South African taxpayers losing millions from SARS fraud

The Southern African Fraud Prevention Service (SAFPS) warned that scammers are increasingly impersonating SARS and using tactics to steal personal data and funds.

While the tax filing season is a time of economic alignment and fiscal responsibility, it is also a prime opportunity for cybercriminals to exploit unsuspecting taxpayers.

With SARS introducing pre-assessments to simplify submissions for taxpayers, fraudsters and scammers are capitalising on this convenience to craft sophisticated scams that mimic official communications.

The SAFPS warned that the public needs to be vigilant to navigate this heightened activity from fraudsters.

“Fraudsters are exceptionally active during this period, and taxpayers must stay alert to the latest tactics being used to steal personal data and funds,” said SAFPS CEO Manie van Schalkwyk.

“Scammers impersonate SARS officials and persuade and manipulate victims into voluntarily surrendering sensitive data under false pretences or into paying them money. There are a few scam tactics that the public should be aware of to protect themselves.”

Van Schalkwyk warned that the first, phishing emails and SMSs, are becoming increasingly sophisticated and realistic.

“Our brains are conditioned to gloss over subtle differences unless we’re actively scanning for them. This is exactly what makes these tactics so dangerous.”

Scammers will send messages from a fake SARS email address containing a link to a fraudulent website.

Often, they will change a single character in the hyperlink, like replacing South Africa with South Afrìca, using a special character that looks similar to the original.

They could ask taxpayers to verify their banking details or personal information, claim that they are due a refund, or even claim that they are auditing their refund.

They could then redirect victims to a malicious website, potentially compromising their device and stealing their personal information.

“The email may say it’s from SARS and look realistic; however, if you look at the actual email address, it is not an official SARS email address.”

“Scammers can change the display name to appear as SARS, and if you are not concentrating, you could click on the link or action the request due to fear.”

Van Schalkwyk urged consumers to examine the sender’s email address carefully. If it does not include @SARS.gov.za, it is likely a scam.

Taxpayers losing thousands

Another growing tactic is direct scam attempts, where scammers initiate contact by impersonating SARS representatives. Scammers claim to want to help taxpayers with their tax returns and follow up on payments or refunds.

They often create a sense of panic by warning consumers that there is a problem, that their tax status needs urgent attention, or that they are subject to fines for incorrect submissions.

Fraudsters then offer to lend a helping hand if the consumer provides them with their tax or ID number. “It is important to note that an official SARS representative will never ask for this information,” Van Schalkwyk said.

Scammers also use eFiling profile hijacking to defraud taxpayers. This is when fraudsters take over existing profiles or impersonate a valid taxpayer’s profile.

They then change banking or other details to redirect refunds to fraudulent bank accounts, which have been set up for this purpose.

This emerging trend indicates a sophisticated form of identity theft, where criminals exploit personal data, often gathered during legitimate interactions with SARS, to open bogus accounts and intercept refund payments.

Van Schalkwyk said that in one case, a 68-year-old taxpayer lost R37,000 after his refund was paid into a bank account fraudulently created under his name. Despite submitting his real bank details during his filing appointment, the payment was rerouted.

Similar cases have surfaced involving other banks where victims reported that substantial refunds were paid into unfamiliar accounts using stolen credentials.

Finally, Van Schalkwyk said that taxpayers should also be wary of fraudulent letters of demand. The SARS website shares examples of fraudulent letters claiming that SARS attorneys have issued a letter of demand which requires urgent attention.

The letter prompts the taxpayer to pay an outstanding amount of money into a fraudulent bank account, claiming to be a SARS account.

Staying safe during tax season

“Proactive awareness is the strongest defence against digital fraud during this critical financial period,” Van Schalkwyk said.

The SAFPS shared some tips consumers can use to protect themselves from scams during tax season:

• Do not share eFiling usernames or passwords.
• Do not share sensitive information: SARS will never ask for information like your banking details, pin, or card info via email or SMS.
• Verify and check payment details: Pay via the eFiling profile or check the payment options on the official SARS webpage. SARS is a pre-approved beneficiary with all the banks. So, if a letter asks someone to load banking details, these are fraudulent. Do not make payments to accounts provided via unsolicited communication.
• Use official SARS channels: Do not click on links in SMSs, emails, or WhatsApp. Visit the SARS website and utilise formal channels only. If in doubt, contact SARS directly to verify.
• Implement robust cybersecurity practices: Use strong and unique passwords, avoid public Wi-Fi when working with sensitive information, and implement multi-factor authentication where possible.
• Be wary of a sense of urgency or pressure: In general, be cautious when there is a sense of urgency, or the person or communication is trying to intimidate you or illicit a sense of fear.

Anyone who suspects their refund has been compromised must immediately contact their bank, report the incident to SARS, and open a case with the South African Police Service.

Victims can also report the incident to the SAFPS using the www.yima.org.za website. Van Schalkwyk explained that the SAFPS launched Yima in response to the growing need for a proactive approach to fraud prevention.

“Through Yima, South Africans can report suspicious activity directly to the SAFPS. The intelligence gathered is shared with law enforcement, strengthening fraud investigations.”

“Additionally, users can access a dedicated scam hotline, enabling direct reporting to banks and the South African Police Service.”

The SAFPS also provides protection for individuals against identity theft through Protective Registration and victim support through fraud victim listings on the SAFPS database.
These services are provided at no cost to the individual.

“All of these products and services actively take the fight to fraudsters, reinforcing consumer protection and shaping a more secure financial landscape.”