SARS refund SMS and email scams: "Your refund is ready" is the bait
23 October 2026 · Omnitrace
Problem: during filing season, millions of South Africans are waiting for a SARS refund. Criminals know it. Agitate: an SMS says "SARS: your refund of R4,850 is ready, verify your banking details here". The link opens a perfect copy of eFiling. You type your login, ID number and bank details, and the fraudster now has everything needed to redirect your real refund, open credit in your name or empty your account. Solution: SARS never sends links that ask for your banking details, PIN or password. Check your refund only by typing sars.gov.za into your browser yourself, or in the SARS MobiApp.
How the scam works
- You get an SMS, email or WhatsApp claiming a refund, an "outstanding amount" or a "suspended eFiling profile".
- A link takes you to a fake eFiling page on a look-alike address.
- You enter your username, password, ID number and bank details, sometimes an OTP too.
- Criminals log into your real profile, change the bank account, or sell your identity.
Red flags
- Any message with a link asking you to "verify" or "update" banking details.
- Attachments such as "SARS_Refund.pdf.html" or zipped "statements".
- Pressure: "claim within 24 hours or the refund is forfeited".
- Sender addresses like sars-refunds@gmail.com or a random cellphone number.
- Requests to pay a "release fee" before a refund is paid. SARS never charges one.
What to do instead
- Type www.sars.gov.za yourself and log in to eFiling, or use the SARS MobiApp.
- Phone the SARS Contact Centre on 0800 00 7277 if unsure.
- Forward suspicious emails to phishing@sars.gov.za.
Already clicked?
- Change your eFiling password from a safe device straight away.
- Call your bank's fraud line and block any card or account you entered.
- Report it to SARS and open a SAPS case if money or details were taken.
- Request a free credit report and consider a Protective Registration with the Southern African Fraud Prevention Service (SAFPS).
Rule of thumb: a real SARS refund lands in the bank account on your profile. It never needs you to click a link.
Running a business? Omnitrace helps you verify every client's identity before you sign, lend or hire. Request a service or call 065 375 6188.
This article is general information, not legal or financial advice.
Keep reading
- "This is SARS, you owe R38,000": fake SARS calls and debt threats
- eFiling hijacks and fake tax returns: when criminals file in your name
- Phishing in South Africa: how to spot a fake email, link or login page
- Banking app fraud: how criminals empty accounts, and how to stop them
- Fake SMSes and calls: when the "bank" is not your bank
- Crypto and investment scams: the promise of quick riches
- Online shopping, marketplace and courier scams in South Africa
- 7 habits that keep your personal information out of criminal hands
- Your ID number is gold to fraudsters. Here is how to guard it
- The most common South African scams and how to spot them
- Fake job offers and human trafficking in South Africa: the warning signs
- Inside the playbook: how scammers and cyber criminals target South Africans