South Africans whose eFiling accounts are hacked still forced to pay SARS

South African taxpayers who claim that their SARS eFiling accounts have been compromised may still face tax bills and penalties if they cannot prove that their accounts were accessed without authorisation.

The Tax Court dismissed a company’s appeal against the disallowance of R6.37 million in input tax deductions after it argued that unknown third parties had used its eFiling profile to submit fraudulent VAT returns.

This is according to Shepstone & Wylie Tax Executive Johan Kotze, who said the case serves as a warning about the evidence required when taxpayers dispute SARS assessments on the grounds of electronic fraud.

The judgment in Taxpayer TQ v CSARS (VAT 2138) was delivered by Mali J on 13 August 2026. It also upheld a 150% understatement penalty imposed by SARS for intentional tax evasion.

The taxpayer was an information technology consulting company that submitted VAT returns for August and October 2017.

The returns claimed input tax deductions totalling R6.37 million. This attracted the taxman’s attention because the company had previously submitted nil returns.

Following this, SARS conducted verification audits and contacted the suppliers named on the supporting tax invoices.

The suppliers denied issuing the invoices or conducting the transactions in question. SARS also found that the company’s bank records did not show payments to the purported suppliers.

SARS classified the conduct as intentional tax evasion. It disallowed the input tax deductions and imposed a 150% understatement penalty.

The company challenged the decision. However, it did not attempt to substantiate the underlying transactions.

Instead, it argued that the returns and supporting documents had been submitted without its knowledge or permission.

According to its director, unknown third parties had compromised the company’s eFiling profile and used it to submit fraudulent refund claims.

The company could give proof

Kotze explained that the company relied partly on evidence that the IP address associated with the submissions originated in Zimbabwe, while its director was in South Africa at the time.

It also argued that its registered email address and telephone numbers were no longer operational, something which potentially exposed the account to unauthorised access.

However, the company did not provide expert information technology evidence establishing that its eFiling profile had been compromised.

SARS called a digital fraud investigator to explain how its eFiling system operates, including password encryption, user identification and access records.

The investigator found no evidence that the company’s password had been compromised. The company’s banking details had also remained unchanged despite the substantial refunds allegedly sought by the fraudsters.

The court considered this important because a criminal attempting to obtain fraudulent refunds would ordinarily be expected to redirect the money to an account under their control.

The company’s failure to provide its laptop for forensic examination also weakened its case.

“A taxpayer may pay another person’s expenses, but that does not mean the taxpayer ‘incurred’ them in the production of its own income,” the court explained.

The court found that the company had failed to prove that the returns were submitted without its authority.

Taxpayers must prove allegations of electronic fraud

The judgment also examined the Electronic Communications and Transactions Act 25 of 2002, which governs the admissibility of electronic evidence.

The court confirmed that section 15 facilitates the admission of electronic evidence but does not remove the need to establish its relevance, authenticity and reliability.

It distinguished between automatically generated electronic records and electronic communications containing statements made by people.

Automatically generated records may constitute real evidence, while communications containing human statements can raise questions about hearsay and documentary evidence.

Where a taxpayer alleges unauthorised access, password compromise or manipulation of an electronic system, appropriate technical evidence may therefore be necessary.

The court also considered section 250(2) of the Tax Administration Act, which provides that a return claiming to have been made or signed by a taxpayer is regarded as duly made unless the taxpayer proves otherwise.

The company’s denial of responsibility was insufficient to overcome this statutory presumption, Kotze said.

The company also argued that SARS had suffered no prejudice because the disputed refunds were never paid.

The court rejected this argument, relying on the Supreme Court of Appeal’s decision in Purlish Holdings v CSARS.

It confirmed that prejudice is not limited to an actual financial loss. The potential payment of an unjustified refund, and the resources SARS spends on investigating and preventing that payment, may also constitute prejudice.

The fact that the taxman’s verification procedures prevented the refunds from being paid did not rule out the imposition of understatement penalties.

The Tax Court dismissed the appeal, confirmed the additional assessments for the 2018, 2019 and 2020 tax years, with interest, and ordered the company to pay SARS’ legal costs, including counsel’s costs.