SARS eFiling fraud warning for South Africans

As the 2026 tax-filing deadline approaches, South Africans are facing increasingly convincing phishing scams, fake eFiling sites and risks to their personal information.

There are currently fewer than six weeks remaining before the 23 October filing deadline for non-provisional individual taxpayers.

With SARS urging taxpayers not to leave filing until the last minute, many South Africans are turning their attention to outstanding tax returns.

For many taxpayers, this period is characterised by a feeling of pressure as they move against the clock to avoid getting in trouble with the taxman.

The approaching deadline creates the perfect condition for scammers to take advantage of South African taxpayers.

Kaspersky researchers identified phishing websites that imitate SARS eFiling and malicious email attachments disguised as tax-related documents.

One fake eFiling page asks victims for their username, password and phone number, while another uses what appears to be an Adobe PDF sign-in screen to request email credentials.

Kaspersky researchers also picked up attachments with filenames such as “Tax Returns Of RXX,XXX.XXX” and “Final_Assessment_Notification-2026-0X-0X.pdf”.

The emails often use phrases like “Refund due” or “SARS Letter of demand”, which gives people a reason to open the file before stopping to check where it came from.

“By this point in the tax season, people are used to receiving messages about returns, assessments and refunds,” said Kaspersky’s General Manager for Sub-Saharan Africa, Chris Norton.

“So, an email like this may not immediately look out of place. That is what scammers rely on. The closer we get to the deadline, the easier it is to act quickly because you think you are dealing with something that needs your attention.”

In July, SARS also warned that scammers were using AI to create professional-looking email templates that are harder to identify as fraudulent.

The warning followed a new wave of SMS and email scams claiming that taxpayers were owed refunds and directing them to fraudulent websites.

That means some of the old visual clues, including awkward wording or amateur-looking correspondence, no longer have the same impact. A message can look professional and still be fraudulent.

Taxpayers land themselves in trouble with SARS

The 2026 filing season has also seen a new AI-related risk popping up. Many people are turning to chatbots and other AI tools for help understanding their returns or working through tax questions.

However, Kaspersky warned that tax documents contain highly sensitive personal and financial information.

Uploading tax records, identification documents, banking information or other confidential data to an AI service can create unnecessary exposure.

“AI can make complicated information easier to work through, but taxpayers should be careful about the information they provide to an external service,” Norton said.

“A tax return contains a detailed picture of someone’s financial and personal life. Sensitive records should stay out of public AI tools, and important tax information should be checked through trusted sources.”

On top of this, AI-generated responses can also contain errors, which means that South Africans are putting themselves at risk for results which could potentially get them in trouble with SARS.

One of the simplest protections taxpayers have is simply removing the urgency from the interaction, the organisation explained.

Instead of following a link in an unexpected tax message, access SARS eFiling or the MobiApp directly and check whether the communication is reflected there.

SARS has said it will never request passwords, one-time PINs, banking PINs or eFiling login credentials through email, SMS, social media, or telephone.

“The closer the deadline gets, the more tempting it can be to deal with a tax message immediately,” Norton added.

“Taking a few minutes to verify it through an official channel can be the difference between completing your return successfully and handing valuable information to a scammer.”