The Federal Tax Ombudsman (FTO) has busted another gang of cybercriminals within the Federal Board of Revenue (FBR) and Pakistan Revenue Automation Limited (PRAL) involved in the fraudulent filing of sales tax returns and revised returns, using fake or flying invoices to show fictitious supplies.
On Wednesday, the FTO issued strict instructions to the FBR to take action against the cybercriminals and beneficiaries of the tax fraud.
“The repeated hacking of taxpayers’ password IDs also reflects on the quality of security and sanctity of the data and the entire IT system. Critical system weaknesses include compromised data integrity, inadequate data security, weak internal controls, and insufficient safeguards against tax fraud. Inadequate system controls allow for data manipulation, a lack of system alerts for unusual activity, and unauthorized changes in taxpayers’ profiles to facilitate the creation of fake transactions,” the FTO stated.
According to the order signed by the new FTO, the illegal misuse of the complainant’s password ID and the fraudulent filing of sales tax returns and revised returns for the tax periods July 2024 to June 2025, repeatedly every month, introduced fake supplies through Annexure C, resulting in multiple issues for filing sales tax returns in subsequent periods. This amounts to maladministration.
The FBR has been directed to instruct the Chief Commissioners-IR at RTOs in Multan, Peshawar, Quetta, Faisalabad, Lahore, Rawalpindi, Sahiwal, RTO-I Karachi, RTO-II Karachi, CTOs in Islamabad & Lahore, and LTOs in Lahore & Islamabad.
The FBR must ensure legal proceedings for conviction against the beneficiaries of tax fraud, as already identified and communicated by this forum via letter dated 29.10.2025, followed by a reminder on 19.11.2025, in compliance with the Board’s instructions dated 07.09.2023 in Sales Tax General Order No. 12 of 2023, “Standard Operating Procedure (SOPs) to deal with cases involving flying and fake invoices.”
The FBR must also identify other beneficiaries down the supply chain and immediately share details of such cases with the relevant jurisdictions for legal action, as per the Board’s instructions dated 07.09.2023, to be carried out by the respective Commissioners, the FTO order maintained.
The FTO has directed the Director General Intelligence and Investigation (I&I) to identify the cybercriminals, whether within or outside the FBR/PRAL, who used IP addresses to introduce fake supplies into the supply chain, for conviction under the law.
Additionally, the FTO has directed the CEO of PRAL, Islamabad, to remove the link incorporated in the 181-registration form as (Muhammad Sohail Ajmal), or to enable the Local Registration Office, RTO Bahawalpur, to remove the link, as they are currently unable to do so at their end.
