SARS scams in tax season: how to spot them and what to do

Every filing season, criminals send messages that look like they come from the South African Revenue Service (SARS): refund notices, debt threats, court summonses and links to fake eFiling pages. SARS's own rule is the quickest test. It will never ask for your password, one-time PIN (OTP), banking PIN or eFiling login by email, SMS, social media or phone. If a message asks for any of those, or pushes you to a link to "fix" your tax, it is a scam. Go to eFiling or the SARS MobiApp yourself instead.

Why scams peak in filing season

SARS says plainly that in the run-up to filing season scammers try to copy what it does. The timing works for them. Millions of people are waiting for an assessment or a refund, and a message about either is expected rather than strange.

Filing season dates (2026)

Source: the SARS Tax Season page, as at 19 October 2026.

SARS's list of scam samples shows that fake SARS messages arrive all year, not only in these months.

What SARS says it will never do

From SARS's own scams and phishing pages:

• It will never ask for passwords, OTPs, banking PINs or eFiling login details by email, SMS, social media or phone.
• It will never ask for banking details by post, email or SMS.
• It does not send links to other websites, not even to banks, and does not send attachments ending in .htm or .html.
• It never asks for credit card details.
• It will not give you a bank account to pay into in a WhatsApp message or a letter.

SARS does contact taxpayers by SMS, email, WhatsApp and phone, for example about an auto-assessment. So a message from "SARS" is not a scam just because it arrived. What gives a scam away is what it asks you to do. SARS lists its genuine current campaigns on its Current Surveys, SMSs and Emails page.

The lures SARS has seen

SARS publishes numbered samples of scams it has seen. Recent ones include:

• Refund bait. "Complete this form to receive your refund", with a link to a fake form that collects your banking details.
• Fake assessments. A forged notice of assessment (ITA34) that carries a bank account for "payment".
• Threats. A letter of demand or a High Court summons from "SARS Attorneys", with a short deadline to pay.
• Help with your auto-assessment. Someone offering to change your auto-assessment or guaranteeing a bigger refund.
• Fake eFiling pages. A link to a login page that looks like eFiling and captures your username and password.
• Calls from "SARS". A caller claiming to be from SARS, or a customs inspector, asking for details or payment.
• Unregistered tax practitioners. People who charge to file for you without being registered.

If you agree with your auto-assessment, SARS says you do not need to do anything. There is nothing to "accept" and no form to send back. A message asking you to accept it by clicking a link is a scam.

How to check a message

1. Do not click links or open attachments in the message. Open eFiling or the SARS MobiApp yourself, from a bookmark or by typing the address.
2. Look at your correspondence there. Real assessments, debts and letters are on your eFiling profile. If it is not there, treat the message as fake.
3. Pay only through eFiling, the MobiApp or your bank, using the payment reference from your own SARS statement. Never pay into an account given in a message.
4. Check the real sender address, not only the display name. A name such as "SARS eFiling" can be put on any address.
5. Check a tax practitioner before you hire one. Anyone who charges for tax services must be registered with a recognised controlling body and with SARS. You can check on the SARS Tax Practitioner Query. SARS points out that you remain responsible for your return even if someone else submits it.
6. Confirm a caller. SARS gives 012 422 7435 to check that a caller is a SARS employee.

Secure your eFiling profile

SARS has added protection to eFiling over the last two years:

• Two-factor sign-in is required on individual eFiling profiles. In 2026 a login can be approved with a notification on the SARS MobiApp.
• Changes to banking details are confirmed with an OTP, and SARS checks the account with the bank before paying a refund.

Your part is to keep the contact details on your profile current, so the OTPs reach you, and to use a password for eFiling that you use nowhere else. A password manager makes that easy. Never read an OTP out to anyone, whoever they say they are.

If you clicked, paid or gave details

Act quickly, in this order:

1. Your bank. If you shared banking details, card details or an OTP, call your bank straight away. The South African Banking Risk Information Centre (SABRIC) also advises opening a case with the South African Police Service (SAPS) and getting a case number.
2. Your eFiling profile. If you entered your login on a fake page, change the password from a device you trust. If the profile shows changes you did not make, report it to SARS through its online digital fraud form or book a branch visit.
3. SARS. Report the message to [email protected] or the SARS Fraud and Anti-Corruption Hotline on 0800 00 2870.
4. Your identity. If you think your ID number is being used, SARS says to notify it, report it to the police and close affected bank accounts. The Southern African Fraud Prevention Service (SAFPS) offers free Protective Registration, which flags your ID number so credit providers take extra care before opening accounts in your name.
5. Your computer. If you downloaded a file from the message, assume the computer may be infected. Our article Saved passwords, stolen in seconds explains how to clean it and change passwords in the right order.

