Tax

The Federal Board of Revenue (FBR) has introduced major changes to protect taxpayer data in the rapidly changing digital tax compliance environment for Pakistan. The FBR new password policy is the cause behind these changes; this requires your FBR password that IRIS portal be changed every 60 days, thereabouts. And it’s not just a cosmetic update; it’s a pro-active measure as cyber threats like phishing and unauthorized access continue to loom. If you are a taxpayer and using IRIS login for return filing, NTN (verification), online payment or similar other, this policy has a direct effect on how you work. 

With each filing season, that policy becomes more important to understand. In this blog, we’ll break the password policy for IRIS login and explore the FBR password change policy, in addition to explaining how to go through FBR login online verification, FBR NTN login, and easy IRIS login. And it really doesn’t matter what type of taxpayer you are: an individual filer, business owner or consultant with a bazillion account; knowing about the changes ahead better enables you to keep up on your tax responsibilities. 

 

What is the FBR New Password Policy? 

The introduction of FBR new password policy was effective since November 2024 and is part of digital security upgradation for IRIS (Income Tax Return Information System) portal in Federal Board Revenue. This is a rule that your IRIS user password or passwords (if you have multiple) to access tax filings; refunds and compliance reminders are all due to a reset every 60 days. For example, if the date on which you changed your password is 1st Jan 2025 and its now 2nd March 2025. It should expire automatically on the next login attempt; you need to update your password compulsorily.  

Why is the 60-day cycle? FBR explains that the move is due to growing cyber threats in Pakistani cyberspace. With a userbase of over 5 million active IRIS users online, the portal holds highly sensitive information i.e. income details, NTN registrations payment histories etc. public expiration on the password reduces the time window for which an attacker can potentially use their password. This is consistent with international best practices and according to the advice of experts in cyber security. But it’s been slightly adapted to take account of Pakistan’s insecurities as tax evasion probes and data leaks there are on the rise. 

 

Why Does Your FBR Password Expire in 60 Days? 

The rationale behind the FBR New Password Policy boils down to enhanced security in an era of sophisticated threats. Here’s why this 60-day expiration is a game-changer: 

Mitigating Breach Risks: 

To a hacker, a static password is like winning the lottery. And if a phishing email can crack an FBR alert, it might be able to provide access forever. A 60-day expiration ensures stolen credentials become stale rather fast, allowing a chance to notice the breach and recover.  

Encouraging Strong Habits: 

Here we use a policy to lean on our users and leverage strong IRIS passwords. FBR must have at least 8 characters including a combination of an uppercase letter, a number, and special character. Consider those noted on the mail or calendar, try something cryptic like “TaxFiler2025! PK” 

Compliance with Digital Pakistan Initiative: 

Like the other government’s taxes and import-export management, FBR is also working to lessen its carbon footprint by converting IRIS into a real-time notification and AI-auditing system. Secure logins are non-negotiable for features like instant FBR login online Verification, where you confirm your tax status via CNIC or NTN in seconds. 

User Feedback Loop: 

Early adopters find that not having to remember email with the reminders ‘SMS, unable to forget my password. It has also stirred up some controversy among accountants handling 100+ client accounts. Clearly, there is a need for efficiency! 

In other words, despite the sense of an extra hassle it may give you, this policy serves to protect your financial data more than it inconveniences you. 

 

Navigating the Password Policy 

The IRIS password policy is simple, but it is necessary to pay attention. Here’s how it dovetails with daily FBR interactions: 

For Salaried: Already, if you log in each year to file return the same logically is also an auto-prompted change at expiry; you do nothing preemptive about. Upgrade via the portal, and you’re good for the year. 

For Businesses and Frequent Users: Use calendar reminders for 60 days from the removing of lock-in letters since monthly withholding tax returns will be filed. That being said, tools like password managers (e.g. LastPass) would have the ability to flag expirations without having to store FBR creds insecurely. 

Effect on FBR NTN Login: When applied is successful, a new applicant receives the first password by email or SMS after completing the form. The initial IRIS password will start that 60-day clock right away, be sure to change it right away for security. 

Pro Tip: Always add working Mobile and email during FBR login Online Verification. This Discussion Allows for 2-Factor Authentication (2FA) with OTP which is one step beyond password policy. 

