KTBA demands FBR relax password policy

KARACHI: The Karachi Tax Bar Association (KTBA) has urged the Federal Board of Revenue (FBR) to revise its password protection policy, which mandates taxpayers to change their passwords every 60 days -- a requirement that must be followed six times a year. The policy restricts access to tax accounts unless passwords are reset using the ‘Forgot Password’ or ‘Change Password’ options.

In a letter to the FBR, the KTBA acknowledged the importance of strengthening taxpayer security but criticised the excessive frequency of password changes. Per the KTBA, the impractical nature of the security measure is likely to result in non-compliance, particularly in light of the increasing obligations placed on taxpayers and their representatives..

The association pointed out that the policy was introduced in response to recent sales tax fraud cases involving the misuse of passwords from inactive or nil-filing accounts, leading to fraudulent sales tax invoices. However, the KTBA argued that rather than imposing a blanket password change requirement on all 5.8 million taxpayers, the FBR should focus on preventing the misuse of sales tax registration numbers (STRNs) through targeted security measures.

“If this rigid password policy remains in place for all taxpayers -- whether salaried individuals or businesses -- it will likely lead to higher non-compliance and system inefficiencies,” the letter added. The KTBA noted that banks also implement password security measures, but none require customers to change their passwords every two months.

The association also highlighted the differences in tax filing frequencies, stating that income tax returns are filed annually, withholding statements quarterly, and sales tax returns monthly. Given this distinction, the KTBA proposed that the 60-day password change requirement should apply only to sales taxpayers, while income taxpayers -- particularly salaried individuals -- should be required to update their passwords only once a year.

The KTBA recommended that the FBR amend the IRIS web portal rules to reflect these changes. The association also suggested that STRNs should be automatically blocked or suspended if a taxpayer fails to file returns for three consecutive months -- a practice already followed by provincial tax regulators to prevent tax evasion and misuse. Similarly, STRNs should be blocked if a deregistration request remains pending for more than three months.

The KTBA urged the FBR to reassess the policy to ensure a more balanced approach to security while reducing unnecessary compliance burdens on taxpayers.