As South Africa’s 2025 tax season commences, the South African Revenue Service (SARS) has issued a stern warning to taxpayers about a surge in phishing scams impersonating SARS officials via SMS and email. Fraudsters are reportedly sending fake audit notices and requesting personal and banking details to steal refunds.
SARS has reiterated that it never sends links or asks for sensitive information digitally. With tax filings set to begin soon, this alert is critical in protecting millions from falling victim to fraud.
Cybercrime Tactics Targeting Taxpayers
Lucas Molefe, a cybersecurity expert at ESET, highlighted the methods criminals use to exploit taxpayers during this period.
“They know people are expecting communication from SARS about their returns,” Molefe explained. “Their goal is to steal personal and banking information, which they then use to commit fraud.”
How to Spot and Avoid Scams
Molefe shared key tips to help taxpayers stay vigilant:
-
SMS Scams: SARS does not send SMS notifications about tax matters. Any such message should be deleted immediately.
-
Email Red Flags: Fraudulent emails often create a false sense of urgency, demand immediate action, or contain spelling errors.
-
Hover Over Links: Before clicking, hover over any link to see if it leads to a legitimate SARS website. If the URL looks suspicious, do not click.
-
Direct Website Access: Instead of clicking email links, manually type SARS’ official website address to log in securely.
The Growing Threat of AI-Powered Fraud
With cybercriminals increasingly using artificial intelligence (AI) to craft convincing scams, Molefe warned that businesses and individuals must stay informed.
“AI helps scammers create more believable emails, but human vigilance remains the best defense,” he said.
Collaborative Efforts Needed to Combat Cybercrime
Molefe emphasized the importance of cybersecurity awareness training, especially for businesses that communicate via email and social media.
“Companies must invest in employee training because even the best security systems can be bypassed if someone clicks a malicious link,” he noted.
A Call for Stronger Law Enforcement
Despite these warnings, concerns remain over whether South African authorities have sufficient resources to tackle cybercrime effectively.
“Right now, many victims only report incidents to get a case number for insurance claims,” Molefe said. “We need stronger collaboration between law enforcement, businesses, and the public to fight this growing threat.”
As tax season begins, SARS urges taxpayers to remain cautious and report suspicious communications.
Stay alert, stay safe, and file wisely.
For more updates, visit SARS’ official website.