The Federal Tax Ombudsman (FTO) has taken a strong stance against growing cyber fraud in Pakistan’s sales tax system, instructing the Federal Board of Revenue (FBR) to move quickly against those involved in digital tax manipulation. This directive, issued by Ombudsman Zafar-ul-Haq Hijazi, is his first official order and highlights serious concerns about weaknesses in tax administration systems.
The order calls for strict legal action against individuals and groups responsible for submitting fraudulent sales tax returns using fake and flying invoices. These activities involve illegally accessing taxpayers’ login credentials and using them to report false supplies, often without the knowledge of the affected businesses. The Ombudsman noted that those responsible may be operating both within government institutions and outside them, including networks linked to Pakistan Revenue Automation Limited (PRAL).
Repeated incidents of hacked taxpayer IDs and passwords were described as alarming, raising questions about the reliability, security, and oversight of the tax authority’s digital infrastructure. According to the FTO, these breaches point to deeper problems such as weak internal controls, poor data protection, and insufficient checks to prevent unauthorized system access.
The Ombudsman also highlighted the lack of effective system monitoring. He observed that current systems do not generate timely alerts for suspicious behavior, data manipulation, or unauthorized changes to taxpayer profiles—gaps that allow fraudulent transactions to be created and sustained.
In a specific case examined by the FTO, a taxpayer’s credentials were misused regularly between July 2024 and June 2025 to submit falsified sales tax returns. Fake supplies were added through Annexure C each month, resulting in continuous difficulties for the taxpayer when attempting to file legitimate returns. These failures were declared instances of maladministration.
To ensure enforcement, the FBR has been directed to inform and involve Chief Commissioners of Inland Revenue across several regions, including Lahore, Islamabad, Karachi, Multan, Faisalabad, Peshawar, Quetta, Rawalpindi, and Sahiwal, along with major Large and Corporate Tax Offices.
The Ombudsman further ordered the FBR to begin prosecution proceedings against fraud beneficiaries already identified by the Ombudsman’s office in earlier communications during October and November 2025. These cases must be handled in accordance with procedures outlined in Sales Tax General Order No. 12 of 2023, which deals specifically with fake and flying invoice fraud.
Beyond the already identified cases, the FBR has also been instructed to trace additional beneficiaries further along the supply chain and immediately share their details with the relevant tax authorities for legal action.
The Director General of Intelligence and Investigation (I&I) has been assigned the task of tracking the cybercriminals by analyzing IP addresses used to introduce fake supplies into the system. Those found responsible—whether government-linked or external—are to be prosecuted under applicable laws.
Lastly, the FTO instructed the CEO of PRAL to resolve a technical issue involving a disputed system link in a registration form. If direct removal is not possible, the local registration office must be given the authority to make the necessary correction.
This directive underscores the urgency of strengthening cybersecurity, improving oversight, and protecting honest taxpayers from organized digital fraud within the sales tax framework.