 

Step-by-Step Guide 

The FBR policy stresses that passwords must be updated easily. Follow these guidelines to remain in compliance: 

Visit the IRIS Portal: Navigate to iris. fbr. gov.pk (or e.fbr. gov.pk for legacy access). 

Start Login: Enter your User ID (CNIC for individuals, NTN for businesses) and current FBR password. If expired, you’ll see a “Password Expired” alert. 

Choose Change/Reset Option: 

• For previous proactive changes: Once successfully logged in, click “Change Password” from the top-right menu. 

• For expired/forgotten: Hover over “system” at the top, and you will see where to click to reset password. 

Verify Identity: Enter your registered email/mobile. FBR SMS a 15-minute life one time password (OTP). 

New Password: Enter IRIS password (must meet the following requirements) Confirm New Password: Repeat new IRIS password. Don’t reuse the old one; FBR blocks this for security.  

Confirm and Log In: And it should give you a message of success! Test your new creds immediately. 

Time estimate: 5-10 minutes. If you encounter problems (such as outdated contact info), call the helpline at 111-772-772 or email helpline@fbr.gov.pk. 

If you are an FBR NTN login first time user: Register with “New Registration” on the portal, enter CNIC/NTN details and receive instant credentials. Just apply the change policy directly then. 

 

Assistance by CBM Consultants: 

CBM Consultants are in a prime position to support their clients who need to comply with the FBR new password policy. We make certain all the IRIS client’s passwords are updated in the period of 60-day expiry, assist them to reset their password securely and direct them for FBR login online verification. We train taxpayers in establishing strong passwords, safeguarding their data, and how to avoid access issues. Our tax experts resolve these technical and compliance issues on behalf of individuals and businesses, to allow their uninterrupted access to their FBR login portal/NTN for timely tax filing and compliance. 

 

Best Practices for Secure FBR Access  

So, here’s what you need to do to play it according to our way: 

• Enable Notifications: Subscribe for expiry alerts 7 days in advance through IRIS settings. 

• Use Unique Passwords: Never use the same ones on different systems, create them using something like Bit warden. 

• Regular Audits: Every quarter, audit your FBR NTN login profile to ensure it is correctly listed. 

• Stay Updated: Follow FBR’s X on (Twitter) or official newsletters for mission changes. Rumors of extending to 90 days are flowing but nothing solid yet. 

 

By embedding these habits, you’ll turn a compliance chore into a security strength. 

 

Conclusion 

The FBR new password policy might be yet another hoop to jump through, but it is an essential safeguard in Pakistan’s digital tax vision. Now you can ask for FBR new password 60 days before having a smooth IRIS login, hassle free FBR NTN login. Online verification and disturbance free NTN login. As FBR drives a completely digital infrastructure, compliance isn’t just something they must do; it’s something that has them poised for success.  

Among the myriad provisions of Pakistan’s tax laws, perhaps one of the more important is Section 138 which deals with enforcement and recovery from noncompliant taxpayers. Under the Income Tax Ordinance, 2001, Section 138 gives legal backing to the tax authorities for recovery of dues through a coordinated mechanism. This article covers Section 138, tax recovery under section 138, and consequences thereupon with due reference to Section 138 of Income Tax Act penalty on dishonor. Whether you are a citizen, taxpayer, employer or a tax consultant, it’s important to have sufficient knowledge about Income Tax Ordinance’s Section 138.  

 

What is Section 138 of the Income Tax Ordinance? 

The provided text outlines the legal provisions for the recovery of tax dues by a commissioner from a taxpayer, as well as related procedures. Here’s a summary:  

Notice of payment (Section 138): The Commissioner has power to serve a notice on a taxpayer in the prescribed form and requiring such person to pay within such time as is specified in the notice mentioning therein and forthwith all moneys outstanding under this Act. 

Recovery Methods: In case the taxpayer could not pay within the specified or extended period, the Commissioner assesses him on the amount and can recover it in any of these ways: 

Attachment and Sale: Attaching of the movable or immovable property (of the taxpayer) followed by its sale. 

Receiver Appointment: Appointment of a receiver to take over and manage the taxpayer’s assets. 

Arrest and Detention: The jailing of the taxpayer for six months. 

