Big stack of papers with the label tax refund scam.
The Office of the Tax Ombud heard from tax practitioners how they feel like the South African Revenue Services (Sars) accuses them of eFiling profile hijacking, while also hindering them from rendering their services.
The Ombud has been looking into allegations of eFiling profile hijacking and has since released a draft report of its findings, which includes recommendations. On Wednesday, the Ombud heard mostly from tax practitioners about how the recommendations made can be reworked.
A representative from the Ombud said they are looking into publishing the final report by the second week of February 2026.
ALSO READ: Draft report on eFiling hijacking: Almost 16 000 cases and R21 million
Draft report into eFiling profile hijacking
The report was commissioned with a focus on assessing the scope and impact of eFiling profile hijacking, identifying factors that make taxpayers vulnerable, evaluating Sars’ response mechanisms to taxpayers who report profile hijacking and suggesting areas for improvement.
“The rapid increase in eFiling profile hijacking has presented significant challenges for South African taxpayers and tax practitioners and raised concerns regarding the security of the Sars’ eFiling system,” said the Office of the Tax Ombud.
“Fraudsters exploited vulnerabilities of the Sars system to gain unauthorised access to taxpayer accounts, modify banking details and redirect tax refunds for fraudulent gain.”
Recommendations for eFiling profile hijacking
The first recommendations were made to Sars. One recommendation details that Sars should strengthen fraud detection while enhancing service efficiency. It was raised that the tax agency restricts tax practitioners from updating security details even when there is a power of attorney (POA).
One tax practitioner accused Sars of treating them like criminals because of this restriction. “It is a slap in the face that we as tax practitioners are treated as criminals when all we are attempting to do is assist Sars. Close the net and treat everyone fairly, ensuring everyone pays their fair share of tax,” he said.
Another one added that the link provided by tax practitioners between Sars and taxpayers is important. “The role of the tax practitioner is to represent the taxpayer. If the taxpayer has authorised the tax practitioner, especially under a POA, there is no legal basis for that authority to be overridden.”
ALSO READ: Investigation into eFiling hijackings highlights the vulnerabilities
Sars must allow tax practitioners to do more
Many taxpayers opt to make use of tax practitioners to complete their tax obligations because they do not have enough time, or they do not understand the complexity of the tax language, or it is difficult for them to navigate the Sars’ eFiling platform.
“The role of the tax practitioner is to represent the taxpayer,” said one tax practitioner. “If the taxpayer has authorised the tax, Sars is very inconsistent in what they allow and what not when it comes to tax practitioners trying to do their jobs for their clients.”
One highlighted that they deal with clients who are overseas, and having to wait for the client to update details is a nightmare, given the time zone difference between countries.
How to track changes made?
One other recommendation made in the draft report is the enhancement of security and the prevention of fraud. This can be done by allowing taxpayers to view detailed login history (IP Address, device, location) from within their profiles.
During the webinar, many tax practitioners agreed that this would help, as it is difficult to track who made what changes on an eFiling profile.
One tax practitioner said his client discovered changes to her profile that she had not made. The practitioner also confirmed that they had not made the changes, leaving it unclear whether SARS made the updates or if the profile had been hacked.
Anther practitioner highlighted that they do not believe a legitimate tax practitioner would do anything illegal. “I don’t believe there is a legitimate tax practitioner that would do funny things on a taxpayer’s account because for us this is our livelihood, and we have too much to lose.”
ALSO READ: Report by Sars and Tax Ombud to reveal pattern of e-filing hijackings
How do hijackers know?
Another recommendation made is Sars should hold refunds for additional verification when banking details are changed before a refund is claimed.
A tax practitioner asked how these hijackers know whether a taxpayer is due a refund, since the alleged profile hijacking occurs before the taxpayer even files their tax return.
“How do these hijackers know if a taxpayer is due for a refund, because profiles are hijacked before the statement of account is even issued, so who is feeding these hijackers information about taxpayers?”
One has accused the tax agency of a lack of willingness to fight these profile hijackings. “You’d swear there are people higher up who are benefitting – and rather than fight the syndicate, they are busy implementing measures that render tax practitioners almost redundant — it’s very difficult to work when every little thing requires the representative approval.”
Upgrades in digital hotline
Another key recommendation is that Sars should improve its end-to-end digital fraud process by ensuring that the tax agency’s digital hotline meets standards.
A tax practitioner said they believe a lot of Sars’ hotline issues come from unresolved phone calls. “I need to call two times, most of the time, just to get a consultant who can advise me and give me information that will actually assist me.”
Another said, “I called Sars over 30 times asking for assistance with my refund. The information was so incorrect with every agent that I spoke to. They never get back to you on time. Closer to the day, they just send a reminder and postpone the matter.”
Key recommendations to taxpayers
The draft report includes one recommendation to taxpayers: beware of phishing scams.
“Phishing scams have become increasingly sophisticated, and the outsourcing of the Sars debt management system to third parties further compounds the problem.”
NOW READ: Tax ombud’s five-year plan is to gain greater independence from Sars
About the Author
