PROJECT: THE TAX SEASON HEIST - PROTECTING SOUTH AFRICANS FROM SARS IMPERSONATION FRAUD

6 hours ago
7 min read

PLEASE SHARE THIS PUBLIC DOCUMENT

South Africa’s tax season has become a prime hunting ground for cybercriminals.

As millions of citizens engage with the South African Revenue Service (SARS) to fulfil their tax obligations,

a parallel criminal enterprise is working just as hard to steal their money and personal information.

This project outlines the mechanics of SARS impersonation scams, their devastating impact,

and the essential steps taxpayers must take to protect themselves.

THE PROBLEM: A GROWING WAVE OF DECEPTION AND THEFT:

SARS impersonation fraud is a sophisticated and opportunistic crime.
Fraudsters exploit the annual tax filing season to target taxpayers with a range of deceptive tactics aimed at stealing banking details, login credentials, and ultimately, hard-earned money.
The illicit practice has created a parallel criminal economy that:
- DEVASTATES INDIVIDUALS:
  - Victims lose significant sums, often their entire tax refunds, leading to financial hardship and emotional distress. In one case, a 68-year-old taxpayer lost R37,000 when his refund was redirected to a fraudulent account.
- DRIVES UP CRIME STATISTICS:
  - These scams significantly contribute to the country’s escalating fraud statistics, placing a substantial burden on law enforcement and the judicial system.
- ERODES TRUST IN INSTITUTIONS:
  - These scams undermine public confidence in SARS and the broader financial system, making taxpayers fearful and hesitant.
- FUELS CRIMINAL NETWORKS:
  - The proceeds from these scams are often used to fuel further criminal activities, including sophisticated identity theft and profile hijacking.

KEY DETAILS OF THE CRISIS:

THE CORE ISSUE:
- Fraudsters impersonate SARS officials to gain access to victims’ personal and financial information through:
  - PHISHING (EMAIL & SMS):
    - Sending fake messages that appear to be from SARS, often containing links to fraudulent websites.
  - VISHING (VOICE PHISHING):
    - Making unsolicited phone calls, claiming to be from SARS to extract sensitive information like one-time pins (OTPs).
  - SOCIAL ENGINEERING:
    - Creating a sense of urgency or panic, such as claiming a taxpayer owes money or is due a refund, to pressure them into acting without thinking.
  - eFILING PROFILE HIJACKING:
    - Using stolen personal information to gain access to a taxpayer’s legitimate eFiling profile and change banking details to redirect refunds.
THE SCALE:
- The problem is widespread and escalating.
- The 2026 tax season has seen a surge in these scams, with criminals using Artificial Intelligence (AI) to generate more convincing and professional-looking fraudulent emails and SMSs.

THE MECHANICS OF THE SCAMS:

Criminals employ a range of tactics.

Here are the most common ones to watch out for:

The Fake Settlement Notification:
- A victim receives an email or SMS claiming they owe SARS a specific, urgent amount of money.
- The message includes payment instructions to a fraudulent bank account.
The Fake Refund SMS:
- The victim is told they are due a tax refund and are directed to click a link to “verify their details” or “link their credit card” to receive it.
- The link leads to a fake website designed to harvest personal and banking information.
The Fake Letter of Demand:
- A more threatening message claims SARS has issued a court summons or that blacklisting is imminent.
- It contains a link or attachment that leads to a phishing site.
The Fake Auto-Assessment or Compliance Notice:
- The victim is prompted to confirm their compliance status or banking details via a link in the message, which takes them to a proxy website that mimics the official SARS eFiling interface.

THE HUMAN COST: A CRIME OF VIOLATION

The consequences of this fraud are deeply personal and extend far beyond a financial loss.

A Case Study: The Hijacked Refund
- A common and devastating outcome is eFiling profile hijacking.
- In one case, a 68-year-old taxpayer was the victim of a sophisticated scheme.
- Fraudsters used his stolen personal information to open a bogus bank account in his name.
- When he filed his return, his legitimate refund of R37,000 was paid into the fraudulent account instead of his own, leaving him with nothing and a long, difficult battle to prove what had happened.
- This story illustrates how ordinary citizens are being targeted by criminal networks that exploit their trust and the digital systems designed for convenience.

KEY CHALLENGES:

AI-GENERATED SCAMS:
- Fraudsters are using AI to create highly realistic emails and SMSs that are difficult to distinguish from official SARS communications.
SOPHISTICATED SOCIAL ENGINEERING:
- Scammers are skilled at manipulating human psychology to bypass security measures.
SPOOFING TECHNOLOGY:
- Criminals can make phone numbers and email addresses appear legitimate, making it difficult for victims to distinguish a real call from a scam.
eFILING PROFILE HIJACKING:
- Criminals take control of legitimate taxpayer profiles, redirecting refunds without the victim’s knowledge.
UNDER-REPORTING:
- Many cases go unreported, meaning the true scale of the problem is likely much larger than the official statistics suggest.

