eFiling hijacks and fake tax returns: when criminals file in your name
23 October 2026 · Omnitrace
Before: you assume your tax profile is safe because you file on time. After: you notice changes, lock your profile and stop a fake refund before it is paid. Bridge: knowing how eFiling identity fraud works, and checking your profile regularly, gets you there.
SARS and its partners regularly warn about syndicates, sometimes helped by corrupt insiders or tax practitioners, who register eFiling profiles in other people's names, change banking details and submit inflated returns or fake medical and travel claims. You may only find out when SARS audits "your" return or a refund you never received is flagged.
Warning signs
- An SMS or email from SARS saying your banking details, contact details or password changed, and you didn't do it.
- You can't register for eFiling because "a profile already exists" for your ID number.
- An assessment or audit letter for a return you never submitted.
- Unknown employers, IRP5s or tax directives on your profile.
- A tax practitioner you've never heard of is linked to your tax number.
Protect your tax identity
- Register for eFiling yourself, even if you don't need to file, so nobody else can.
- Use a strong, unique password and keep your registered cellphone and email current. SARS sends OTPs and change alerts there.
- Only use tax practitioners registered with a recognised controlling body. Ask for their practitioner number.
- Never share your eFiling login or send your ID copy without watermarking it "For SARS submission only".
- Check your profile and statement of account a few times a year.
If you suspect fraud
- Contact SARS on 0800 00 7277 or visit a branch (book online) with your ID to secure the profile.
- Report it to the SARS fraud hotline on 0800 00 2870 and open a SAPS case.
- Apply for SAFPS Protective Registration and check all three credit bureaus.
Businesses: Omnitrace ID verification helps you confirm a person is who they say they are before you onboard staff, suppliers or clients, so stolen identities are stopped at your door.
Running a business? Omnitrace helps you verify every client's identity before you sign, lend or hire. Request a service or call 065 375 6188.
This article is general information, not legal or financial advice.
Keep reading
- SARS refund SMS and email scams: "Your refund is ready" is the bait
- "This is SARS, you owe R38,000": fake SARS calls and debt threats
- Phishing in South Africa: how to spot a fake email, link or login page
- Banking app fraud: how criminals empty accounts, and how to stop them
- Fake SMSes and calls: when the "bank" is not your bank
- Crypto and investment scams: the promise of quick riches
- Online shopping, marketplace and courier scams in South Africa
- 7 habits that keep your personal information out of criminal hands
- Your ID number is gold to fraudsters. Here is how to guard it
- The most common South African scams and how to spot them
- Fake job offers and human trafficking in South Africa: the warning signs
- Inside the playbook: how scammers and cyber criminals target South Africans