A message claiming that the South African Revenue Service owes you a refund—or that you must pay immediately—can be convincing. SARS has warned repeatedly about spoofed emails, fake assessments and malicious links. Even professional-looking letters can be fraudulent.

Warning signs

  • An SMS or email asks you to click a link to enter your eFiling password, OTP or banking PIN.
  • A message demands urgent payment into a personal bank account or via a suspicious payment link.
  • The sender threatens immediate action but asks you not to contact SARS through its official channels.
  • A supposed refund requires you to complete an unusual web form or open an HTML attachment.
  • The address or linked website imitates the look of SARS without using an official domain.

What does SARS say?

SARS states that it will not request passwords, one-time PINs, banking PINs or eFiling credentials by email, SMS, social media or telephone. Its published scam alerts describe fake tax settlements, assessment notifications and refund claims, including cases reported in 2026.

What to do when you receive a suspicious message

  • Do not submit passwords, OTPs, bank details or identification documents through the suspicious message.
  • Open your browser directly and type the official SARS website address rather than following the message’s link.
  • Check your tax position within your own authenticated eFiling session.
  • Use the official SARS scams page for current warnings and the official channels listed there to report suspicious correspondence.
  • If you have already shared credentials, change them using the official service and contact your bank if banking information may be compromised.

A quick verification habit

Treat any tax-refund notification as a prompt to verify the status independently, not as an instruction to click. This is especially important during filing season, when fraudsters use topical language such as “assessment”, “settlement” and “final demand”.

Example: a convincing refund message

Picture an SMS claiming, “Your tax refund is ready — verify your details within two hours.” It may use official-looking colours and mention eFiling. Do not trust the message merely because it includes your name or a plausible refund amount. Open a fresh browser window, type the official SARS address yourself and sign in through your normal trusted route to check your account.

  • Do not open shortened or suspicious links or unexpected HTML attachments.
  • Never disclose your eFiling password, OTP, banking PIN or card details in response to the message.
  • Check SARS official scam alerts and the notices in your own eFiling profile.
  • If you shared login information, change your password using the official service and contact your bank promptly if banking details are exposed.

What makes a message suspicious even if it looks professional?

Scammers can copy logos, email templates and familiar language. Pressure to respond immediately, a request for secret credentials or a payment into an unfamiliar account should trigger independent verification. SARS specifically warns that it will not request your passwords, OTPs, banking PINs or eFiling credentials by email, SMS, social media or telephone.

Check the latest examples directly on SARS: https://www.sars.gov.za/targeting-tax-crime/scams-and-phishing/.

Official sources and related reading

SARS Scams and Phishing — https://www.sars.gov.za/targeting-tax-crime/scams-and-phishing/

SARS Beware of Scams, July 2026 — https://www.sars.gov.za/latest-news/beware-of-scams/

Further reading: South African Income Tax Thresholds for 2026/27 — income-tax-thresholds-south-africa-2026.html.