WHAT IS BEING DONE & RECENT PROGRESS:

LAW ENFORCEMENT ACTIONS:
- While specific arrests are less publicised, prosecutions are possible, demonstrating that this crime is being taken seriously.
CONSUMER ALERTS:
- Organisations like the Southern African Fraud Prevention Service (SAFPS) are actively warning the public about the rise in these scams and advising on prevention.
SARS INITIATIVES:
- SARS has an IT Security team to investigate phishing attempts and maintains a “Scams and Phishing” webpage to educate the public.
MEDIA AWARENESS:
- Publications like The Citizen, BusinessTech, and Daily Maverick are playing a crucial role in reporting on these scams and sharing victim stories.

HOW CAN YOU HELP?

1. BE INFORMED & VIGILANT:

GOLDEN RULES FROM SARS:

SARS will :

NEVER ask for your password, one-time PIN (OTP), banking PIN, or credit card details via email, SMS, or phone.
NEVER send you hyperlinks to other websites, including those of banks.
NEVER ask you to verify your banking details or pay money into an account provided in an email or SMS. All official payments go through eFiling or the SARS payment portal.

2. VERIFY INDEPENDENTLY:

If you receive a communication claiming to be from SARS:

Do not click on any links or open attachments.
Do not use any contact details provided in the message.
Verify the sender’s email address:
- Official SARS correspondence comes from an @sars.gov.za domain. Be wary of spoofed addresses like returns@sars.co.za.
Log in directly to your official SARS eFiling profile or the SARS MobiApp to check the status of your tax affairs.

3. REPORT SUSPICIOUS ACTIVITY:

If you suspect you have been a target or a victim of this scam:

Immediately forward suspicious emails to the SARS IT Security team.
Report the crime to your local South African Police Service station.
Contact the Southern African Fraud Prevention Service to place a protective registration against your identity.
If your eFiling profile has been compromised, immediately notify your bank and SARS.

4. SHARE RESPONSIBLY:

Talk to family, friends, and colleagues about these scams.
Awareness is the most powerful defence.
Use social media to share factual information from official sources like SARS and SAFPS.

5. ADVOCATE FOR REFORM:

Support measures that call for stronger penalties for fraudsters.
Encourage SARS to provide more proactive and clearer warnings to customers about these specific scams.
Stay informed. Be sceptical. Verify. Report fraud. Protect your finances.

SOURCES:

This project was compiled using the following source document:

A public awareness document containing reporting by Tarryn-Leigh Solomons, published in August 2026, which detailed the surge in SARS impersonation scams, the tactics used by fraudsters, and official warnings from the Southern African Fraud Prevention Service (SAFPS) and SARS.

RELEVANT SSS PROJECTS:

Specialised Security Services invites the public to the Mike Bolhuis Daily Projects WhatsApp Channel.

This channel is important in delivering insights into the latest crime trends, awareness, warnings and the exposure of criminals.

How to Join the WhatsApp Channel:

1. Make sure you have the latest version of WhatsApp on your device.

2. Click on the link below to join the Mike Bolhuis Daily Projects WhatsApp Channel:

- https://whatsapp.com/channel/0029VarjftF8PgsI4pODE929

3. Follow the prompts to join the channel.

4. Make sure you click on "Follow", then click on the "bell"-icon (🔔)

CONTACT MR MIKE BOLHUIS FOR SAFETY AND SECURITY MEASURES, PROTECTION, OR AN INVESTIGATION IF NEEDED.

ALL INFORMATION RECEIVED WILL BE TREATED IN THE STRICTEST CONFIDENTIALITY AND EVERY IDENTITY WILL BE PROTECTED.

Regards,

Mike Bolhuis

Specialist Investigators into

Serious Violent, Serious Economic Crimes & Serious Cybercrimes

PSIRA Reg. 1590364/421949

Mobile: +27 82 447 6116

E-mail: mike@mikebolhuis.co.za

Fax: 086 585 4924

Follow us on Facebook to view our projects -

https://www.facebook.com/MikeBolhuisOfficial

EXTREMELY IMPORTANT: All potential clients need to be aware that owing to the nature of our work as specialist investigators there are people who have been caught on the wrong side of the law - who are trying to discredit me - Mike Bolhuis and my organisation Specialised Security Services - to get themselves off the hook. This retaliation happens on social media and creates doubt about our integrity and ability. Doubt created on social media platforms is both unwarranted and untrue. We strongly recommend that you make up your minds concerning me and our organisation only after considering all the factual information - to the exclusion of hearsay and assumptions. Furthermore, you are welcome to address your concerns directly with me should you still be unsatisfied with your conclusions. While the internet provides a lot of valuable information, it is also a platform that distributes a lot of false information. The distribution of false information, fake news, slander and hate speech constitutes a crime that can be prosecuted by law. Your own research discretion and discernment are imperative when choosing what and what not to believe.

STANDARD RULES APPLY: Upon appointment, we require a formal mandate with detailed instructions. Please take note that should you not make use of our services – you may not under any circumstance use my name or the name of my organisation as a means to achieve whatever end.

POPI ACT 4 of 2013 South Africa: Mike Bolhuis' "Specialised Security Services" falls under Section 6 of the act. Read more here: https://mikebh.link/fntdpv

SSS TASK TEAM:

https://mikebh.link/2fkmx6

Our mailing address is:

Mike Bolhuis Specialised Security Services

PO Box 15075 Lynn East

Pretoria, Gauteng 0039

South Africa

Add us to your address book

THIS PUBLIC DOCUMENT WAS INTENDED TO BE SHARED, PLEASE DO SO.