SARS eFiling Scams Are Becoming Harder to Spot – What Taxpayers Need to Know

South African taxpayers have become accustomed to scam emails and SMS messages pretending to be from SARS. In the past, many of these were fairly easy to identify: poor spelling, strange email addresses, badly designed logos or suspicious-looking websites were usually enough to raise alarm bells.

Unfortunately, that is changing very quickly.

Fraudsters are increasingly using artificial intelligence and other technology to create highly professional emails, documents and websites that closely resemble genuine SARS correspondence. In some cases, fake eFiling pages can look almost identical to the real SARS website.

For us as an accounting practice, this is concerning because taxpayers naturally take communication from SARS seriously. An email saying that you have an outstanding tax liability, that legal action is being taken against you, or perhaps more tempting that you have a large tax refund waiting for you can create an immediate sense of urgency.

That urgency is exactly what the scammers are relying on.

A professional-looking SARS email may still be fake

Cybersecurity specialists have identified fraudulent SARS eFiling pages designed to capture taxpayers' usernames, passwords and cellphone numbers. Other scams imitate familiar services such as PDF or document login screens and attempt to obtain email usernames and passwords.

The important lesson is that appearance is no longer a reliable way of deciding whether something is genuine.

Artificial intelligence allows criminals to produce well-written correspondence with convincing SARS branding, professional formatting and language that sounds very similar to legitimate tax communication. The days of assuming that a badly written email is a scam and a professional-looking email is genuine are unfortunately behind us.

SARS itself has previously warned taxpayers about fraudulent messages claiming that refunds are available, tax payments are outstanding, or serious action will follow unless the taxpayer responds.

Be especially careful when money is involved

One of the most common approaches is a message informing you that SARS owes you a refund and asking you to follow a link to claim it. Another is designed to frighten taxpayers by referring to outstanding taxes, penalties, tax evasion or possible legal proceedings.

Our advice to clients is simple: do not allow the urgency of the message to determine your response.

If you receive unexpected SARS correspondence, particularly where it asks you to click a link, provide banking information, enter an eFiling password or make an urgent payment, rather verify it before doing anything.

Where MJB Professional Accountants is your registered tax practitioner, send the correspondence to our office and allow us to check your SARS profile and confirm whether the communication is legitimate.

A genuine tax liability, assessment or refund should ultimately be capable of being verified through the appropriate SARS channels. You do not need to rely solely on a link contained in an email or SMS.

Your tax information should also be treated carefully

There is another side to this issue which is becoming increasingly important: the amount of personal information taxpayers share electronically.

Tax returns and supporting documents can contain ID numbers, addresses, bank account details, income information, investment information, company records and other highly confidential financial information. This information should be handled with the same care as your online banking information.

The growing popularity of public AI and chatbot services has created another potential area of exposure. While these tools can be extremely useful for explaining complicated information, taxpayers should think carefully before uploading complete tax returns, identity documents, bank statements or other confidential records to an external online service.

Technology can be enormously useful, but convenience should never come at the expense of protecting sensitive financial information.

When in doubt, ask us first

As your accountants and tax practitioners, we would much rather have a client forward us a suspicious email that turns out to be genuine than discover afterwards that banking details, passwords or personal information have been provided to a criminal.

If something from “SARS” feels unusual, unexpectedly promises you money, threatens immediate action, or asks you to log in through a link, do not rush to respond.

Send it to us first.

At MJB Professional Accountants, we deal with SARS correspondence and taxpayer profiles on a daily basis and can assist our clients in determining whether correspondence is legitimate and what action, if any, needs to be taken.

As scams become more sophisticated, being cautious is no longer about spotting bad spelling or a strange-looking logo. It is about verifying before you act.

Protect your eFiling details. Protect your personal information. And when you are unsure, speak to your accountant before clicking.