Key Takeaways

Every year, as tax filing season opens, fraudsters use the trusted, familiar SARS name to trick taxpayers into acting quickly at a time when refunds, deadlines and admin are already on people's minds.

This guide is brought to you by Sanlam to help you understand how scammers exploit the SARS tax season and how to protect your money and identity while filing.

Why Does Tax Season Attract So Many Scammers?

Before looking at how to spot a scam, it helps to understand why Filing Season is such a popular target.

According to the TransUnion H1 2026 Update: Top Fraud Trends report, one third (33%) of South African consumers who reported losing money to digital fraud last year, stated their losses came from third-party seller scams on legitimate platforms. The report also notes that criminals are exploiting established trust, active accounts and verified digital relationships, which can make SARS-branded phishing attempts more believable during tax season.

The high volume of genuine SARS contact during Filing Season, such as auto-assessments, refunds and deadline reminders, makes it easier for a fake message to blend in. The promise of a refund, or the fear of a penalty, motivates people to act quickly, which is exactly what scammers rely on.

What Do SARS Tax Scams Usually Look Like?

Common patterns reported each Filing Season include:

Risk warning: SARS has confirmed it will never request passwords, OTPs, banking PINs or eFiling login details by email, SMS, social media or phone, and it does not send links to other websites or .htm/.html attachments. Treat any message asking for these details as not from SARS and verify through official SARS channels.

How Can You Tell a Real SARS Message From a Scam?

Questions to ask before responding to any tax-related message:

It may help to check any unexpected message against SARS's own published list of known scams before responding.

What Is the Bigger Risk — Phishing or Identity Fraud?

The South African Banking Risk Information Centre (SABRIC) has noted that phishing remains one of the largest single contributors to digital banking losses.

However, identity fraud (where your personal details are used without your permission) is also a concern. According to VerifyNow’s 2026 report, identity fraud in South Africa is increasingly AI-driven, with deepfake impersonation, spoofing, and biometric verification attacks becoming the main threats.

Identity fraud can happen when criminals steal or fabricate a person’s personal details, such as an ID number, name, contact information, or banking details, and use them to open accounts, submit false claims, or impersonate the taxpayer. This can be used against taxpayers by producing fraudulent tax returns, redirecting refunds, creating fake employment or income records, or making it harder for the real person to access SARS services and prove their identity.

Risk warning: If scammers obtain enough of your personal information through a tax-season phishing attempt, this can potentially be used well beyond that single message, creating longer-term administrative and financial consequences that requires time and effort to resolve.

What Should You Do if You Think You've Been Targeted or Scammed?

Risk warning: South Africa does not currently have an automatic refund scheme for scam victims. Outcomes are generally assessed case by case, and organisations may treat cases where you shared an OTP or approved a payment yourself as harder to resolve than cases of unauthorised account access. Reporting quickly may improve your options.

Next Steps

This is general information and education only and does not constitute financial advice. For personal recommendations, speak to a licensed financial adviser.