Other modes: Additional recovery methods as specified under the Sales Tax Act, 1990. 

Powers of Commissioner: The Commissioner shall have the like powers as are vested in a Civil Court under the Code of Civil Procedure, 1908, for the purpose of enforcing the recovery of any amount due under a decree. 

Rule Making: The Board may promulgate rules governing the procedure for payment and collection of taxes. 

Recovery by District Officer (Revenue) (Section 138A): – 

The Commissioner may also transmit to the District Officer (Revenue) in any district where the taxpayer resides, carries on business or owns property a certificate setting forth the amount of tax due. 

The amount shall be recoverable by the District Officer as if it were arrears of land revenue, with the powers of a Civil Court under the Code of Civil Procedure, 1908. 

Estate in Bankruptcy (Section 138B): 

A taxpayer’s tax debt becomes part of the bankruptcy estate if they become bankrupt. 

The estate’s tax liability is treated as ordinary and necessary business expenses and given priority over the claims of other creditors. 

This structure provides strong tax-recovery measures, such as escalating notices, property actions, and incarceration, and cooperation with revenue departments or bankrupt estates. 

 

The Purpose of Section 138 

The main objective behind this provision is to enable speedy recovery of tax arrears so as to avoid undue delays that will disturb the financial position of the Government. When tax-to-GDP ratios continue to be below targets in these tax systems, measures such as this discourage intentional non-payment and encourage willing compliance. 

The CIR can serve as a notice under Section 138 in a prescribed form requiring payment within a set period often between 15 and 30 days, corresponding to the facts of each case. This notice is a formal wakeup call that taxpayers now have an available opportunity to resolve liabilities before harsh actions follow. The idea is deterrence: by setting the stages of recovery section 138 acts as a spur to do the needful and protects against arbitrary enforcement.  

Secondly, the provision of Section138 is in harmony with above broader fiscal reforms including amendments made by the Finance Act, 2024 on such fiscal reform brought through the Tax Laws (Amendment) Ordinance, 2025 as well. These amendments stress quick recoverability of taxes after assessment, over-riding the interregnum of period consumed in appeal proceedings or court stay in some cases. This development emphasizes FBR’s willingness to modernize tax recovery and makes Section 138 a pivot of modern-day tax recovery by way of Section 138. 

 

How Tax Recovery Works Through Section 138 

Tax recovery through Section 138 is a multi-tiered process, empowering the CIR with civil court-like authority under the Code of Civil Procedure, 1908 (CPC). Here’s a step-by-step breakdown: 

Issuance of Demand Notice: 

CIR serves as a notice under sub section (1) of section 138, addressing the issue of tax amount and time limit. This is the first line of defense, often sent via registered post or email for traceability. 

Non-Payment Outcome: 

If unpaid within the timeframe (or extended period granted by the CIR), sub-section (2) activates recovery modes 

Attachment and Sale of Property: 

The movable/immovable property can be attached and sold; it is in the nature of decree execution under Order 21 CPC. 

Garnishee Proceedings: 

Third party debtors of the taxpayer (e.g. banks) are ordered to pay directly to the FBR. 

Arrest and Detention: 

In extreme cases, the taxpayer can be arrested and detained for up to six months, akin to civil imprisonment for debt recovery.  

Delegation to District Officer (Revenue): 

A supplementary provision under Section 138A of the Act, whereby the CIR may certify dues payable by a person (i.e., as arrears from land revenue) to be collected by the district officer who would attach agricultural land or other district level properties. 

 

The author suggests that Section 138’s recovery process should be based on due process, with coercive means halted during appeals to the Commissioner. After 2025 amendments, taxes can be recovered on High Court or Supreme Court judgment. 

 

Consequences of Defiance: 

Though Section 138 is purely a civil one, its non-compliance can have grave consequences, i.e. Section 138 of Income Tax Act punishment. The term ‘Income Tax Act’ used therein is consistent with the Ordinance and that the `punishment’ is one of recovery and not an independent criminal penalty.  

Civil Penalties:

The most direct “punishment” is asset attachment and sale, which can cripple businesses. For instance, failure to pay can result in bank account freezes or property auctions, leading to financial distress. 

