The digital transformation of Pakistan’s tax administration was intended to improve transparency, efficiency, and compliance. Systems such as the Federal Board of Revenue’s (FBR) IRIS portal promised to reduce human intervention, simplify tax filing, and strengthen revenue collection. However, the findings of the Federal Tax Ombudsman’s (FTO) decision in Complaint No. 3529/KHI/ST/2025 expose a troubling reality: when digital systems operate without adequate safeguards, they can become powerful instruments of fraud rather than accountability. The case revolves around Imran Impex, whose proprietor claimed that he had never applied for sales tax registration and had no involvement in taxable business activities requiring such registration. Despite this, he was compulsorily registered for sales tax, his identity was allegedly manipulated, fake sales tax returns were filed in his name, and purchases worth billions of rupees were inserted into the tax system without his knowledge. These fraudulent entries ultimately led to blacklisting of his registration and assessment proceedings against him, exposing him to severe legal and financial consequences.
What makes this case particularly alarming is that it extends far beyond the grievance of a single taxpayer. The FTO’s investigation identified a systematic pattern of identity theft, manipulation of taxpayer profiles, and fraudulent use of fake invoices across multiple entities. According to the investigation, an accused former employee of Pakistan Revenue Automation Limited (PRAL), Yasir Latif, allegedly exploited weaknesses in the IRIS system by altering taxpayers’ registered mobile numbers and email addresses, thereby obtaining unauthorized access to their accounts. The investigation further concluded that the same network of fraudsters was involved in similar cases involving Sultan Medical Store and Poultry International, demonstrating that this was an organized cyber-enabled tax fraud rather than an isolated incident. Perhaps the most disturbing aspect of the case is not merely the existence of fraud but the apparent failure of institutional controls to prevent it. The FTO highlighted that the complainant was compulsorily registered after receiving only a three-day online notice, with no evidence that the notice had actually been served through conventional means or that reasonable opportunity for hearing had been provided. This falls short of the principles of natural justice, particularly the universally accepted doctrine that no person should be condemned without being heard. Equally concerning are the technological weaknesses identified in the IRIS system itself. The investigation found that billions of rupees in fictitious transactions moved through the tax system without triggering meaningful alerts. Returns involving a poultry business suddenly declaring transactions relating to scrap metal, repeated invoices with identical values and quantities, and implausibly large purchases worth Rs. 7.7 billion were accepted by the system without effective validation. Such glaring anomalies should have activated automated risk detection mechanisms. Instead, weak business rules and insufficient system controls enabled fraudsters to exploit the platform and transfer fake input tax credits across multiple tiers of the supply chain. The case also raises important questions regarding institutional accountability. Rather than thoroughly investigating the complainant’s repeated claims of identity theft, the tax authorities proceeded with assessment proceedings and recovery efforts against the apparent victim. The FTO criticized the respondent department for focusing on tax recovery while neglecting the larger criminal conspiracy responsible for manipulating taxpayer identities and generating fraudulent tax records. This approach reflects a reactive administrative culture that prioritizes procedural enforcement over factual investigation.
The broader Implications for Pakistan’s digital governance are significant. Public trust is the cornerstone of voluntary tax compliance. Citizens are more likely to comply with tax laws when they believe that government institutions are competent, transparent, and capable of protecting their personal information. Cases involving unauthorized profile modifications, misuse of taxpayer credentials, and delayed institutional responses inevitably undermine confidence in digital public services. If taxpayers begin to fear that they may be held responsible for fraudulent activities committed by cybercriminals, confidence in online tax administration will continue to erode.
The findings further highlight the growing importance of cybersecurity within public sector institutions. As governments increasingly digitize essential services, cyber resilience becomes a fundamental requirement rather than a technical luxury. Robust authentication procedures, multi-factor verification, biometric confirmation for sensitive profile changes, real-time anomaly detection, comprehensive audit trails, and stronger internal access controls are no longer optional features they are essential components of modern digital governance. Equally important is continuous oversight of employees with privileged system access, as insider threats often pose risks comparable to external cyberattacks. The Federal Tax Ombudsman deserves recognition for conducting a detailed investigation that went beyond the immediate complaint to uncover systemic weaknesses within the tax administration. Rather than focusing solely on procedural irregularities, the investigation identified broader governance failures involving administrative practices, technological vulnerabilities, and institutional coordination. The recommendations including restoration of the complainant’s sales tax registration where appropriate, comprehensive investigation into cybercriminals, legal action against beneficiaries of fake input tax adjustments, and submission of a detailed compliance report by the FBR-provide a roadmap for meaningful institutional reform. Ultimately, this case should serve as a wake-up call for Pakistan’s public institutions. Digital transformation cannot succeed on software alone; it must be supported by effective governance, strong cybersecurity, transparent accountability, and respect for due process. As governments continue embracing digital platforms, protecting citizens from identity theft and administrative injustice must remain a central priority. The credibility of Pakistan’s tax system depends not only on its ability to collect revenue but also on its ability to safeguard taxpayers’ rights while ensuring that criminals not innocent citizens are held accountable for fraud.
The lesson from this case Is both simple and profound: technology can strengthen governance only when institutions are equally committed to transparency, accountability, and justice. Without these foundations, digital systems risk becoming tools that magnify administrative failures instead of solving them.
