Locked out of IRIS: how to recover access
Being locked out of IRIS is an administrative problem right up until the week of a filing deadline, at which point it becomes an expensive one. The recovery route depends entirely on one thing: whether you control the contact details on your registered profile.
Two very different situations
| Situation | Route | Realistic timeline |
|---|---|---|
| You control the registered email and mobile | Standard password reset — a verification code is sent and you set a new password | Minutes |
| The registered email or mobile belongs to someone else, or has lapsed | A change of registration particulars, evidenced by your own identity documents | Days, sometimes longer |
The standard reset
- Go to the IRIS login page and select the password recovery option.
- Enter your registration identifier — CNIC for an individual, registration number for an entity — in the format the portal expects.
- A verification code is sent to the registered email address and mobile number.
- Enter the code and set a new password.
- Log in and immediately confirm your profile particulars are still current — profile updates.
If the code does not arrive, check the identifier format first. A formatting mismatch produces a failure that looks identical to a lost account.
You need an NTN — for a job, a bank, a business registration, or as the first step to becoming a filer.
When the contact details are not yours
Work through these in order before assuming the worst:
- Can the mobile number be reactivated? If it lapsed rather than transferred, the operator can often restore it, and that is usually the fastest path.
- Can the consultant simply forward the code? Not a long-term answer, but it may unlock the account today so you can change the particulars from inside.
- Otherwise, change the registered particulars through the process for updating registration details, supported by your own identity documents.
Whichever route works, the first thing to do once inside is replace the email and mobile with your own. Do not fix the immediate problem and leave the underlying arrangement in place.
Why access matters beyond filing
People treat IRIS access as something needed once a year. It is more than that:
- Notices are served electronically and response deadlines run whether or not you saw them — responding to a notice.
- Your filing history lives there, and you cannot verify what was filed in your name without access.
- Withholding credits appearing against your registration are checked there before you claim them.
- Payment records and challans are traced there.
- Active Taxpayer List problems often trace back to something visible in the account — an unsubmitted draft, a wrong tax year.
Entity accounts and the person who left
For a company or association of persons the access problem has an extra dimension: the account is the entity, but the credentials sit with a person. Two situations recur:
- The finance manager or director who held the login has left. If the registered email was their work address it may still exist, but the mobile is often personal and goes with them. Treat credential handover as part of the exit checklist, alongside bank mandates and system access.
- The registered contact is a former director. This needs a change of particulars, and for a company it should be checked against the SECP record at the same time — a director who has resigned should not remain the FBR contact either.
The practical control is to use a role-based email the entity controls — a finance or compliance address rather than an individual one — with a mobile number held by the business. That survives staff changes, which individual credentials do not. See updating the profile.
Not needing this guide again
- Register the email and mobile in your own name, and keep both active.
- Store credentials somewhere durable and accessible in three years — not only in a browser on a device you will replace.
- Log in once a quarter, even with nothing to file. It confirms access works and surfaces any notice sitting unread.
- Give a consultant representative access rather than your password.
- Update immediately when contact details change, rather than at the next filing.
- Test access in July, at the start of the filing cycle, not in late September.
That last item costs two minutes and removes the entire category of deadline-week access panic — see deadlines.
An evidence-led way to apply this guidance
The useful question in Locked out of IRIS: how to recover access is not simply whether a rule exists. For Locked out of IRIS: how to recover access, the file must prove the facts that make the rule apply. Start the Locked out of IRIS: how to recover access working by writing down filing obligation, tax year, income head, evidence, computation and submission status. Then tie each Locked out of IRIS: how to recover access conclusion to CNIC or registration record, contracts, certificates, bank statements, computation and acknowledgement. That article-specific exercise separates a defensible Locked out of IRIS: how to recover access position from one built around a label, a memory or a copied rate.
The legal starting point for Locked out of IRIS: how to recover access is the Income Tax Ordinance 2001, the relevant rules and the current Finance Act. The operational check for Locked out of IRIS: how to recover access belongs with FBR or the competent provincial authority. Read the instrument, current guidance and actual transaction together for Locked out of IRIS: how to recover access: guidance explains administration, but it does not rewrite the law or repair missing evidence.
No decorative rate. Locked out of IRIS: how to recover access is primarily a classification and evidence question, so this case file uses amounts to demonstrate the decision without inventing a percentage that the governing rules do not supply. That restraint is deliberate for Locked out of IRIS: how to recover access: an irrelevant percentage would make the page look detailed while making the advice less reliable.
