The New SARS Refund Scam and What You Can Do
This article will count 0.25 units (15 minutes) of unverifiable CPD. Remember to log these units under your membership profile.
Your client gets an email. It says SARS owes them a refund. There's a link. They click it.
That's it. That's the scam. And right now, during the busiest filing window of the year, it is landing in inboxes across South Africa.
SARS published its latest fraud alert on 21 July 2026, officially logged as SARS-SCAM-395 — "Get Your Tax Return". The timing is deliberate. Auto-assessments ran from 1 to 12 July 2026. Filing season for non-provisional taxpayers opened on 13 July. Millions of South Africans are expecting either a refund or a return request right now. Scammers know this. They designed this campaign around it.
The scam works because it sounds plausible. A message that says "your tax return is ready" or "a refund has been issued" fits exactly what taxpayers are expecting to hear from SARS this month. The link looks official. The format mimics SARS correspondence. And the result, for anyone who clicks and enters their details, is the same: personal information stolen, banking credentials exposed, and a problem that lands squarely on the desk of their accountant.
As a practitioner, you are the first line of defence. Your clients will not always spot the difference between a real SARS notification and a sophisticated fake. You can.
What the Scam Looks Like
This latest scam follows a pattern that has become familiar during filing season. The message arrives by email or SMS. It uses subject lines such as "Get Your Tax Return", "Your SARS refund is ready", or similar language designed to seem routine. It carries SARS branding, logos, and formatting that looks legitimate at a glance.
The message then directs the recipient to click a link to "verify your details", "confirm your banking information", or "release your refund". That link leads to a fake website built to steal login credentials, banking details, or identity documents.
These phishing portals use SARS's real colours, fonts, and wording. They do not need to hack anyone. They simply need one rushed, stressed taxpayer to click the wrong link. And then your phone starts ringing.
A scam spike during filing season is predictable, and practitioners who warn clients early are the ones who avoid the fallout.
What SARS Will Never Do
This is the non-negotiable list. Share it with your clients. Pin it in your office. Send it in your next client newsletter.
SARS will never request passwords, one-time pins (OTPs), banking PINs, or eFiling login credentials through email, SMS, social media, or telephone. Beyond that, SARS will also never:
Ask for your credit card details in any form of communication.
Send hyperlinks directing you to external websites, even those of banks.
Send .htm or .html attachments.
Ask you to click a link to release or confirm a refund. Refunds go to the bank account already registered on your eFiling profile — no action required.
Accept direct deposits into personal bank accounts.
If a message asks for any of the above, it is a scam. Full stop.
What You Should Do
If you or your client receives a suspicious email, SMS, or call claiming to be from SARS, follow these steps.
Step 1: Do not click, reply, or download anything.
Close the message. Do not open any attachments, especially .htm or .html files.Step 2: Verify your tax status directly through official SARS channels.
Log in to SARS eFiling by typing the address directly into your browser, never via a link in a message. You can also use the official SARS MobiApp. Your actual SARS status will be visible there.Step 3: Check the SARS Scams and Phishing page.
SARS maintains a live list of confirmed scams on their scams and phishing website. Compare the message you received against known scam exampleStep 4: Report the scam to SARS.
Forward the suspicious email to phishing@sars.gov.za. For phone-based scams or further information, call the SARS Fraud and Anti-Corruption Hotline on 0800 00 2870. Reporting helps SARS track and shut down these campaigns faster.To report other types tax crimes look on SARS website for more information:
If you are suspecting digital fraud (i.e. efiling hijacking), report it here.
If you are suspecting a SARS staff member to be involved in malpractice or corruption, report it here.
If you are suspecting a tax or customs crime, report it here.
Step 5: Check whether your eFiling profile has been accessed.
If you suspect your login details may have been compromised, log in to eFiling immediately and check your profile activity. Review who is listed as your tax practitioner. If anything looks unfamiliar, contact SARS via their Contact Us page or call 0800 00 7277.
Read more in our previous publications:
Cybersecurity for the Small Practice covers exactly what SARS, POPIA, and your PI insurer expect from you as a data custodian.
Watch the SARS YouTube videos on how to protect yourself from scammers: