SARS AI scams include eFiling phishing, and they are harder to spot this tax season.
With fewer than six weeks until the 23 October 2026 deadline for non-provisional individual taxpayers, South Africans are racing to sort their returns. That deadline pressure is also a gift to scammers, and this year they’ve arrived better-equipped than before.
Kaspersky researchers have identified phishing websites designed to imitate SARS eFiling, along with malicious email attachments disguised as tax documents.
Separately, SARS itself has confirmed that scammers are now using AI to generate professional-looking email templates that are harder to identify as fraudulent. The old tells (clunky grammar, off-brand formatting, etc) are no longer reliable checkpoints.
SARS urged taxpayers not to leave filing until the last minute. The deadline is 23 October for non-provisional filers. You can submit via SARS eFiling or the SARS MobiApp.
What SARS AI scams look like
Kaspersky researchers found fake eFiling pages asking for usernames, passwords and phone numbers. One imitation page uses what appears to be an Adobe PDF sign-in screen to request email credentials. Notice the url as ‘sers-portal’, and not ‘sars’.
This is a move specifically designed to catch people off-guard because it doesn’t immediately look like a tax page at all.
Attachments with filenames like ‘Tax Returns Of RXX,XXX.XXX’ and ‘Final_Assessment_Notification-2026-0X-0X.pdf’ have also been identified. The emails carrying them tend to use subject lines or phrases such as ‘Refund due’ or ‘SARS Letter of demand’, designed to create urgency before the reader stops to check the sender.
SARS has been tracking and publishing these scams for a while now. The list goes back years and keeps growing.
The latest scam, flagged by Sars on 2 September 2026, scares taxpayers into thinking the High Court has issued a Letter of Demand for an overdue amount. The link in the document redirects to a Netlify hosted “letter”; the site has since been taken down.
The scam uses the urgency factor by stating “COURT SUMMONS AND BLACKLISTING IMMINENT if this is not attended to within the next 48 hours.”
A scam flagged by SARS in July 2026 involved SMS and email scams claiming recipients were owed a refund, in one case R68,000, directing them to fraudulent websites to claim it.
AI makes scams harder to dismiss
In July, SARS warned that scammers were using AI to produce email templates that look genuinely professional.
1. AI scams, timing and urgency
The timing is important here, because by mid-season, people are used to receiving messages about returns, assessments and refunds. A message that blends into that pattern doesn’t trigger the same scepticism.
“By this point in the tax season, people are used to receiving messages about returns, assessments and refunds, so an email like this may not immediately look out of place,” said Chris Norton, General Manager for Sub-Saharan Africa at Kaspersky.
“That is what scammers rely on. The closer we get to the deadline, the easier it is to act quickly because you think you are dealing with something that needs your attention.”
AI-generated messages can pass the basic visual checks that used to catch fakes: spelling is clean, branding looks right, tone sounds official. The scam doesn’t announce itself anymore.
ALSO READ: How romance AI scams stole R15 million from Brad Pitt fan
2. Uploading tax documents to a chatbot
There is another artificial intelligence angle this filing season that gets less attention. As people try to understand their returns or work through complicated tax questions, some may turn to AI tools for help.
I have been guilty of this myself, especially after a tax professional caused more harm than help, and I couldn’t afford to find another professional to fix his mess. So, who else to turn to, than ChatGPT. That said, I did take care not to upload any identifying documents, instead screenshotting sections of the forms I didn’t understand.
But Kaspersky warns this carries its own risk.
Tax documents are detailed records of a person’s financial and personal life. They contain employment history, income figures, banking information and identification details. Uploading that data to a public AI service creates exposure that most people haven’t thought through.
“AI can make complicated information easier to work through, but taxpayers should be careful about the information they provide to an external service,” said Norton. “Sensitive records should stay out of public AI tools, and important tax information should be checked through trusted sources.”
READ: SARS tax season guide: Dates, who must file, and what’s new
3. AI errors
Beyond the privacy risk, AI-generated responses can also contain errors. Getting wrong tax information from a chatbot, and filing on the basis of it, is a problem official SARS channels and registered tax practitioners exist to prevent.
That said, and let me insert my personal rant here: A tax practitioner isn’t a guaranteed fix. Mine cost me money and still left my record worse off than before I paid him.
Funny how we all learned the mitochondria is the powerhouse of the cell, yet nobody sat us down and explained how tax actually works. That gap doesn’t close in adulthood either. SARS could stand to make its own systems a lot less confusing instead of leaving people to fend for themselves.
Maybe that’s why there is a tax revolt underway in South Africa, but what do I know.
How to stay ahead of the scam
SARS is clear on what it will never do:
- request passwords,
- request one-time PINs (OTPs),
- request banking PINs or eFiling login credentials through email, SMS, social media or telephone.
If a message asks for any of those things in any of those ways, it is not from SARS. Taxpayers must use only official SARS channels and verify the credentials of any tax practitioner before sharing personal information.
Also take a quick look at the SARS scams and phishing page once in a while. It keeps a running list of confirmed fake messages, which is a useful reference when something looks off.
To report a suspected phishing message, SARS asks taxpayers to email phishing@sars.gov.za.
“The closer the deadline gets, the more tempting it can be to deal with a tax message immediately. Taking a few minutes to verify it through an official channel can be the difference between completing your return successfully and handing valuable information to a scammer,” concluded Norton.
How to protect yourself and your data
Kaspersky’s practical advice is to go directly to directly to SARS eFiling or the MobiApp and check whether the communication appears there, instead of following a link in an unexpected message.
Kaspersky also suggests:
File your taxes yourself
Even when using a legitimate consulting firm, the risk is still extremely high. You are handing over a complete file about yourself, including ID details, employment and income info, your address, etc.
And even if they have no ill intentions, remember that even the most honest services aren’t immune to hacks and data breaches.
Watch out for fake websites
Use a reliable security solution that prevents you from visiting phishing sites and blocks malicious file downloads.
Don’t trust AI
Your preferred chatbot of choice, no matter how advanced, are still prone to errors and hallucinations. And nothing stops chatbot developers from reading the conversations you have with their AI.
If you absolutely must use AI, install and run a local version on your own computer. (I’ll be writing a guide about this soon.)
Stick to official channels only
“The ‘chief tax inspector’ of your country or city is definitely not going to message you: high-ranking officials have more important things to do,” says Kaspersky.
Contact tax authorities through official channels only, and always verify the sender of mails you receive. Even a slight deviation in a name or address is a telltale sign of a phishing campaign.
Scammers might swap the letter a for a lookalike character such as the Latin alpha (ɑ), or use a capital i to stand in for a lowercase L, tricks designed to fool a quick glance at a domain or email address.
