Pakistan’s IT Industry Warns NCCIA Raids Are Hitting Legitimate Software Firms, Not Just Scam Centres

Pakistan’s IT industry has warned that a cybercrime crackdown meant to shut down scam call centres is now sweeping up legitimate software companies — and it says the raids are putting the country’s fastest-growing export industry at risk.

The Pakistan Software Houses Association for IT and ITES, known as P@SHA, said in a statement on Monday that teams from the National Cyber Crime Investigation Agency (NCCIA) have raided legitimate software and IT-enabled services companies as part of the agency’s ongoing crackdown on fraud operations. The association urged the agency to draw a clear line between real IT firms and scam centres, warning that the way the raids are being carried out could cost Pakistan foreign clients, jobs and export earnings.

The warning matters because Pakistan’s IT sector is one of the few bright spots in the economy. It is growing at around 20 per cent a year, and its exports hit a record $4.6 billion in the last financial year. The government wants that figure to reach $10 billion by 2029. P@SHA says heavy-handed raids threaten that target — not because the industry opposes action against fraud, but because legitimate businesses are being treated as suspects first and asked questions later.

What P@SHA is saying

P@SHA’s message is not that the crackdown should stop. The association says it fully supports every lawful, evidence-based operation against scam centres, and it agrees that fraud operations damage Pakistan’s reputation and hurt legitimate exporters. Its complaint is about how the raids are being done.

In its statement, P@SHA said it considers call centres to be legitimate businesses and does not class scam operations as call centres at all. That distinction is the heart of the dispute: the association says enforcement teams are treating any office with rows of computers and a night shift as a possible scam centre, when many of those offices are doing genuine work for clients overseas.

“Every single dollar is earned on trust,” said P@SHA Chairman Dr Shoaib Ahmed Khan. “A foreign client who hears that his vendor’s office was raided and its servers taken away does not wait for the forensic report.”

He added a sharper warning: “Fraudsters may lose a call centre, but Pakistan loses an entire market.” In other words, a scam operator can set up again somewhere else, but a country that gains a reputation for raiding its own IT firms can lose clients for good.

P@SHA also pointed out that the NCCIA itself has said some fraud operators register their businesses as IT companies. The association says that is exactly why enforcement must tell the two apart with care, rather than treating every registered IT firm as a suspect.

What companies say happened during the raids

According to complaints P@SHA has received from member companies, NCCIA teams entered offices without showing a warrant, held and questioned employees for hours, and took laptops, servers and mobile phones into custody — even in cases where investigators found nothing unlawful.

The association says such actions halt work for clients, put confidential foreign client data at risk, and create fear among employees and investors. When a server is seized, a company cannot deliver work to its clients. When client data is taken away, the company may be in breach of the confidentiality agreements it signed with those clients. And when staff are questioned for hours, the message to the workforce is that their employer could be raided at any time.

Dr Khan stressed that the IT industry is not a handful of companies — it is an entire ecosystem. Pakistan produces more than 70,000 computing graduates every year, families invest their savings in their children’s education, and universities and the Higher Education Commission build programmes around what the industry needs. The Ministry of IT and Telecom, the Pakistan Software Export Board (PSEB), Ignite, the State Bank of Pakistan and the Higher Education Commission are all working towards the government’s export targets.

“Indiscriminate raids undo that collective effort and push skilled young people to leave the country,” Dr Khan said.

Why this matters for Pakistan’s IT exports

To understand why P@SHA is speaking out so strongly, it helps to look at the numbers. IT is the only industry in Pakistan’s economy growing consistently at around 20 per cent every year, according to the association. IT exports reached a record $4.6 billion in the financial year 2025-26, known as FY26, up from $3.8 billion the year before.

The government has set an ICT export target of $10 billion by FY29 under its Uraan Pakistan economic plan. That would more than double exports in three years — an ambitious goal that depends on foreign clients trusting Pakistani companies with their work and their data.

Trust is the key word here. Most Pakistani IT companies sell services, not physical products. A client in the United States, Britain or the Gulf hires a Pakistani software house to build an app, manage a database or answer customer calls. The client never visits the office. It chooses the company on reputation, and it can move the work to India, the Philippines or Eastern Europe at short notice if that trust is shaken.

That is why P@SHA is worried about the knock-on effects of a raid even when no crime is found. A client that hears its vendor’s office was raided and its servers seized may not wait to find out whether anything was wrong. It may simply move the contract elsewhere. And when one company loses a client, the damage spreads: the whole country’s IT sector gets a reputation for risk.

There is also a domestic cost. Raids that seize equipment and question staff create uncertainty for businesses and for the young graduates the industry employs. If skilled workers feel their employers are not safe from sudden enforcement action, more of them may look for work abroad — the brain drain Pakistan can least afford in its most promising sector.

What P@SHA wants the NCCIA to do

P@SHA has set out a list of practical demands, and it has asked for an urgent joint meeting with the Minister for IT and Telecom, the Interior Ministry and the Director General of the NCCIA. Its main proposals are:

• Court warrants and agreed procedures. Every search of a registered IT company should be carried out under a court-issued warrant, presented to the company at the start of the operation, in line with the Prevention of Electronic Crimes Act (PECA) 2016 and the Code of Criminal Procedure. Employees should be treated respectfully, particularly women.
• Check before you raid. Before taking action against a registered company, the NCCIA should verify the company’s status with the PSEB and P@SHA through designated focal persons who are available around the clock. A company that is registered, paying taxes and exporting services should not be raided on the same basis as an unregistered operation.
• A joint coordination and grievance committee. P@SHA has proposed a permanent committee made up of the NCCIA, the Ministry of IT and Telecom, the PSEB and P@SHA. It would review complaints, share intelligence about scam operators and agree on standard procedures for raids on registered IT firms.
• Copy data on site instead of seizing hardware. The association wants investigators to make forensic copies of data at the office rather than taking laptops and servers away, and to return any unrelated devices within seven days.
• No media trials. P@SHA has asked the NCCIA not to subject IT companies to media trials — publicising a raid before any wrongdoing has been established — because the reputational damage is done even if the company is later cleared.

