Before You Share Your FBR IRIS Password With Anyone
For years in Pakistan, the standard way people hired an informal tax preparer was dangerously casual: you sent a photo of your CNIC and your FBR IRIS password to an unknown stamp-paper vendor or social media agent, paid a small fee, and waited for a PDF acknowledgement to come back. Many taxpayers do not even know their own IRIS recovery details because the first person who registered their NTN put their own office email address and phone number on the profile.
Understanding how to protect ownership of your FBR IRIS profile—while still letting a trusted tax consultant handle your filings smoothly—is essential for every individual and business owner in Pakistan.
What Goes Wrong With Unverified Street Agents
When an unverified agent or tout takes over your IRIS profile and replaces your contact details with their own, several severe problems can occur without your knowledge:
- Unauthorized Business Additions on Form 181: A third party can file a Form 181 modification adding an unknown trading firm or warehouse to your CNIC. You receive no alert if the agent replaced the email address on your profile.
- Fake Sales Tax Invoicing and Supply-Chain Fraud: Criminal networks routinely buy or harvest dormant IRIS logins to register for Sales Tax (STRN) or attach dummy suppliers. Millions of rupees of fake input/output invoices are routed through the account before FBR's automated risk system flags the CNIC.
- Locked Contact Details and Hostage Profiles: Unscrupulous preparers sometimes replace the taxpayer's personal email and phone number with their own office contact information so the client cannot switch consultants without paying a release fee.
- Unapproved Wealth Statement Figures: Submitting a return with arbitrary cash-in-hand, unverified foreign remittances, or inaccurate property values creates massive exposure during a Section 122 or Section 111 audit.
How Safe Advisor Execution Actually Works (Three Flexible Options)
Working with a disciplined consultancy does not mean you have to struggle with complicated FBR and SECP portals alone. First, you never paste passwords or PINs into an unreviewed public web form. Once your case is opened with Corporate Morning Desk (or through direct engagement on WhatsApp or phone), we complete your portal work through whichever of our three execution modes fits you best:
- Option A — Guided Session / Client Submission: We prepare your complete working papers, tax computation, and draft forms, share them on your status page, and guide you on a quick call or screen-share while you review and click submit.
- Option B — Authorized Representative / Advisor Link: For corporate SECP eZfile and FBR representation matters, we act through formal authorized representation workflows where supported by statute.
- Option C — Direct Advisor Execution After Engagement: If you prefer our desk to execute the IRIS or portal steps hands-on for you after your case is opened, our advisor coordinates verification and OTP steps directly with you over WhatsApp or phone call—while ensuring your own personal email address and CNIC-registered mobile SIM always remain the permanent recovery channels on your profile.
Four Golden Rules to Keep Your Profile Safe
First, verify that the mobile SIM and email listed on your FBR profile belong to you, never to an agent's office. Second, never type passwords into public website intake boxes before a case is formally opened. Third, always review your draft working papers and wealth reconciliation before final return submission. Fourth, rotate your password after an engagement finishes if you ever want to reset access.
Disclaimer: Corporate Morning Desk (desk.corporatemorning.com) is a private tax and corporate advisory practice handling FBR, SECP, and provincial revenue filings across Pakistan. This guide is provided for general informational purposes in plain English and does not constitute formal legal representation.