ISLAMABAD: In an unexpected and unannounced development, the Federal Board of Revenue (FBR) has removed the Multi-Factor Authentication (MFA) requirement for Tax Consultants and Sales Tax registered taxpayers logging into the IRIS system.
The MFA system, introduced only three months ago, required users to verify their identity through the Tax Asaan Mobile App before gaining access to their accounts. The policy was implemented to enhance system security and protect sensitive taxpayer data.
However, as of today, multiple tax professionals have reported being able to log in without completing the MFA step. No authentication code or verification prompt is appearing, allowing direct access to IRIS accounts.
What has added to the confusion is that the MFA popup notification — instructing Tax Consultants and Sales Taxpayers to use the Tax Asaan App for login authentication — is still prominently displayed on the FBR website. This suggests that while the requirement has been disabled, the front-end communication to taxpayers has not been updated, leaving a contradictory message.
The sudden rollback has generated mixed reactions in the tax community. Some practitioners welcome the removal, citing previous complaints about login delays and technical issues with the Tax Asaan App. Others have expressed concern over possible security risks and the absence of any official clarification from the FBR.
As of now, the FBR has not issued any press release, notification, or official statement explaining whether the move is temporary, a system glitch, or a permanent policy reversal.