| Checkpoint | Evidence to place on file | Reviewer question |
|---|---|---|
| Legal trigger | the Income Tax Ordinance 2001, the relevant rules and the current Finance Act | Which fact activates the Locked out of IRIS: how to recover access rule, and where is that fact evidenced? |
| Period and cut-off | Dated contract, invoice, return period and acknowledgement | Does the Locked out of IRIS: how to recover access amount belong in this period rather than the one before or after it? |
| Classification | CNIC or registration record, contracts, certificates, bank statements, computation and acknowledgement | Would an independent reviewer reach the same Locked out of IRIS: how to recover access classification from the documents alone? |
| Rate or treatment | Current authority publication saved with the working | Was the Locked out of IRIS: how to recover access source effective on the transaction date? |
| Submission trail | Final computation, payment proof and portal receipt | Can the Locked out of IRIS: how to recover access filed figure be rebuilt without asking the preparer? |
Two worked case files
Worked example 1 — bridge the taxpayer records to the filing position. For a file concerning Locked out of IRIS: how to recover access, assume the records show Rs 650,000 as the gross amount identified in the records, Rs 130,000 as the documented amount outside the selected income head, and Rs 40,000 as the period, exemption or classification adjustment. The amount carried to the Pakistan computation for Locked out of IRIS: how to recover access is therefore Rs 480,000:
| Line | Amount | File reference |
|---|---|---|
| gross amount identified in the records | Rs 650,000 | Primary control schedule |
| Less: documented amount outside the selected income head | (Rs 130,000) | Supporting document index |
| Less: period, exemption or classification adjustment | (Rs 40,000) | Reviewer-approved adjustment |
| amount carried to the Pakistan computation | Rs 480,000 | Signed computation |
WORKING 1 Rs 650,000 - Rs 130,000 - Rs 40,000 = Rs 480,000
The arithmetic is the easy part of Locked out of IRIS: how to recover access. The Locked out of IRIS: how to recover access judgement sits in filing obligation, tax year, income head, legal treatment and the evidence behind each adjustment, including why Rs 130,000 and Rs 40,000 were removed. If any Locked out of IRIS: how to recover access answer is weak, keep the amount in the exception list rather than forcing it into a filing, resolution or account.
Worked example 2 — reconcile the submitted figure to payments. For Locked out of IRIS: how to recover access, assume Rs 1,650,000 as the return and payment control total, Rs 190,000 as the withholding or payment supported by evidence, and Rs 65,000 as the valid credit or timing difference. The open balance before submission for Locked out of IRIS: how to recover access is Rs 1,395,000.
WORKING 2 Rs 1,650,000 - Rs 190,000 - Rs 65,000 = Rs 1,395,000
For Locked out of IRIS: how to recover access, place the Rs 1,650,000 return and payment control total, the Rs 190,000 support for the withholding or payment supported by evidence, and the Rs 65,000 schedule for the valid credit or timing difference beside the final Rs 1,395,000 balance. A Locked out of IRIS: how to recover access reviewer should be able to move from source evidence to control total, from control total to decision, and from decision to the submitted figure without a hidden spreadsheet or oral explanation.
The final quality-control questions
- Has the file for Locked out of IRIS: how to recover access identified the controlling law and the version effective for the relevant date?
- Are the Locked out of IRIS: how to recover access assumptions visibly labelled and separated from enacted rates, thresholds and deadlines?
- Do the Rs 480,000 and Rs 1,395,000 results reconcile to source evidence and the general ledger?
- Is every Locked out of IRIS: how to recover access exception assigned to a person and date rather than buried in a note?
- Has the client or responsible officer approved the Locked out of IRIS: how to recover access facts before submission?
This is the standard that makes Locked out of IRIS: how to recover access useful in practice: the conclusion is stated, the law is named, the numbers can be recomputed, and the evidence survives after the person who prepared the file has moved on.
Sources
This guide is written against the official and clearly labelled professional references below. Rates, thresholds and portal procedures change between reviews, so open the primary source before relying on a figure.
Questions people also ask
My consultant registered me and holds the email. How do I take control?
This is a profile change rather than a password reset, because the verification codes go to their address. You will need to update the registered email and mobile to details you control, which is a change to your registration particulars supported by your own identity documents. Start it well before you need access, because it is not instant.
The registered mobile number is no longer active. What now?
A lapsed number is the most common cause of a stalled recovery, because it is where the verification code goes. Where possible, reactivate the number with the operator — often faster than the alternative. If it cannot be recovered, the route is a change of registered particulars, evidenced by your identity documents.
Can I just create a new IRIS account?
No, and attempting it creates a worse problem. Your registration is tied to your CNIC or registration number, so a second profile is not a fresh start — it is a duplicate that has to be unwound. Recover the existing account rather than trying to work around it.
How long does recovery take?
Where you control the registered email and mobile, minutes. Where you do not, it depends on the change process and how quickly you can produce supporting documents. Assume days rather than hours, which is precisely why this should not be discovered on 29 September.
Is it safe to let a consultant keep my login?
Sharing a password is different from authorising a representative. Where a consultant needs access, the appropriate route is representative access, which lets them work while notices and verification codes continue to reach you. Handing over the primary credentials means you cannot independently verify what has been filed in your name.
Send the tax year and the transaction or filing involved, and we will tell you what is actually required.
Talk to Chartered Advisory Open the tax calculators