Are insiders behind SARS eFiling hijackings?

EFiling profile hijackings have surged because taxpayers’ statuses, tax-related details and personal information on the South African Revenue Service (SARS)’s platform are compromised before the profile is hijacked, tax practitioners alleged at a recent tax ombud workshop.

They believe data breaches within SARS are enabling fraudsters to exploit taxpayers in a rapidly escalating wave of digital tax fraud.

During a recent virtual public workshop hosted by the Office of the Tax Ombud (OTO) on its draft report into Alleged eFiling Profile Hijacking, many practitioners questioned how fraudsters seemingly know so much about the targeted taxpayers – for instance, they seem to know when a refund is due, or if there is pattern of regular and high VAT refunds.

 “On a balance of probabilities, someone inside the house opens the door. It takes someone inside SARS and someone outside to tango,” one practitioner said.

Practitioners targetted

A key finding in the ombud's draft report is that tax practitioners who manage multiple client accounts are increasingly targeted, accounting for more than 48 percent of all reported hijacking incidents.

Nearly 16 000 eFiling profiles have been taken over by criminals between 2023 and 2025 and 387 new cases are reported each month, the ombud reports.

When fraudsters take over eFiling profiles, they get unlawful access to taxpayers’ confidential data, enabling them to alter taxpayers’ banking details and redirect legitimate refunds to their own accounts.

The ombud’s report notes that criminals go so far as to submit fraudulent tax returns on hijacked profiles to generate illegal refunds – an activity that often goes unnoticed until victims realise they are locked out of their own profiles.

While the ombud's draft report sets out extensive recommendations for SARS, tax practitioners, banks, law-enforcement bodies and the Companies And Intellectual Property Commission (CIPC) as a co-ordinated approach to curb the problem, the workshop repeatedly returned to one unresolved concern: what happens before a profile is hacked and how is data about which taxpayers to target leaked in the first place? For now, that question remains unanswered.

The ombud did not find any evidence of insider involvement – it merely found that survey participants and those who commented on the draft report had expressed concerns about potential internal fraud as one of the key contributors to profile hijacking and the subsequent fraudulent processing of tax refunds.

Lack of facts

In its comments on the ombud’s report, the South African Institute of Chartered Accountants (SAICA) highlighted a lack of critical facts about the causes and consequence of eFiling profile hijacking. It said SARS had not confirmed that all +/-16 000 cases were reported to the South African Police Service (SAPS) nor had information been provided on how many cases resulted in criminal cases against SARS officials.

Tax Ombud Yanga Mputa welcomed the practitioners’ input and said it would be incorporated into the final report, expected by mid-February 2026.

She added that any further investigation into possible insider involvement at SARS would require a separate approval from the Minister of Finance, as the Tax Administration Act prevents the ombud from doing any systemic investigations without the Minister’s approval.

Key findings in draft report

The key findings of the ombud’s investigation that are contained in the draft report released in October reveal that:

• eFiling profile hijacking is most prevalent among tax practitioners and individual taxpayers.
  
  
• Most cases involve Personal Income Tax and Value-Added Tax (VAT).
  
  
• Fraudulent transactions typically involve amounts under R10 000 but can reach up to R100 000.
  
  
• Vulnerabilities include inadequate authentication processes such as taxpayers using basic login details or not using two-factor authentication, challenges in detecting fraud due to the absence of a centralised case management system within SARS and limited cross-divisional collaboration, delayed SARS response times, insider threats and low digital security awareness among taxpayers.

Evolving cybercrime risks acknowledged

SARS did not respond to requests for comment on practitioners' fears about insider involvement.

Following the publication of the draft report in October 2025, SARS did, however, acknowledge that cybercrime is an evolving and growing risk, requiring continued investment to modernise its tax administration platform.

SARS responded to the draft report saying that many of the ombud’s recommendations were already being implemented and will be continually enhanced as threats evolve.

Ombud notes insider threat

The ombud’s recommendations to SARS include measures to deal with internal threats by:

Strengthening internal controls and processes;

Conducting periodic independent audits on SARS eFiling systems and Mobi APP;

Initiating or continually improving regular audits on system log ins, employee access history and refunds processed after hours or within days of bank account creation or a change in banking details.

The ombud’s draft report refers to the Nugent Commission’s recommendation that an Inspector General be established to provide a secure, independent reporting system accessible to all SARS employees. This will allow employees to report colleagues suspected of internal fraud and/or insider involvement in profile hijacking.

Other recommendations in the report include:

SARS should enhance authentication protocols such as improving one-time password (OTP) deliveries and adding special linked devices for authentication, improve fraud detection and refund verification systems and boost taxpayer education.

SARS should strengthen collaboration with the banks, CIPC and the police.

VAT fraud often begins with unauthorised or fraudulent changes to the information of directors of companies at the CIPC. This allows fraudsters to take control of the company tax profile or open fraudulent bank accounts.

The ombud recommends that changes to the information of directors of companies submitted to CIPC should be pre-validated by SARS. Further to this, the CIPC must notify SARS immediately and automatically of any changes to directors or company ownership information, upon which SARS should temporarily freeze payment of VAT refunds until the new information has been verified.

The ombud recommends that SARS and banks must collaborate to flag new accounts receiving refunds and cases where large or unusual VAT refunds are involved to detect fraud and recover fraudulent refunds.

SARS investigations take time

While the ombud’s draft report states that the majority of eFiling-related fraud cases are ultimately resolved in favour of taxpayers, the process is far from swift. SARS takes on average 150 days to finalise investigations into eFiling profile hijacking, with some cases stretching beyond a year.

This further disadvantages the affected taxpayer, the ombud notes. During the investigation, taxpayers may face restrictions on their accounts and receive limited updates, leading to frustration and uncertainty.

To add insult to injury, fraudulent VAT returns trigger compliance penalties, final demand letters, and aggressive debt collection measures against affected taxpayers. “The lack of structured fraud recovery mechanisms makes reclaiming lost funds difficult,” the report states.

During the workshop on the ombud's report, Mputa said SARS indicated that the fraud unit is still in its infancy and each investigator has an average of 130 cases which contributes to the growing backlogs and long turnaround times.

Mputa said 94 percent of cases finalised in 2024 were resolved in favour of taxpayers and approximately R21 million has been refunded to victims of eFiling profile hijacking over the past two years.

The report also notes that police are often willing but unable to assist victims because they do not know how to classify the offence. It recommends that SARS, together with SAPS, provide training on identifying tax-profile hijacking, recognising digital tax fraud and escalating cases appropriately to the National Prosecuting Authority.