The South African Revenue Service (SARS) has warned taxpayers that fake eFiling messages are getting harder to tell from the real thing, and that small businesses handling VAT, PAYE and company tax are among the people being targeted this filing season. In the words SARS used, quoted by BusinessTech: “The scammers are now using AI to generate professional-looking email templates that are harder to identify as fraudulent.”
## What the fake messages look like
Older phishing emails tended to give themselves away with clumsy spelling and crude logos. The newer ones, according to a summary of the SARS warning, are written without errors, carry SARS branding and formatting, and use the names of real SARS employees. They quote specific refund amounts, such as R48,900 or R68,652.86, so the figure looks as though it came from SARS systems. A link or PDF attachment then leads to a fake login page built to capture eFiling credentials and banking details.
BusinessTech said the emails and SMS messages typically claim the recipient is owed a refund, often of up to R50,000. The aim is what SARS calls profile hijacking: with stolen personal data, a criminal changes the banking details on a taxpayer’s profile so that a genuine refund is paid into the fraudster’s account. Victims often find out only when the money does not arrive.
IOL’s guide to tax-season scams lists four other formats alongside the fake refund:
– phishing emails and SMS messages with small changes to an address or web link;
, fake settlement notices threatening action over unpaid tax and demanding payment into an unfamiliar account;
, impersonation of SARS officials who ask for identity numbers, tax reference numbers or banking credentials;
, the hijacking of an eFiling profile using stolen personal information.
IOL added that SARS is pre-approved with the banks, so it does not ask for payment through unsolicited messages.
## Why businesses are exposed
The inboundsa summary says the same criminals who go after personal refunds also target business eFiling profiles, VAT refunds and PAYE accounts. It names SME owners, bookkeepers and accountants as prime targets because they handle large transactions and often act quickly on what looks like an official notice. A business’s login can also show VAT and PAYE information covering staff and suppliers, which makes a convincing fake worth the criminal’s effort.
The timing adds pressure. SARS opened the 2026 filing season on 1 July, and auto-assessments went out from 1 to 12 July. According to SAnews, the standard filing window for individuals then ran from 13 July to 23 October 2026, and provisional taxpayers have until 22 January 2027. SARS expected to issue about six million auto-assessments, so a message about a refund or an assessment is what most people expect to receive at this time of year. SARS said refunds on auto-assessments would be processed within 72 hours where the information was complete and accurate, which is why a message promising a refund if you first confirm your details should be checked against your profile, not the link.
## What SARS advises
SARS’s recommendations, as set out in the summaries above, are consistent:
– Do not click links in tax-related emails, SMS or WhatsApp messages. Type www.sars.gov.za into the browser, or use the SARS MobiApp.
, Check your eFiling profile or the app for notifications instead of relying on a message.
, Confirm that genuine correspondence comes from an address ending @sars.gov.za, and treat .htm or .html attachments with suspicion.
, SARS will never ask for passwords, one-time PINs or banking details by email or SMS.
, Use a strong password and multi-factor authentication, and avoid public Wi-Fi when accessing financial information.
## If you have clicked
Forward the message to phishing@sars.gov.za, change your eFiling password at once and switch on multi-factor authentication. IOL adds that victims should contact their bank, SARS and the South African Police Service straight away, and can report the fraud to the Southern African Fraud Prevention Service through its Yima platform.
Related reading: regulatory and policy news, SME and entrepreneurship coverage and markets and finance.
