Suspicious FBR message? Verify it before responding
Checked 19 September 2026. Practical guidance for individuals. All examples are illustrative; amounts are not tax quotations.
A message claims you owe tax immediately, or that a refund is waiting if you enter bank details. Before replying, separate two questions: is the communication authentic, and is there a genuine matter requiring action? Checking the first should not make you overlook the second.
Pause the requested action
FBR's phishing advisory says it does not send emails requesting PINs, passwords or similar financial-account access information. It advises against using suspicious links and attachments. Open the official FBR website independently and reach Iris or support from there.
Do not send money to a personal account because the sender uses an FBR logo. Do not approve a login prompt you did not initiate. A familiar display name, correct spelling or your actual name does not by itself authenticate the sender.
Record enough detail to verify the claim
| Claimed item | What to record safely |
|---|---|
| Notice or order | Reference, section if stated, period and claimed issuing office |
| Urgency | Stated response date and the date you received it |
| Sender | Displayed address/number and the message context |
| Payment or refund | Amount and what action the sender demands |
| Your checks | Independent Iris/support check, date and case reference |
Do not click a link merely to complete this table. Preserve the message or a screenshot safely and follow the official reporting instructions. Share sensitive evidence only through the verified reporting channel, not a public comment thread.
Example: a refund requires a password
An illustrative message promises a refund if you supply your bank password. That demand is a reason to stop. Independently check your actual refund application and official FBR correspondence. If no matching matter is found, ask official support about the claimed reference rather than testing the sender's form with real credentials.
Now consider a different message that alerts you to a genuine document already in your account. The alert may still need verification, but the underlying document requires its own review. Do not discard an actual notice just because another message was fraudulent. Absence from one screen is not a universal legal test for valid service; verify an uncertain document with the relevant office.
If you already entered information
- For bank credentials or an unauthorised payment, contact your bank immediately through its verified channel.
- For tax-account access, use the official recovery/support process and review contact and representative details.
- If you installed unknown software, stop using the affected device for sensitive transactions and seek trusted technical help.
- Record what was disclosed and when, without sending the secret again to someone offering help.
Use the Iris recovery guide and the bank-complaint checklist for the appropriate next step. A promise of instant recovery in exchange for another fee should itself be verified.
Report and handle the real tax task separately
Use FBR's published fraud instructions and current official support details. The phishing page includes older external reporting links; verify the present reporting channel before submitting personal evidence. Keep your reporting reference.
If the underlying tax notice is genuine, follow the response guide and organise the document, evidence and stated deadline. A scam report does not automatically extend a genuine response deadline. Seek professional help for the tax issue if needed; you can perform initial authenticity checks yourself.
Test the message and the underlying matter separately
A suspicious link does not prove that the claimed tax issue is imaginary. Open Iris from an independently typed official address, compare the tax period, section, document number and response date, and then contact the issuing office through details obtained independently. This creates two conclusions: whether the message channel is trustworthy, and whether a genuine notice exists.
If credentials were entered, change access through the official recovery route, review representative and contact details, and tell the bank immediately if financial information was exposed. Preserve the original message headers or screenshot and your verification reference. Do not forward a live phishing link to colleagues as a warning; use a screenshot with sensitive information redacted.
I have a tax document whose authenticity or response requirements need review. I can give a redacted summary and the stated deadline. Begin with a short summary. Ask for the scope and fee before commissioning work. Do not send passwords, PINs or one-time codes.
Sources
This guide is written against the official and clearly labelled professional references below. Rates, thresholds and portal procedures change between reviews, so open the primary source before relying on a figure.
- FBR: instructions on fraudulent emails and SMS
- FBR: phishing warning and reporting guidance
- FBR: official online services and support routes
Questions people also ask
Does FBR ever send messages?
Do not assume every message is fake. Verify the particular claim independently and distinguish an alert from the underlying official document.
Can I ignore a notice if it is not on the first Iris screen?
No blanket conclusion follows. Check the account and claimed reference and verify uncertain service with the relevant office.
Should I send my password to someone checking the notice?
No. Begin with a redacted description and use official account and support processes.