Imprisonment:

Under clause (2)(c), the power is given to detain the person for six months. It is not a criminal prosecution, but a statutory civil relief, for the recalcitrant defaulter. The courts have supported this, even in the one that came before the ATIR emphasizing proportionality. 

Compounding and Interest:

So long as there is an overdue tax, the default surcharge under Section 205 (up to 1.2% per month) compounds the liability. Furthermore, fees for recovery procedures are an additional burden. 

Though, Section 138 of the Income Tax Act penalty is a last resort. Data from the FBR shows that thousands of recovery notices are issued every year, but many are resolved by settling. An FBR notification dated 2023 read, had withdrawn premature notices which were at the stage of appeal, referring to Supreme Court precedents (such as 2018 SCMR 939), demonstrating judicial control in curbing overreach. 

 

Integrating Section 138 into Your Tax Strategy 

To avoid the pitfalls of Section 138, proactive compliance is key. Businesses should: 

• File returns in time and comply with orders of assessments. 

• Apply for extensions or CIR installment plans before notices become enforced. 

• Maintain accurate records to challenge erroneous demands during appeals. 

• Seek advice from tax consultants on maximizing exemptions or reliefs under the Ordinance. 

Recent improvements, such as electronic notices through the FBR Iris portal, have made the task of keeping track much easier. If Section 138 is understood as a compliance tool and not perceived simply as a weapon, taxpayers will be able to fit it comfortably into their fiscal planning. 

 

Conclusion 

Thus, the purpose of Section 138 in IT Ordinance is very simple- to double lock tax recovery under Section 138 to know that the stream resides with Pakistan. From providing demand notices to the prospect of detention, it gives officers an arsenal of enforcement tools that are in line with procedural fairness. Section 138 of the Income Tax Act punishment is a reminder to us that we have no choice on tax, but there are plenty of places to take refuge. 

 

 At the time that Pakistan’s tax-plunged terrains shift toward new horizons, compliance is not just submitting returns. But ensuring what is submitted is precise and real! With the filing deadline for Tax Year 2025 just around the corner on September 30, a new glitch has arisen. As per details, the PBC has reported a ‘flag error in tax credit calculation’ at the FBRs IRIS portal. It has been blocking urgent calls from the business community as well. This red flag raised by the Pakistan Business Council (PBC) demonstrates a broader picture of tax computation issues in Pakistan. It could cause filing delays and inflated liabilities for thousands. You are not the first to wrestle with a deduction of conundrum when it comes to making donations or paid contributions to your pension. Let’s break it down. 

 

What is the IRIS Portal, and Why Does It Matter? 

IRIS, The E-Portal Backbone of Pakistan’s Tax System Federal Board of Revenue (FBR) has introduced its digital backbone for taxpayers, i.e., IRIS. Introduced to simplify e-filing, it enables individual taxpayers, association of persons (AOP) and companies to file income tax return. Also, wealth statements and other documents electronically through a single portal. Debuts for Tax Year 2025 with IRIS 2.0, where new technology would allow us all to file seamlessly with simpler forms and real time verifications. As you learn every day from machines, it is always safe to trust machines but that never happens without more than a few prologue hiccups. 

IRIS handles all salaried tax slabs to complicated deductions and is crucial for over three million working filers. But when it’s not perfect, they percolate through. An ostensibly simple thing turns into a nightmare. This is where the PBC flags math error on FBR’s IRIS Portal falls under legal scan, not only a technical bug. 

 

The Core Issue 

The PBC wrote to FBR Chairman Rashid Mahmood on October 8, 2025, to alert him that a serious flaw has been discovered in processing of tax credits under Sections 61 and 63 of the Income Tax Ordinance, 2001 through IRIS. For the most part, this is due to the way that IRIS calculates credits donations at Section 61 and pension fund contributions of an approved variety in section 63. These sections provide that a taxpayer is entitled to claim credits for payments equal to a percentage of the “total tax assessed” explicitly including the super tax surcharge under section 4C. 

IRIS is completely unwilling to have anything to do with that surcharge when calculating its return. This discrepancy translates into filers receiving less than what is owed under law, due to above-penalty liabilities and delays in filing. The PBC notes that these hits the “highly skilled professionals, generous donors and active investors in voluntary pension funds” hardest of all, including member companies. That is not a minor oversight with the filing deadline ready to slam shut; but a barrier to compliance. 

