Few emails get opened as quickly as one that appears to come from SARS. A refund waiting, a penalty due, an "urgent verification" of your eFiling profile: criminals know that South Africans take tax messages seriously, and they use that against you.

For small businesses, the risk is bigger than one person's tax return. A single click on a fake SARS email can hand over your eFiling credentials, install malware on a work computer, or open the door to invoice and banking-detail fraud against your clients. This guide shows you how to spot these emails and what to do if someone falls for one.

Why SARS scams work so well

  • Authority. Nobody wants trouble with SARS, so people act first and think later.
  • Timing. Scams spike around filing season and payment deadlines, when inboxes are full of genuine SARS mail and everyone is rushed.
  • Money. "You have a refund of R4,872.13" is hard to ignore. So is "you have an outstanding penalty".
  • Realistic branding. Logos, colours and wording are copied from real SARS communication. Some fake emails are almost perfect.

Seven warning signs

1. It asks for banking details, passwords or OTPs

SARS has warned many times that it does not ask for banking details, passwords or one-time PINs by email or SMS. Any message that does is a scam, no matter how official it looks.

2. It contains a link to "log in" or "verify"

Be very suspicious of any SARS email or SMS with a link you're meant to click to log in, claim a refund or update details. The safe habit: never use the link. Type sars.gov.za into your browser yourself, or open the SARS MobiApp, and log in from there.

3. The sender's address is slightly off

Look at the actual email address, not just the display name. Scammers use addresses like sars-refunds@..., free email services, or domains that are almost right. A real-looking name can hide a fake address, so tap or hover on it to see the full address.

4. There's an attachment you didn't expect

Fake "tax certificates", "statements" or "assessments" sent as attachments are a favourite way to deliver malware, especially ZIP files, HTML files, or Office documents that ask you to "enable content" or "enable macros". If you weren't expecting it, don't open it.

5. It creates urgency or fear

"Your account will be suspended within 24 hours." "Legal action will follow." Pressure is a tactic. Real SARS processes have deadlines, but they don't threaten you through an email link.

6. The refund is too good, or too precise

Unexpected refund notifications, especially with odd amounts designed to look genuine, are one of the oldest SARS scams. Check your real status by logging in to eFiling yourself.

7. Small mistakes in language or layout

Spelling errors, strange greetings ("Dear Taxpayer", "Dear Customer"), mismatched fonts or a SARS logo that looks slightly stretched are all red flags. That said, don't rely on this alone; many scams are now well written.

The business-specific risks

For a business, fake SARS emails lead to more than a stolen refund:

  • Stolen eFiling access. Criminals with your company's or practice's eFiling credentials can change banking details or submit fraudulent returns.
  • Malware on a work computer. One infected laptop can lead to password theft, ransomware or a full-blown data breach, with POPIA notification duties if personal information is involved.
  • Email account takeover. Some scams lead to a fake Microsoft 365 or Google login page. Once attackers control a mailbox, they can send fake invoices or "new banking details" to your clients from your real address.
  • Accounting practices are prime targets. Firms that manage eFiling for many clients hold the keys to dozens of profiles at once. If that's you, see our page on cybersecurity for accounting firms.

What to do if someone clicks

Make it easy for staff to own up quickly. The first hour matters far more than who made the mistake.

  1. Don't panic, and don't ignore it. Tell your IT support or whoever looks after your systems straight away.
  2. If they entered a password, change it immediately from a different, trusted device, along with any other account that used the same password. Switch on multi-factor authentication if it isn't on already.
  3. If they entered eFiling details, log in to eFiling yourself (by typing sars.gov.za) and check that your contact and banking details haven't been changed. Contact SARS through its official channels if anything looks wrong.
  4. If they entered banking details, call your bank on the number on the back of your card or on the bank's official website.
  5. If they opened an attachment, disconnect that computer from the network (unplug the cable and turn off Wi-Fi) and have it checked before it's used again.
  6. Report the phishing message. SARS asks that phishing emails be forwarded to it; check the scams and phishing page on sars.gov.za for the current reporting address.
  7. Consider POPIA. If a mailbox or computer holding personal information was compromised, you may need to notify the Information Regulator and the people affected. See our guide on how to report a POPIA data breach.

Five habits that stop most SARS scams

  1. Always go direct. Log in to eFiling by typing the address or using the official app, never through a link.
  2. Switch on multi-factor authentication for email and anything else that supports it, so a stolen password alone isn't enough. If you use Microsoft 365, see our Microsoft 365 security checklist.
  3. Agree a "call to confirm" rule for any change to banking details, for your staff and your clients.
  4. Keep computers updated and protected, so a malicious attachment has fewer weaknesses to exploit.
  5. Brief your team before filing season. A five-minute reminder with a real example is more effective than a policy nobody reads.

The safety net behind the habits

Even careful teams click eventually. When it happens, what matters is how quickly you find out. EZ Cyber Guard monitors your computers for the suspicious behaviour that follows a bad click, such as malware starting up, documents launching scripts or unusual connections. It alerts you in plain language and can contain common threats automatically. Not sure how well your business is covered? Take the free POPIA Security Readiness Check.