SARS warns against new 'scam wave'

Only a few weeks after our last blog about tax scams, the South African Revenue Service (SARS) has issued yet another scam alert – this time warning about the use of AI to generate messages that are harder to identify as fraudulent.

The warning on the SARS website.

SARS has issued a scam alert, warning against a fake tax return notification that lures taxpayers into clicking on a malicious link.

"A new scam wave is circulating via SMS and email, telling recipients they are owed a refund – in one case R48,900 – and directing them to a fraudulent website to claim it," reads the warning.

SARS advises anyone who receives such a message to delete it and block the sender right away.

This is what the latest tax scam looks like. Image: SARS

Tax scams in which SARS is impersonated are nothing new but AI technology is making it easier for scammers to deceive taxpayers. According to the statement, SARS is "noting with concern that the scammers are now using AI to generate professional-looking email templates that are harder to identify as fraudulent".

How to protect yourself

• Remember that SARS won’t ask you to click on a link or request any personal information, banking or login details, or OTPs via email, SMS, social media or telephonically.

• Be extra vigilant when something seems too good to be true and/or when a sense of urgency is created. The words "Action Required" in the above example is a big red flag.

• If in doubt, go to the official eFiling website (secure.sarsefiling.co.za) and log in to your profile directly or use the SARS MobiApp (only download it from official app stores) for any info related to your tax returns. Also read our recent blog on tax scams.

• Email the SARS IT security team at phishing@sars.gov.za or visit its scams and phishing webpage to see the latest scam examples.

• Subscribe to our mailing list if you'd like to stay posted on the latest online-safety news.

Disclaimer: NetSavvy’s services and content are for educational and informational purposes only and do not guarantee protection against cyberthreats. While we aim to deliver high‑quality online‑safety education, training and consulting services, threat landscapes and misinformation tactics continuously evolve and no single solution can ensure complete protection. Our content is not, and is not intended to be, legal, medical, mental health, financial, investment or cybersecurity incident-response advice. Read our full disclaimer here.