South African taxpayers are being urged to stay alert during the 2026 tax filing season after the South African Revenue Service (SARS) warned that cybercriminals are increasingly using artificial intelligence to create highly convincing phishing messages.
The revenue service said a new wave of fraudulent emails and SMS messages is targeting taxpayers, particularly those who have recently submitted tax returns and may be expecting refunds.
Unlike older phishing attempts that were often easy to recognise because of poor spelling or formatting, the latest scams use AI-generated content that closely resembles official SARS correspondence, making them significantly harder to detect.
According to SARS, scammers typically inform recipients that they qualify for a substantial tax refund—sometimes as much as R50,000—before directing them to fake websites designed to steal personal and banking information.
The tax authority warned that these sophisticated messages can appear professional and legitimate, increasing the likelihood that taxpayers may trust them without verifying the source.
Anyone who receives suspicious communication is advised to delete the message immediately, block the sender and report the incident to the SARS IT Security team.
Tax refund scams evolving with new technology
SARS said artificial intelligence is changing the landscape of online fraud by allowing criminals to produce polished emails that imitate official government communications.
The warning follows similar concerns raised by the Southern African Fraud Prevention Service (SAFPS), which said cybercriminals are combining AI with social engineering techniques to pressure victims into acting quickly.
Many fraudulent messages create a false sense of urgency by asking taxpayers to confirm banking details, update their eFiling profiles or verify personal information before a supposed refund can be processed.
Clicking on embedded links may expose sensitive information or install malicious software capable of compromising devices.
Although legitimate SARS emails are sent from the @sars.gov.za domain, taxpayers are reminded that criminals can spoof email addresses. For this reason, SARS recommends confirming all tax-related information directly through the official SARS eFiling platform or the SARS MobiApp rather than following links contained in emails or text messages.
Protecting taxpayer information
The SAFPS warned that stolen taxpayer information can be used to hijack eFiling profiles, enabling fraudsters to change banking details linked to taxpayer accounts.
Once those changes are made, legitimate tax refunds can be redirected into fraudulent bank accounts created using stolen identities. In many cases, victims only discover the fraud after learning that their refunds have already been paid into unfamiliar accounts.
To reduce the risk of becoming a victim, SARS advises taxpayers never to share eFiling usernames, passwords, PINs or banking details through email, SMS or telephone calls.
Taxpayers should also avoid accessing tax services through links received via email, WhatsApp or text messages, instead navigating directly to the official SARS website or mobile application.
Using strong passwords, enabling multi-factor authentication and avoiding public Wi-Fi when accessing financial accounts can provide additional protection against cybercrime.
Both SARS and the SAFPS stress that if taxpayers have any doubts about a message claiming to come from the revenue service, they should verify it immediately using official SARS contact channels before taking any action.
Source: BusinessTech.