 

 

Tax Calculation Issues 

The tax calculation mistake in IRIS has been the bane of the system and bodies like the Karachi Tax Bar Association have over the years raised alarm. Filers faced lower rates on contract receipts in 2022 pursuant to section 153 (at 7% versus 7.5%) and wrong taxes levied on gains. It is from immovable property under section 37(1A) along with an erroneous cap on Bahbood Certificate yields under the second schedule. Fast forward to 2025 and some of the same difficulties persist: IRIS does not set aside donation credits against surcharges under section 60 and 4AB, treats some amounts raised as final tax with no entitlement to adjust. 

For everyone from salaried workers to businesses that pay taxes, these are bugs that lead to manual overreactions. One that may be more expensive in filing season. FBR’s response? Most of the time with no extensions even after pleading.  

Unpacking the Reasons for Errors in Tax Calculation 

These are some of the reasons taxes could be wrong, especially where tax is calculated by using a computerized system:

• Software Failures/Coding Errors: The portal algorithm may be making an error in new tax law changes or credit data. 
• Insufficient Synchronized Data: It may be that if the taxpayer’s complete data is not synchronized, credits cannot be computed correctly. 
• Updates of Law & Regulations: Pakistan’s tax laws and finance acts get updated from time to time. IRIS: Absence of regularly up-to-date information on IRIS may lead to obsolete calculations. 
• User Entry Error: Taxpayers can input the data wrong or forget to populate a field, which is then processed through the system incorrectly. 

These are not “bugs” as errors in tax calculation. Instead, they’re the difference between the policy intent and what gets implemented digitally. These days, fewer businesses will be able to rely on that period. “Filers lose immediately without 90-day grace periods after fixes,” as PTBA noted in 2023. 

 

How to Mitigate the Impact: 

Do not let these obstacles get in your way. Just in case you were also wondering, here is how to deal with PBC flags error in tax credit calculation on FBR’s IRIS Portal:

• Double-Check Inputs: Utilize FBR’s official salary tax calculator for a double-check of the form before applying in order to identify any discrepancies. Check the add on charges manually for Section 61/63 claims. 

• Get Professional Help: Hire a tax professional who understands IRIS overrides. KTBA and PTBA members guide you on what to avoid. 

• Document Everything: Ensure to screenshot the errors you are facing and maintain a record of your communications with FBR helpline (051-111-772-772). If delayed, refer to the appeals to the PBC letter. 

• Monitor Changes: We will wait for advance notices from FBR as well as IRIS FAQs and changes for applying patches. The system is still operational, as of October 2025; however, maintaining vigilance is important. 

• Advocate for Change: Support PBC and KTBA petitions demanding systemic changes such as live error alerts and beta testing of updates. 

 

CBM Accounting Playing a Major Role: 

CBM Consultants plays a major role in addressing and rectification of errors, FBR’s IRIS portal regarding tax credit calculations. Our professionals can: 

• Detect and Confirm Mistakes: Companies can reconcile system-generated tax numbers with hand calculations to identify inconsistencies in the calculation of tax credit. 

• Assist in Filing Corrections: We assist filers in completing amended returns or adjustments for the correct amount of taxes due, as well as any credits to which they are entitled.  

• Offer Professional Advice: Our experts understand the provision of the Income Tax Ordinance, 2001. We assist them in interpreting various sections as well as their applications for credits. 

• Liaise with FBR: Qualified accountants can approach the tax department online to inform about a bug and request an amendment. 

• Educate Taxpayers: Clients can learn how to input data into IRIS correctly, which means fewer user errors that lead to tax shortfalls. 

In short, CBM Consultants serve as a bridge between taxpayers and FBR. It ensures accuracy, compliance, and timely resolution of digital tax computation errors. 

 

Conclusion: 

The PBC flags an error in tax credit calculation on FBR’s IRIS Portal is more than a glitch. It reveals systemic issues in tax calculations that Pakistan. Also, it undermines trust in our digital tax system. Reasons for errors in tax calculation; the onus is upon FBR to also focus. Taxpayers should have a portal that facilitates, not hinders, compliance.