Every year, as South Africa’s tax filing season opens, fraudsters get to work.
They know exactly what you’re doing right now. You’re filing a tax return, waiting for a refund, or expecting correspondence from SARS. And that heightened watchfulness for anything SARS-related is precisely what scammers are counting on.
SARS has issued an urgent warning this filing season: scammers are now using artificial intelligence to generate professional-looking email templates that are harder to identify as fraudulent. The usual warning signs — poor grammar, awkward phrasing, suspicious-looking email addresses — are disappearing. The fake emails now look like the real ones.
What the Scams Look Like Right Now
One of the most common scams involves phishing emails and SMSs that appear to come from SARS, directing taxpayers to fake websites where criminals attempt to steal login credentials, banking details and other personal information.
The message usually tells you one of two things: you are owed a refund and need to click a link to confirm your banking details — or you have an outstanding penalty that must be paid immediately to avoid legal action, with banking details provided in the message itself.
The link leads to a convincing copy of the eFiling login page. Once you enter your credentials, fraudsters take control of your eFiling profile, redirect your refund to a different bank account, and lock you out.
Impersonation scams have also become increasingly sophisticated. Criminals posing as SARS officials contact taxpayers by phone, email or messaging platforms, claiming there is a problem with a tax return, refund or tax status. Their goal: obtain identity numbers, tax reference numbers, banking details or one-time passwords.
The Five Things SARS Will Never Do
This is the list worth saving — and sharing with everyone in your business.
SARS will never ask for your banking details via SMS or email
SARS will never ask you to click a link in an SMS or email to update your bank account. If a message asks you to confirm, update, or provide banking details — it is a scam. Full stop.
SARS will never send you a refund notification asking you to click a link
Legitimate SARS refunds are processed directly to the banking details already registered on your eFiling profile. SARS does not need you to confirm or redirect anything via a link in a message.
SARS will never request your eFiling password, OTP, or banking PIN
SARS will never ask for passwords, one-time PINs, banking PINs or credit card information via email or SMS. Any message that asks for any of these is fraudulent — regardless of how official it looks.
SARS will never ask for immediate payment into an unfamiliar bank account
SARS is a pre-approved beneficiary with South African banks and does not request payments into unfamiliar bank accounts sent via unsolicited emails or SMSs. If you owe SARS money, you pay through eFiling or at a SARS branch.
SARS will never threaten arrest or immediate legal action via SMS
Legitimate SARS enforcement follows a formal process — assessments, notices, objection windows. A message threatening immediate arrest unless you pay right now is a scam designed to create panic and short-circuit your judgement.
The New Threat — AI-Generated Scams
This year’s scams are different from previous years. Scammers are now using AI to generate professional-looking email templates that are harder to identify as fraudulent. The logos are correct. The formatting matches genuine SARS correspondence. The language is professional.
The old advice — ‘look for spelling mistakes and poor formatting’ — is no longer sufficient. The new advice is simpler: never act on a communication that asks you to click a link, provide information, or make a payment — no matter how official it looks. Go directly to eFiling yourself by typing the address into your browser.
What To Do If You Receive a Suspicious Message
Don’t click anything
Not the link, not the attachment, not the ‘unsubscribe’ button. Clicking anything in a phishing email confirms that your address is active and may trigger further attempts.
Delete and block the sender
Remove the message immediately. Block the number or email address.
Report it to SARS
Forward the message to phishing@sars.gov.za. You can also visit the SARS Scams and Phishing webpage at sars.gov.za to see the latest known scam examples.
If you clicked a link — act immediately
Log in to your eFiling account immediately, change your password and activate multi-factor authentication. Contact your bank if you entered any banking details.
Check your eFiling profile for unauthorised changes
If a scammer has accessed your profile, they may have changed your banking details to redirect your refund. Log in directly and verify that your banking details are correct.
A Note for Business Owners
If your business has staff who handle SARS correspondence, payroll submissions, or eFiling — make sure they know about these scams. Business eFiling profiles are high-value targets because they may contain access to multiple tax accounts, larger refunds, and more sensitive financial data.
Brief your team. Share this article. At TBC, we manage eFiling profiles for our payroll and compliance clients. If you ever receive a message that appears to be from SARS and you’re not sure whether it’s legitimate — contact us before you click anything.
The Mindset Shift
Most people assume they’ll recognise a scam when they see one. The whole point of a scam is to look like the thing you trust.
This year, with AI-generated correspondence that mirrors genuine SARS communication almost perfectly, the question is not whether you can spot it. The question is whether you have habits that protect you regardless of whether you spot it.
Those habits are simple: never click a link in a SARS SMS or email. Never provide banking details or passwords in response to a message. Always go directly to eFiling yourself. Always verify before you act.
Tax season is here. So are the scammers. The best protection is knowing exactly what SARS will never do.
Keep It Simple
- SARS will never ask for your banking details, password, or OTP via SMS or email — ever
- SARS will never send a refund notification asking you to click a link to confirm banking details
- SARS will never threaten immediate arrest or legal action via SMS
- AI is now being used to generate fake SARS emails that look completely legitimate — old detection methods no longer work
- If you receive a suspicious message: delete it, block the sender, and report it to phishing@sars.gov.za
- If you clicked a link: change your eFiling password immediately and activate multi-factor authentication
- When in doubt — go directly to sars.gov.za yourself. Never follow a link from a message.
Tax season is here. So are the scammers. The best protection is knowing exactly what SARS will never do.
General information only — chat to your accountant about your specific situation.