ByThe Federal Board of Revenue (FBR) has introduced a significant update regarding the security of Iris (Income Tax Return System) logins. A new feature has been implemented where users now receive an email notification whenever their account is accessed. This initiative enhances security by keeping taxpayers informed about login activities related to their accounts. Let’s delve into the details of this update and its implications.
Previously, the Iris system did not notify users if someone accessed their account. This lack of alerts posed risks of unauthorized access, especially when personal details like CNIC numbers were misused. Many individuals faced issues where others could access or manipulate their data without detection. The absence of notifications made it easier for unauthorized individuals to exploit accounts. However, with this update, FBR is addressing these vulnerabilities.
From now on, as soon as someone logs into an IRIS account using the correct credentials, the account owner will receive an email. This email will include both the date and time of login, ensuring users are promptly informed. This feature provides taxpayers with the ability to monitor their accounts more effectively and take timely action if unauthorized access occurs.
Historical Context of FBR’s Password Policy
FBR introduced a policy requiring users to update their IRIS passwords every 60 days. While this was aimed at improving security, it also created challenges for many users. If someone forgot their password and their email or mobile number linked to the account was outdated, the password recovery process became difficult. Additionally, the system did not block users from logging in after the 60-day period; instead, it prompted them to update their password before proceeding. Users could still access their accounts by entering the old password and creating a new one.
This policy remains in place, but there is no clarity from FBR yet on whether it will be updated or revised. For now, taxpayers must continue adhering to the 60-day password change requirement.
Managing IRS Access for Multiple Users
There are solutions for managing IRIS logins, especially for individuals or consultants handling multiple accounts. FBR allows users to authorize family members or clients, providing them with controlled access. This feature ensures better management of accounts while maintaining security. If this process interests you, reviewing FBR’s guidelines or seeking professional advice can help streamline authorization for multiple users.
Enhancements to Security Measures
The introduction of login notifications is part of a broader effort by FBR to improve security. Taxpayers will also receive updates in the future through text messages. This dual-layer notification system aims to ensure users are aware of any login attempts, whether successful or otherwise. However, as of now, notifications are only sent via email. It is anticipated that FBR will provide more details about account lockout mechanisms, such as the number of failed login attempts that might trigger an account block.
Benefits of the Update
- Enhanced Awareness: Taxpayers are instantly informed if their account is accessed.
- Improved Security: Unauthorized access becomes more detectable, reducing misuse.
- Account Monitoring: Users can track login activities, ensuring transparency.
- Prompt Action: Suspicious activity can be addressed immediately, minimizing risks.
Areas Needing Clarification
While this update is a positive step, some aspects remain unclear. For instance, FBR has not specified whether the 60-day password change policy will continue unchanged or whether further security measures will be introduced. Additionally, users await details on whether the new notification system will extend to unauthorized login attempts or failed login attempts.
Final Thoughts
The new email notification feature by FBR is a welcome addition to the IRIS system, providing taxpayers with better control over their accounts. By ensuring users are informed about account access in real-time, FBR is addressing long-standing security concerns. As more updates are rolled out, users can expect enhanced safeguards against unauthorized access. For now, taxpayers should remain vigilant, keep their contact information updated in the IRIS system, and comply with existing password policies to ensure seamless access to their accounts.
