How to Reset a Forgotten FBR IRIS Password in Pakistan
Forgetting your FBR IRIS password is a common problem, especially because many people log in only once a year to file a tax return. The good news is that FBR IRIS has a built-in password recovery option on its login page, and in most cases you can reset the password yourself in a few minutes. This guide walks you through the recovery steps, the details you should keep ready, what to do when your registered email or phone is no longer accessible, and how to keep the account safe afterwards. Portal screens change from time to time, so if a button label differs slightly from the wording here, look for the recovery option on the login page itself.
Before You Start: Details to Keep Ready
Password recovery asks you to prove that you own the account. Gathering the following details before you begin saves time and avoids repeated failed attempts, which can lock the account temporarily.
- CNIC number or NTN: the identity number used to register the IRIS account. For individuals this is usually the CNIC; for businesses it is the NTN.
- Registered email address: the email address you gave when you registered on IRIS. The reset link or code is sent to this address.
- Registered mobile number: the mobile number linked to the account, used where IRIS sends a verification code by SMS.
- Security question answers: if you set security questions during registration, you may be asked for those answers.
- Access to your inbox and phone: keep the phone switched on and check both the inbox and the spam folder for the recovery message.
If you are not sure which email or phone number is registered, try the one you used most recently for FBR correspondence, such as the address on your tax return acknowledgment. Do not guess repeatedly on the login page, because too many failed attempts trigger a temporary lock.
Step-by-Step Password Reset on the IRIS Login Page
- Open the genuine FBR IRIS login page. Go to the official FBR website and follow its link to IRIS, or use the IRIS address you have used before. Check the website address carefully before typing any personal detail.
- Choose the recovery option. On the login page, look for the forgot password or password recovery link near the login button and click it.
- Enter your CNIC or NTN. Type the identity number exactly as registered, without dashes or spaces unless the form asks for them.
- Enter your registered email or mobile number. Provide the contact detail that IRIS asks for, matching the one registered with your account.
- Answer any security question. If the system asks a security question, answer it exactly as you set it during registration.
- Open the recovery message. Check your email inbox and spam folder, or your SMS messages, for the reset link or verification code. Recovery messages can take a few minutes to arrive.
- Set a new password. Follow the link or enter the code, then choose a new password. Use a mix of upper and lower case letters, numbers, and a symbol, and avoid passwords you use elsewhere.
- Log in with the new password. Return to the IRIS login page and sign in with your CNIC or NTN and the new password to confirm the reset worked.
If the reset link has expired by the time you open it, start the recovery process again and open the newest message promptly. Reset links are time limited for security reasons.
Common Problems and What to Do
| Problem | Most likely cause | What to do |
|---|---|---|
| Reset email never arrives | Wrong registered email, or message in spam folder | Check the spam folder, confirm the registered email, then request the reset once more |
| Verification code does not arrive by SMS | Old mobile number, or weak network signal | Wait a few minutes, check network coverage, then request the code once more |
| Account locked after failed attempts | Too many wrong password guesses | Wait for the lock period to end, then use the recovery option instead of guessing |
| Reset link shows as expired | Link opened too late, or an older link was used | Start recovery again and open the newest link promptly |
| Registered email or phone is no longer accessible | Contact details changed since registration | Contact FBR through official channels with your CNIC and documents to update them |
When Your Registered Email or Phone Is Not Accessible
This is the hardest case, because the online reset process can only send the recovery message to the contact details on record. Repeating the online steps will not help if you cannot open that inbox or receive SMS on that number. Instead, take the following route.
- Contact FBR through official channels. Use the helpline or contact details published on the official FBR website, and explain that your registered contact details are no longer accessible.
- Visit an FBR facilitation centre if needed. Take your original CNIC and, where applicable, your NTN documents. Staff can verify your identity and guide you on updating your registered email and phone number.
- Never share your password with an agent. No genuine FBR officer or agent needs your password to help you. If anyone asks for it, refuse and report the incident through official channels.
- Update your contact details immediately after recovery. Once you regain access, change the registered email and phone number to ones you currently use, so the next recovery works smoothly.
Helpline numbers and office addresses change over time, so always take them from the official FBR website rather than from a social media post or a forwarded message.
Keeping Your IRIS Account Safe After the Reset
- Use a unique, strong password: one that you do not reuse on email, banking, or social media accounts.
- Log out after every session: especially on a shared or public computer, and close the browser afterwards.
- Check the website address: before entering your CNIC or password, confirm you are on the genuine FBR IRIS site and not a lookalike page.
- Keep contact details current: update your email and phone number on IRIS whenever they change, so recovery always reaches you.
- Store the password safely: use a password manager or a private written note kept at home, never a photo shared in a chat group.
- Review your account activity: after logging in, check that your profile details and filed returns look correct, and report anything unfamiliar through official FBR channels.
Once your password is reset, you can return to filing. For the filing steps themselves, read our guide on how to file your income tax return on FBR IRIS, and for checking your filer status, see the active taxpayer status guide on this site.
Frequently asked questions
How do I reset a forgotten FBR IRIS password?
Open the FBR IRIS login page and use the forgot password or password recovery option on that page. Enter your registered CNIC or NTN and the registered email address or mobile number when asked. Follow the link or code sent to your registered contact, set a new password, and then log in again with the new password. If the recovery message does not arrive, check your spam folder and confirm that you used the contact details registered with FBR.
What details should I keep ready before starting an FBR IRIS password reset?
Keep your CNIC number or NTN, your registered email address, and your registered mobile number ready before you start. You may also need the answers to any security questions you set when you registered. Having these details ready avoids repeated failed attempts, which can lock the account temporarily.
What if my registered email or phone number is no longer accessible?
If you cannot access your registered email or phone, the online reset link or code cannot reach you, so do not keep retrying the same step. Instead, contact FBR through its official helpline or visit the nearest FBR facilitation centre with your original CNIC and, where applicable, your NTN documents, and ask for help updating your registered contact details. Only update contact details through official FBR channels, never through a third party who asks for your password.
Why is my FBR IRIS account locked after failed login attempts?
IRIS locks an account temporarily after repeated failed login attempts as a security measure against guessing attacks. Wait for the lock period to end before trying again, and use the password recovery option instead of guessing the password again. If the account stays locked after the waiting period, contact FBR through official channels with your CNIC or NTN ready.
How can I keep my FBR IRIS account safe after a password reset?
Choose a strong password that you do not use on any other website, and never share it with anyone, including anyone claiming to be from FBR. Log out after every session, especially on a shared computer, and check that you are on the genuine FBR IRIS website before entering your CNIC or password. Update your registered email and phone number promptly whenever they change, so future recovery messages reach you.