The other side: why the NCCIA is raiding call centres

The NCCIA’s crackdown did not come out of nowhere. Scam call centres — operations that trick people in Pakistan and abroad out of money through fake tech support, fake investments and other frauds — have become a serious problem. They damage Pakistan’s reputation, and the NCCIA has been under pressure to shut them down.

The difficulty, which even the NCCIA has acknowledged, is that some fraud operators register their businesses as IT companies. On paper, a scam centre can look like a legitimate software house: it has an office, computers, staff and a company registration. That is why the agency says it has to act against registered companies too.

P@SHA does not dispute that. Its argument is that registration with the PSEB or membership of P@SHA is a check the agency can do in minutes, before sending a team through the door. The association says a quick verification call would separate genuine exporters from fraud operations — and would let the NCCIA focus its resources on the real criminals.

The NCCIA had not responded to P@SHA’s statement at the time the story was reported.

This is not the first time

The dispute has a history. In 2021, P@SHA condemned raids by the Federal Investigation Agency on IT companies in Karachi and asked for a transparent investigation. The pattern is familiar: an enforcement drive against fraud catches legitimate companies in its net, the industry complains, and procedures are promised but not always followed.

What is different this time is the scale of what is at stake. In 2021, IT exports were a fraction of today’s $4.6 billion. The industry is bigger now, its clients are more valuable, and the government’s $10 billion target means the cost of getting enforcement wrong is higher than ever.

What happens next

The immediate question is whether the NCCIA and the government accept P@SHA’s proposals. The association has asked for an urgent meeting with the IT minister, the Interior Ministry and the NCCIA’s director general, and it has proposed a permanent joint committee to handle complaints and agree procedures.

If that meeting happens and the committee is set up, it could give the crackdown a clearer set of rules: warrants, verification before raids, and data copied on site instead of hardware seized. That would let the NCCIA keep going after scam centres while giving legitimate companies the protection they need to keep their clients.

If it does not happen, the risk is that the raids continue as they are, and that more companies — and more foreign clients — decide Pakistan’s IT sector is not worth the uncertainty. For an industry that earns its money on trust, that would be a costly outcome.

For now, the ball is in the government’s court. P@SHA has made its case in public, with specific demands and a specific meeting request. The response will show whether Pakistan’s fastest-growing export industry gets the protection it says it needs — or whether the crackdown on fraud ends up hurting the very businesses that are bringing money into the country.

Frequently asked questions

What is P@SHA?

P@SHA is the Pakistan Software Houses Association for IT and ITES. It is the main industry body for Pakistan’s software and IT-enabled services companies, and it represents the firms that export IT services to clients around the world.

What is the NCCIA?

The National Cyber Crime Investigation Agency is Pakistan’s federal agency for investigating cybercrime. It took over cybercrime enforcement from the Federal Investigation Agency and is responsible for acting against online fraud, including scam call centres.

Are the raids on scam centres wrong?

P@SHA says no. The association says it fully supports lawful, evidence-based operations against scam centres. Its complaint is that legitimate, registered IT companies are being raided without warrants and without checks, even when nothing unlawful is found.

How big is Pakistan’s IT industry?

IT exports reached a record $4.6 billion in the financial year 2025-26, up from $3.8 billion the year before, according to P@SHA. The sector is growing at around 20 per cent a year, and the government has set a target of $10 billion in ICT exports by the financial year 2028-29 under its Uraan Pakistan plan.

What does P@SHA want?

It wants raids on registered IT companies to be carried out under court warrants and agreed procedures, with the company’s status verified with the PSEB and P@SHA before any raid. It also wants a permanent joint committee of the NCCIA, the IT ministry, the PSEB and P@SHA to review complaints and share intelligence on scam operators, and it wants data copied on site instead of hardware being seized.

Has the NCCIA responded?

At the time the story was reported, the NCCIA had not responded to P@SHA’s statement.

Sources

• Dawn, “P@SHA raises concern over raids”, 10 November 2026: https://www.dawn.com/news/2043368/p-at-sha-raises-concern-over-raids
• Business Recorder, “P@SHA raises concern over NCCIA raids on registered IT, software firms”: https://www.brecorder.com/news/40448209
• ProPakistani, “P@SHA Tells NCCIA to Stop Confusing Legitimate IT Companies With Scam Centers”, 9 November 2026: https://propakistani.pk/2026/11/09/psha-tells-nccia-to-stop-confusing-legitimate-it-companies-with-scam-centers/
• Profit (Pakistan Today), “P@SHA raises concerns over NCCIA raids on registered IT, software firms”, 10 November 2026: https://profit.pakistantoday.com.pk/2026/11/10/psha-raises-concerns-over-nccia-raids-on-registered-it-software-firms
• TechProlonged, “IT industry body says NCCIA raids are hitting legitimate firms”, 2026: https://techprolonged.com/2026/11/it-industry-body-says-nccia-raids-are-hitting-legitimate-firms/

This article is for general information and education only. It is not legal or financial advice.