iTechGuides is reader-supported. When you buy through links on our site, we may earn an affiliate commission. As an Amazon Associate I earn from qualifying purchases. Learn more
The Federal Tax Ombudsman (FTO) found maladministration in the protection of taxpayer credentials and confidential data in a case involving alleged bogus sales-tax supplies recorded against Gravity Traders. The FTO decision puts the alleged value of those supplies at Rs 81.434 billion and the associated GST impact at Rs 14.658 billion. Those are different figures: the first is the value of alleged supplies, not a finding that Rs 81.434 billion in revenue was stolen.
What happened in the Gravity Traders case?
In decision 2800/KHI/ST/2024, the FTO described a case involving Gravity Traders, which had filed null returns while bogus supplies were allegedly recorded under Annexure C for tax periods from September 2023 through January 2024. The decision gives the alleged supplies’ total as Rs 81,434,501,015 and the associated GST amount as Rs 14,658,210,183.
The FTO said the filed records and transaction chain suggested cybercrime. It also noted that FBR and the Pakistan Revenue Automation (Private) Limited (PRAL) could not provide the underlying Annexure C invoices in the prescribed form, raising questions about credentials, data integrity and a portal check. The decision does not establish a final criminal conviction or identify a proven perpetrator.
Read the Federal Tax Ombudsman’s decision 2800/KHI/ST/2024.
#1 Best Overall
- HARDWARE PLUS SECURITY SERVICES: FortiGate-60F Firewall Appliance bundled with 3 year of FortiCare Premium and FortiGuard Unified Threat Protection.
- UNIFIED THREAT PROTECTION (UTP): Secures against advanced online threats with comprehensive web filtering and anti-botnet technologies.
- OPTIMIZED FOR MEDIUM-SIZED BUSINESSES: Tailored for businesses needing robust security without the infrastructure of larger enterprises.
- RELIABLE CUSTOMER SUPPORT: FortiCare Premium ensures high-quality support and service continuity.
- EFFECTIVE PROTECTION: Employs advanced filtering technologies to safeguard against sophisticated threats.
What did the FTO find and ask FBR to do?
The FTO found maladministration in safeguarding the complainant’s user ID, password and confidential taxpayer data. Its finding described a “Failure to provide the security and protection of the Complainant’s User ID! Password and sanctity of the taxpayers’ confidential data from misuse /hacking leading to a tax fraud case worth Rs. 14.658 billion”. This is the Ombudsman’s finding about the case, not proof that the full FBR IT system was breached.
The decision called for follow-up on several fronts:
Rank #2
- Enterprise-grade prevention, detection, correlation and response from the perimeter to the endpoint with our Total Security Suite.
- Gain critical insights about network security, from anywhere and at any time, with WatchGuard Cloud.
- Built-in compliance reports, including PCI and HIPAA, mean one-click access to the data you need to ensure compliance requirements are met.
- Up to 18 Gbps firewall throughput. Turn on all additional security services and still see up to 2.4 Gbps throughput.
- Investigate the cybercriminals and examine whether anyone within PRAL or FBR may have been involved.
- Have an FBR Member IT inquiry examine the matter and pursue corrective action.
- Consider revoking the taxpayer’s blacklisting.
- Submit reports within the decision’s specified 60-day and 90-day timelines.
The decision sets out those requests and deadlines; the available materials do not establish whether the reports were submitted or every recommendation was implemented.
How did FBR respond?
In a public response carried by Pakistan’s Press Information Department on October 28, 2025, FBR rejected reports that its entire IT system had collapsed or come under cybercriminal control, saying those reports misread the Ombudsman’s decision. FBR said the password remained in the taxpayer’s custody and was misused after a taxpayer-side security lapse. Its statement said: “The password was misused while in the possession of the taxpayer, and not obtained from the FBR database.” FBR also said its Intelligence and Investigation Wing first detected the irregular filing pattern.
Rank #3
- Entry-Level Privacy Gateway: Designed for users who want simple online privacy protection at an affordable level—ideal for basic home networking and daily internet use.
- Secure Browsing for Everyday Needs: Perfect for email, social media, online shopping, and standard streaming—protecting your connection while keeping setup and operation easy.
- Lightweight Protection Against Common Online Threats: Helps reduce exposure to unwanted ads, trackers, and risky websites, improving online safety for your household.
- Simple Setup, No Technical Skills Required: Plug it in, follow the quick steps, and start using—an excellent choice for beginners who don’t want complicated network configurations.
- Decentralized VPN (DPN) Included – No Monthly Payments: Get built-in decentralized VPN access with lifetime free usage, helping you stay private without paying recurring subscription fees
FBR said it overhauled security processes in December 2024, including security information and event management (SIEM), security orchestration, automation and response (SOAR), endpoint detection and response (EDR), multi-factor authentication (MFA) and logging controls. These are FBR’s statements about its response and controls; they do not, by themselves, resolve the factual dispute over how the credentials were misused.
Read FBR’s statement carried by the Press Information Department on October 28, 2025.
Rank #4
- Single appliance with integrated firewalling, SD-WAN and Wi-Fi controller reduces complexity of WLAN management. Its zero-touch deployment helps optimize your onboarding experience.
- Built on a patented secure processor, this compact network firewall delivers the highest level of security and performance in its class – 800 Mbps IPS | 500 Mbps threat protection.
- User-friendly management console gives you centralized visibility and simplifies policy enforcement across your network. Its zero-touch deployment helps you optimize your onboarding experience.
- Compact and fanless design equipped with 4 GE RJ45 ports (1 WAN port and 3 internal ports) provide essential connectivity and flexibility for various network configurations in a small-scale environment.
- Including award-winning FortiGate hardware and 3-year FortiGuard AI-powered UTP security services. Services cover IPS, Advanced Malware Protection, Application Control, URL, DNS & Video Filtering, Antispam Service, and FortiCare Premium customer support.
What the case does—and does not—establish
The central distinction is between the FTO’s finding about inadequate protection of taxpayer credentials and FBR’s later account that a taxpayer-held password was misused. The decision raised questions about possible cybercriminal activity and insider involvement and directed inquiries; those questions should not be treated as established guilt. Likewise, Rs 81.434 billion is the alleged value of supplies, while Rs 14.658 billion is the stated GST impact.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Scan for outdated or missing drivers - takes under a minute3Repair Windows errors before they cause bigger problemsThe FTO’s media index shows that coverage appeared on October 8, 2024, with headlines including “Gang exploits FBR vulnerability, defrauds Rs 81 billion” and “Faulty FBR cyber security caused Rs14.66 billion tax fraud.” Those headlines reflect media framing listed by the Ombudsman, not additional proof of the claims. The accessible decision text does not show a legible decision date, so its complaint number is the reliable identifier.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
