cases this year.

Last week in Karachi, the agency arrested 27 suspects, including four Afghan nationals, at an alleged international scam call centre. Investigators there said operators posed as authorised staff of financial institutions, used spoofed numbers, and tried to obtain personal and banking details from foreign victims.

In August, NCCIA officers in the capital arrested 114 foreign nationals, 111 Chinese and three Vietnamese, accused of running a cyber-romance and sextortion network from a registered IT business. That group, officials said, drew targets into video chats and explicit calls, then used the material to demand money.

Taken together, the three cases show the same basic model: rented urban premises, mixed local and foreign labour, scripted contact with people overseas, and a rapid turnover of phones and computers. What changes is the pitch, fake investment or search-engine “support,” romance, or a bank or customs official on the line.

What “Google scams” and “low-dating” usually mean

NCCIA did not publish a full modus operandi for the E-11 and G-10 centres. In similar cases across South and Southeast Asia, “Google scams” often involve ads or spoofed pages that look like account-recovery, ads-policy or business-support pages. Victims are talked into sharing codes, installing remote-access tools, or paying supposed penalties.

“Low-dating” is industry slang for a lighter version of romance fraud: operators build a short online relationship, then steer the target toward a fake investment, a customs fee, a medical emergency, or a transfer that is never returned. The August Islamabad case was the heavier variant, explicit video used as leverage.

None of the 212 people detained on Tuesday have been convicted. Custody at this stage is for investigation. The agency has not said how many of those held are suspected organisers, paid callers, technicians, or people who may later be treated as witnesses.

Shifting Scam Operations

A single shift of 70-plus people across three sites, plus nearly 1,000 devices, is larger than most routine cyber raids in Pakistan and closer to the factory-style compounds seen in parts of Southeast Asia. NCCIA was created in May 2024 under the Prevention of Electronic Crimes Act to replace the Federal Investigation Agency’s old cybercrime wing. Since then it has advertised a mix of call-centre raids, account freezes and public-awareness work.

Open source analysis of Telegram Groups showed continuous recruitment in Islamabad, in nearby Sectors for "Chat Support Representatives" Jobs.

Officials have previously said online financial fraud accounts for a large share of the complaints they see. They have also frozen tens of thousands of bank accounts and wallets in earlier campaigns. Those figures are agency-reported and have not been independently audited in this article.

For victims outside Pakistan, the practical path remains the same: report the transfer to the local bank immediately, file with the national cyber portal in their own country, and preserve chat logs and wallet addresses. NCCIA said the Islamabad inquiry will now try to map other members of the network and the flow of proceeds.

Based on official NCCIA statements reported on 22 September 2026.