South Africa’s 2026 filing season is fast approaching, and the October 23 deadline is now less than six weeks away for non‑provisional individual taxpayers. While many are scrambling to complete their returns, cyber‑criminals are exploiting the pressure with a new wave of phishing attacks and counterfeit eFiling portals. Understanding the tactics used by scammers and adopting proven security habits can mean the difference between a smooth filing and a costly data breach.
Why the 2026 filing season is a prime target for scammers
Every tax season, the volume of legitimate communications from the South African Revenue Service (SARS) spikes. This creates an environment where fraudulent messages blend in, especially when they reference refunds, assessments or urgent demands. Kaspersky, a leading cybersecurity firm, has identified a surge in phishing sites that mimic the official SARS eFiling interface. These fake pages request usernames, passwords and even phone numbers, giving criminals direct access to taxpayers’ accounts.
In addition to web‑based lures, the firm has uncovered malicious email attachments masquerading as official documents. Filenames such as “Tax Returns Of RXX, XXX.XXX” or “Final_Assessment_Notification-2026-0X-0X.pdf” are crafted to appear authentic. The accompanying messages often contain phrases like “Refund due” or “SARS letter of demand,” which trigger a sense of urgency and prompt recipients to open the files without verification.
Artificial intelligence – a double‑edged sword
Earlier this year, SARS issued a warning that scammers are now using artificial intelligence (AI) to generate highly polished email templates. AI can produce flawless grammar, correct branding and realistic logos, eroding the traditional visual cues that once helped users spot fraud. As SARS warned for the 2026 filing season, the sophistication of AI‑driven scams means even vigilant taxpayers can be fooled.
AI also poses a risk when taxpayers turn to chatbots for tax advice. While these tools can simplify complex calculations, they often require users to upload sensitive documents – identification, banking details and full tax returns. Kaspersky’s research shows that AI‑generated responses may contain errors, and the data fed into public AI services can be harvested by malicious actors. Chris Norton, Kaspersky’s General Manager for Sub‑Saharan Africa, stresses that a tax return is a comprehensive snapshot of a person’s financial life and should never be shared with untrusted platforms.
Practical steps to stay safe during the filing rush
1. Verify every link. Instead of clicking on a URL embedded in an unexpected email, open a new browser window and manually type www.sars.gov.za or launch the official MobiApp. This ensures you are on the genuine portal.
2. Never disclose credentials. SARS will never request passwords, one‑time PINs, banking PINs or eFiling login details via email, SMS, social media or phone calls. If a message asks for this information, it is almost certainly a scam.
3. Scrutinise attachments. Treat any unsolicited PDF or Word document with suspicion, even if the subject line mentions a refund. Scan the file with updated antivirus software before opening.
4. Limit AI usage for tax matters. If you use a chatbot, feed it only generic queries. Do not upload your tax return, ID copy or bank statements to any AI service unless it is a vetted, secure platform approved by SARS.
5. Allow extra time. Rushing to meet the deadline increases the chance of falling for a scam. Start your return early, double‑check figures, and give yourself a buffer to resolve any technical issues.
What SARS is doing to protect taxpayers
SARS has launched a multi‑channel awareness campaign, reminding South Africans that the agency will only communicate through its official channels. The revenue service also collaborates with cybersecurity firms to takedown fraudulent sites as quickly as possible. In addition, SARS provides a dedicated hotline for reporting suspicious emails or websites.
For those who missed the deadline, SARS offers a short extension for genuine technical failures, but it does not apply to cases where the taxpayer ignored warning signs. The agency’s stance is clear: vigilance now prevents penalties later.
Broader context – why tax compliance matters now more than ever
The South African economy is navigating a period of fiscal tightening, and tax revenue plays a crucial role in funding public services and infrastructure projects. Non‑compliance or delayed filings can lead to additional interest charges, penalties and, in extreme cases, legal action. Moreover, a breach of personal data can have long‑term consequences, including identity theft and fraudulent loan applications.
By staying informed and adopting the security measures outlined above, taxpayers can safeguard their personal information while fulfilling their civic duty. As the 2026 filing season draws to a close, a measured, cautious approach will ensure you file on time without falling victim to cybercrime.
For a reminder of how public scrutiny can revive past controversies, see the recent discussion around the Springbok captain appointment brings 2012 school rugby disciplinary finding back into public view. Just as the sports world learns from its history, taxpayers can learn from past scams to protect themselves this season.
