With fewer than six weeks remaining before the 23 October filing deadline for non-provisional individual taxpayers, many South Africans will be turning their attention to outstanding tax returns. SARS itself is urging taxpayers not to leave filing until the last minute.
That approaching deadline also creates good conditions for scammers. Kaspersky researchers have recently identified phishing websites that imitate SARS eFiling and malicious email attachments disguised as tax-related documents. One fake eFiling page asks victims for their username, password and phone number, while another uses what appears to be an Adobe PDF sign-in screen to request email credentials.
Kaspersky researchers have also picked up attachments with filenames such as “Tax Returns Of RXX,XXX.XXX” and “Final_Assessment_Notification-2026-0X-0X.pdf”. The emails often use phrases like “Refund due” or “SARS Letter of demand”, giving people a reason to open the file before stopping to check where it came from.
“By this point in the tax season, people are used to receiving messages about returns, assessments and refunds, so an email like this may not immediately look out of place,” says Chris Norton, General Manager for Sub-Saharan Africa at Kaspersky. “That is what scammers rely on. The closer we get to the deadline, the easier it is to act quickly because you think you are dealing with something that needs your attention.”
AI is making that judgement more difficult. In July, SARS warned that scammers were using AI to create professional-looking email templates that are harder to identify as fraudulent. The warning followed a new wave of SMS and email scams claiming that taxpayers were owed refunds and directing them to fraudulent websites.
That means some of the old visual clues, including awkward wording or amateur-looking correspondence, no longer have the same impact. A message can look professional and still be fraudulent.
There is another AI-related risk during tax season. People may turn to chatbots or other AI tools for help understanding their returns or working through tax questions. Kaspersky warns that tax documents contain highly sensitive personal and financial information, while AI-generated responses can also contain errors. Uploading tax records, identification documents, banking information or other confidential data to an AI service can therefore create unnecessary exposure.
“AI can make complicated information easier to work through, but taxpayers should be careful about the information they provide to an external service. A tax return contains a detailed picture of someone’s financial and personal life. Sensitive records should stay out of public AI tools, and important tax information should be checked through trusted sources,” says Chris Norton.
For taxpayers, one of the simplest protections is to remove the urgency from the interaction. Instead of following a link in an unexpected tax message, access SARS eFiling or the MobiApp directly and check whether the communication is reflected there. SARS says it will never request passwords, one-time PINs, banking PINs or eFiling login credentials through email, SMS, social media, or telephone.
“The closer the deadline gets, the more tempting it can be to deal with a tax message immediately. Taking a few minutes to verify it through an official channel can be the difference between completing your return successfully and handing valuable information to a scammer,” concludes Chris Norton.
