SARS fraud warning for South Africans

With tax fraud on the rise, SARS warned South Africans about a new phishing scam that impersonates SARS employees via email.

On 22 July 2026, the South African Revenue Service (SARS) issued an alert warning taxpayers to be aware of emails circulating that appear to be from one of their employees.

“Please don’t open the PDF attached to the email or click on the link in the PDF, as it is a fraudulent phishing link designed to extract personal details from you to be used in a scam,” SARS said.

With the 2026 tax season now in full swing, with auto-assessments having commenced on 1 July, a new wave of fraudulent attempts has hit South Africans.

Speaking on Kaya Biz earlier this year, Esset South Africa cybersecurity expert Lucas Molefe explained that tax season has effectively become “hunting season” for online criminals.

He warned that scammers are increasingly using phishing emails, SMSs and WhatsApp messages to steal taxpayers’ personal and financial information.

The rise of artificial intelligence has made these scams harder to identify. Fraudsters can now create convincing messages that closely resemble legitimate SARS communications.

With the taxman expanding its digital services, South African taxpayers are more likely to receive legitimate tax-related messages.

This means it is more important than ever for taxpayers to distinguish official communication from sophisticated scams.

Molefe said taxpayers should understand how SARS normally communicates and be wary of messages that create urgency around refunds, audits or outstanding payments.

SARS generally directs taxpayers to use secure platforms such as eFiling, its website, or official mobile application, rather than asking them to provide sensitive information via email or SMS.

Molefe cautioned that scammers rely heavily on psychological pressure. They are encouraging victims to react quickly before they have time to question whether a message is genuine.

To avoid these scams, he said taxpayers should slow down and verify suspicious communication through official SARS channels before clicking links or sharing login details.

Other tax scams on the rise

Beyond fake auto-assessment messages, South Africans are also being targeted by a range of scams designed to exploit concerns about tax debts, refunds and compliance.

One increasingly common tactic involves fake SARS “final demand” letters, which can closely resemble genuine notices.

Tax Consulting SA tax attorney Junaid Bhayla previously said legitimate final demands typically follow earlier communication about an outstanding tax liability and give taxpayers 10 business days to respond.

Fake letters, by contrast, may demand payment within 24 hours, omit key taxpayer details or direct recipients to suspicious payment channels.

Another scam involves fraudulent “Process Quote Letter” emails. SARS has warned that these messages use subject lines such as “PROCESS QUOTE LETTER”.

These communications contain links to phishing websites that ask recipients to provide personal information, which the scammer later exploits.

Fraudsters have also circulated fake eFiling statements, payment notifications and other documents designed to appear official.

Scammers are becoming increasingly sophisticated in their imitation of SARS. Fraudulent emails may use sender names that appear legitimate.

Fake website addresses can also closely resemble the real SARS domain. In some cases, criminals use subtle changes to letters or characters in website addresses to make fraudulent links harder to identify.

The Southern African Fraud Prevention Service has warned that victims may be manipulated into voluntarily handing over sensitive information or transferring money.

Capitec has also previously cautioned that criminals may threaten taxpayers with penalties for unpaid tax or claim that a refund is waiting to be collected.

Taxpayers should never ignore a genuine SARS demand, but they should verify suspicious correspondence before taking action.

The safest approach is to log into the official eFiling platform directly, rather than using links provided in messages, and confirm whether the communication appears on their profile.

If a taxpayer suspects they have been the target of a phishing attempt, it should be reported to the South African Revenue Service.