The Federal Tax Ombudsman (FTO), Zafar-ul-Haq Hijazi, has issued his first order directing the Federal Board of Revenue (FBR) to take immediate and decisive action against cybercriminals involved in fraudulent sales tax filings through fake and flying invoices, whether operating within or outside the FBR and Pakistan Revenue Automation Limited (PRAL).
In his order issued on Wednesday, the FTO instructed the FBR to proceed strictly against those responsible for hacking taxpayers’ IDs and filing fake or revised sales tax returns to show bogus supplies. He noted that repeated breaches of taxpayer passwords raise serious concerns about the security, integrity, and sanctity of the tax administration’s IT systems.
The order highlighted critical weaknesses in the existing systems, including poor data integrity, inadequate data security, weak internal controls, and insufficient safeguards against tax fraud. It further pointed out the absence of effective system alerts for unusual activity, manipulation of data, and unauthorized changes to taxpayer profiles, which enable the creation of fake transactions.
According to the FTO, the illegal misuse of the complainant’s password ID and the fraudulent filing of sales tax returns and revised returns for the tax periods from July 2024 to June 2025—repeated on a monthly basis by introducing fake supplies through Annexure C—constitute maladministration. These actions resulted in persistent complications in filing sales tax returns for subsequent tax periods.
The FTO directed the FBR to issue instructions to Chief Commissioners Inland Revenue of RTO Multan, Peshawar, Quetta, Faisalabad, Lahore, Rawalpindi, Sahiwal, RTO-I Karachi, RTO-II Karachi, CTO Islamabad and Lahore, and LTO Lahore and Islamabad to ensure compliance with the order.
The FBR has also been instructed to initiate legal proceedings for conviction against the beneficiaries of tax fraud already identified and communicated by the Ombudsman’s office through letters dated October 29, 2025, and November 19, 2025. These actions are to be taken in line with the Board’s instructions issued on September 7, 2023, under Sales Tax General Order No. 12 of 2023, which outlines standard operating procedures for cases involving fake and flying invoices.
Furthermore, the FTO ordered the FBR to trace other beneficiaries further down the supply chain and immediately share details of such cases with the relevant jurisdictions for legal action, as per the Board’s instructions, to be implemented by the respective Commissioners.
The Director General of Intelligence and Investigation (I&I) has been tasked with identifying the cybercriminals, whether inside or outside the FBR or PRAL, who used specific IP addresses to introduce fake supplies into the supply chain, and to proceed with their prosecution under the law.
Additionally, the FTO directed the Chief Executive Officer of PRAL to remove a link incorporated in the 181–181 registration form under the name Muhammad Sohail Ajmal, or alternatively to enable the Local Registration Office at RTO Bahawalpur to remove the link, as they are currently unable to do so at their end.