SABRIC reports that losses to digital banking fraud in South Africa rose to about R2.4 billion in 2025, and that most of it came from tricking people rather than attacking bank systems. Tax scams are one of the oldest versions of that trick.

For tax practitioners and businesses

Accountants and tax practices are targets twice over: criminals impersonate SARS to them, and impersonate them to their clients.

• Filter mail before it reaches people. Most fake SARS messages can be caught by spam and phishing filtering before anyone sees them.
• Protect your own domain. SARS already publishes a strict email authentication policy for sars.gov.za, which tells receiving servers to reject mail that falsely claims to be from it. You can do the same for your practice's domain with SPF, DKIM and DMARC records, so that mail pretending to be from your address is refused.
• Send tax documents encrypted. An IRP5, a bank statement or a copy of an ID sent as a plain attachment sits readable in every mailbox it reaches. OpenPGP encryption keeps it readable only by the person it is meant for. Our guide Why and how to encrypt your email with OpenPGP explains how.

Our help article How to identify spam and phishing emails covers the signs to look for in any message.

Where Noiz fits

Every Noiz shared hosting plan includes webmail with spam filtering. The Email Security add-on goes further for a domain hosted with Noiz: advanced spam and virus filtering, and SPF, DKIM and DMARC kept configured so criminals cannot easily pass mail off as yours. For an organisation that wants mail on a server of its own, with two-factor sign-in for users, Noiz runs Private Email, quoted per deployment.

If your practice sends and receives tax documents every season, add Email Security to your domain from the console.

Sources

• SARS, Scams and phishing: https://www.sars.gov.za/targeting-tax-crime/scams-and-phishing/
• SARS, Tax Season (updated 21 September 2026): https://www.sars.gov.za/types-of-tax/personal-income-tax/filing-season/
• SARS media release, 18 June 2026: https://www.sars.gov.za/media-release/sars-rolls-out-phased-filing-season-urges-taxpayers-to-wait-their-turn/
• SARS media release, 2 July 2026: https://www.sars.gov.za/media-release/sars-unveils-smarter-simpler-more-secure-filing-season-experience-for-taxpayers/
• SARS media release, 7 September 2026 (trusts): https://www.sars.gov.za/media-release/trust-filing-season-set-to-open/
• SARS, WhatsApp debt FAQ (updated 4 August 2026): https://www.sars.gov.za/faq/i-have-received-a-whatsapp-from-sars-regarding-debt-owed-how-do-i-know-its-a-legitimate-whatsapp-and-not-a-scam/
• SARS, Current surveys, SMSs and emails: https://www.sars.gov.za/contact-us/current-surveys-smss-and-emails/
• SARS, Identity fraud: https://www.sars.gov.za/targeting-tax-crime/identity-fraud/
• SARS, Compromised eFiling profile: https://www.sars.gov.za/targeting-tax-crime/compromised-efiling-profile/
• SARS, two-factor authentication and eFiling password criteria (22 November 2024): https://www.sars.gov.za/latest-news/enhancements-to-the-two-factor-authentication-and-efiling-password-criteria/
• SARS, Filing Season 2026 leaflet: https://www.sars.gov.za/wp-content/uploads/Docs/TaxSeason/TaxSeason2026/Filing-Season-2026-Leaflet.pdf
• SARS, eFiling features: https://www.sars.gov.za/about/sars-tax-and-customs-system/efiling-features/
• SARS, Controlling bodies for tax practitioners: https://www.sars.gov.za/tax-practitioners/controlling-bodies-for-tax-practitioners/
• SARS scam samples, for example SARS-SCAM-400 (2 September 2026): https://www.sars.gov.za/sars-scam-400-the-high-court-summon-2-september-2026_/
• SABRIC, How to stay safe: https://www.sabric.co.za/how-to-stay-safe/
• SABRIC, Annual Crime Statistics 2025: https://www.sabric.co.za/wp-content/uploads/2026/08/SABRIC-Annual-Crime-Statistics-Report-2025.pdf
• SAFPS, Protective Registration: https://www.safps.org.za/Home/OurServices_ApplyProtectiveRegistration

Note: while some of this content was produced with the help of AI, the final editing has been done by a real human being.