The South African Revenue Service (SARS) has flagged new scams ahead of the 2025 tax season, with Standard Bank also warning of increased criminal activity as filing season opens.<\/p>\n\n\n\n
According to SARS, the latest scam is an SMS indicating that revenue services is conducting an audit on a tax refund. <\/p>\n\n\n\n
Taxpayers are prompted to click a link, which then leads to a phishing site designed to steal user information.<\/p>\n\n\n\n
The latest scam follows a tried-and-true method by scammers to fool taxpayers into taking action that will compromise their data, joining a long and growing list of tactics used by criminals.<\/p>\n\n\n\n
As is always the case, the revenue service urged users to steer clear of messages from unknown sources and refrain from clicking on links.<\/p>\n\n\n\n
“SARS will never send you hyperlinks to other websites. Beware of emails or SMSs asking for personal, tax, banking or eFiling detail,” it said.<\/p>\n\n\n\n
The latest scam, focusing on SARS audits, joins this long list of prototypes that taxpayers should be on the lookout for, especially as tax season kicks off.<\/p>\n\n\n\n
According to Standard Bank’s Head of Fraud Risk Management, Athaly Khan, fraud tends to pick up significantly during filing season, with criminals looking to exploit diligent taxpayers.<\/p>\n\n\n\n
Taxpayers should expect a spike in fraudulent activity starting next week, 7 July, as SARS starts issuing auto assessments, with alerts going out to those who qualify.<\/p>\n\n\n\n
A second wave will hit from 20 July, when the manual filing season opens.<\/p>\n\n\n\n
While tax scams can happen all year round, unsuspecting taxpayers are more vulnerable between 20 July and 20 October 2025, when tax affairs are in the spotlight.<\/p>\n\n\n\n
Popular methods include extortion or secure account scams, as well as alerts to change banking details or the more typical phishing attempts.<\/p>\n\n\n\n
| Income Taxpayer<\/th> | Open<\/th> | Close<\/th><\/tr><\/thead> |
|---|---|---|
| Auto-Assessments<\/td> | 7 July 2025<\/td> | 20 July 2025<\/td><\/tr> |
| Individual<\/td> | 21 July 2025<\/td> | 20 October 2025<\/td><\/tr> |
| Provisional<\/td> | 21 July 2025<\/td> | 19 January 2026<\/td><\/tr> |
| Trusts<\/td> | 21 July 2025<\/td> | 19 January 2026<\/td><\/tr><\/tbody><\/table><\/div><\/figure>\n\n\n\nHow tax scams work<\/h2>\n\n\n\nWith extortion scams, Khan noted that criminals will claim to be investigating a taxpayer’s return submission, having discovered discrepancies.<\/p>\n\n\n\n The fraudsters often threaten penalties or even criminal prosecution, providing fabricated documentation to substantiate their allegations.<\/p>\n\n\n\n \u201cIntimidation and manipulation tactics may be used to instil fear and panic so that you can follow their instructions,\u201d Khan said.<\/p>\n\n\n\n Once satisfied that the customer is convinced, fraudsters usually ask for money to be paid over to them to make the case disappear. <\/p>\n\n\n\n Alternatively, they provide the customer with a fraudulent account number to transfer \u2018funds potentially due to SARS\u2019 so that the funds are secured whilst they are busy with the \u2018bogus\u2019 investigation. <\/p>\n\n\n\n In most of these cases, they claim to be in collaboration with the bank, law enforcement or regulatory bodies.<\/p>\n\n\n\n Fraudsters also send fake communications with banking details, claiming that taxpayers owe funds to SARS. <\/p>\n\n\n\n Some customers may in fact have funds due to SARS, making the communication seem legit, Khan said.<\/p>\n\n\n\n However, the account details provided belong to fraudsters, not SARS. They may offer a settlement discount to pressure taxpayers into paying quickly without checking.<\/p>\n\n\n\n Reflecting the latest scam and many others flagged by SARS, Khan warned of any suspicious communications being sent that include a link, icon, attachment or QR Code.<\/p>\n\n\n\n She said these links and attachments could be laced with malware, which could give the criminals unauthorised access to devices, including digital banking or eFiling profiles.<\/p>\n\n\n\n In more traditional cases, users are prompted to give their banking details to make payments, compromising their cards and accounts.<\/p>\n\n\n\n Some of the fraudulent messages and emails that have been doing the rounds focus on these areas:<\/p>\n\n\n\n
|