By Thalia Pillay, co-founder and CEO of Orca Fraud
Check your SMS inbox or email inbox. There’s a good chance a message claiming to be from SARS is already waiting for you — whether it’s a tax refund you never filed for or an urgent settlement demand designed to trigger panic.
Tax season brings a predictable spike in messages claiming to be from SARS. Most South Africans with a smartphone will receive at least one this year. Four scam types are consistently in circulation during the filing window. Here’s what each looks like and what SARS itself says about how to spot them.
1. The Fake Settlement Notification
An email or SMS arrives with an outstanding tax amount — specific, urgent, due by a named date. Payment instructions are included: a bank account number, a reference. The language is formal and pressured.
SARS has documented this exact scam and is clear on the rules: it will never request banking details by post, email, or SMS, and it will never provide a bank account number for payment. All legitimate tax payments go through eFiling or the SARS payment portal. Genuine SARS correspondence always includes your taxpayer reference number, your ID number, and your name. A message missing any of those details is not from SARS.
2. The Fake Refund SMS
A refund has been issued to your account — a specific amount, ready to be received. The message instructs you to click a link to verify your details or link your credit card to receive it.
SARS will never ask for your credit card details. Refunds go to the bank account registered on your eFiling profile — no link-tapping, no card linking required. In the example currently circulating, the link points to “sarsdue.xyz”. SARS correspondence links only to sars.gov.za. Any other domain is a scam.
3. The Fake Letter of Demand
A more threatening message: SARS has issued a letter of demand, a court summons is imminent, blacklisting may follow. A link or attachment leads to a phishing site designed to harvest your information.
SARS has specifically flagged this type. It will not send you hyperlinks to other websites — including to banks or legal notices. Any genuine legal action from SARS is visible in your eFiling profile, not delivered via a link in an unsolicited message.
4. The Fake Auto-Assessment or Compliance Notice
You’re prompted to confirm your compliance status, update your banking details, or complete your auto-assessment via a link. The destination is a proxy website that mimics the eFiling interface.
SARS does not send links to external websites for compliance purposes. If you need to complete an auto-assessment or update your banking details, go directly to sars.gov.za and log in. Do not use a link from a message to get there.
What SARS Says
As of May 2025, SARS moved entirely to digital correspondence, discontinuing physical mail for all system-generated letters. That means more legitimate SARS communication landing in inboxes and SMS threads — which also means more plausible cover for scams designed to look like it. When you’re expecting to hear from SARS, a message that looks like SARS is easier to act on without checking.
SARS maintains a live scam log at sars.gov.za with nearly 400 documented examples — updated each time a new variant is confirmed.
If you receive anything that looks like SARS correspondence, verify it directly through your eFiling profile at sars.gov.za. Report suspicious messages to phishing@sars.gov.za or call the Fraud and Anti-Corruption Hotline on 0800 00 2870.