South Africa Tax Season puts Cyber Security under the Spotlight

Every year between July and October, millions of South Africans use SARS eFiling and the SARS MobiApp to submit highly sensitive financial and personal information.

In 2025 alone, more than 10 million unique users accessed SARS’ digital platforms, creating an attractive target for fraudsters seeking to steal identities, banking credentials and tax refunds.

Tax season has become prime time for cybercrime

The predictable surge in online tax activity has turned filing season into a lucrative opportunity for cybercriminals.

Throughout the 2025 filing period, SARS, Standard Bank, Capitec and Nedbank all issued public warnings about a rise in phishing attacks, fake tax refund notifications and attempts to hijack eFiling accounts.

Former SARS Commissioner Edward Kieswetter repeatedly reminded taxpayers that SARS never requests personal or banking information via email or SMS, urging users to remain vigilant.

Although there are no official figures showing how many taxpayers were successfully defrauded during the 2025 tax season, the volume of alerts from financial institutions and industry bodies points to a significant increase in tax-related cybercrime.

How fraudsters hijack eFiling accounts

According to the South African Fraud Prevention Service, criminals increasingly exploit the convenience of SARS’ digital systems, particularly the auto-assessment process.

Investigations by the Office of the Tax Ombud into hijacked eFiling profiles identified weaknesses in authentication, profile management and fraud detection that allowed criminals to alter banking details and redirect tax refunds before victims became aware of the fraud.

Attackers typically combine several techniques:

• Data stolen through previous breaches
• Social engineering attacks
• Fraudulent SIM swaps
• Phishing campaigns
• Credential theft

A successful SIM swap is particularly dangerous because it allows criminals to intercept one-time passwords (OTPs), reset eFiling credentials and change banking information linked to tax refunds.

In many cases, once fraudsters control a victim’s mobile number, they can bypass one of the final security barriers protecting both banking and SARS accounts.

Why AI is becoming essential

For banks and fintech companies, tax season has become a major test of fraud detection capabilities.

Transaction volumes rise sharply during filing season, making it impossible for human analysts alone to monitor every login, payment and account change.

This is where AI-driven telemetry is becoming increasingly valuable.

Unlike traditional rule-based systems—which flag transactions only when predefined thresholds are breached—AI continuously builds a behavioural profile for each user.

These profiles incorporate factors such as:

• Device characteristics
• Login locations
• Access times
• Transaction history
• Normal behavioural patterns

When activity deviates from a customer’s established profile, AI can detect the anomaly in real time, often before a transaction is completed.

Modern identity protection is also increasingly incorporating behavioural biometrics, analysing factors such as typing rhythm, swipe pressure and even the angle at which a device is held. These indicators provide an additional security layer without adding friction for legitimate users.

Beyond compliance

Cyber security during tax season is no longer simply a compliance issue.

Regulatory frameworks define what organisations must protect, but they do not identify evolving threats or provide real-time defence against sophisticated attacks.

AI-driven telemetry and threat intelligence fill that gap by enabling continuous monitoring at a scale that manual systems cannot achieve.

For taxpayers, the expectation is straightforward: the platforms used to file taxes, update banking details and receive refunds should provide robust protection without making security the user’s responsibility.

As tax fraud becomes more sophisticated, AI-powered detection is emerging as a critical tool for governments, banks and fintech firms seeking to protect customers while maintaining a seamless digital experience.

The post South Africa Tax Season puts Cyber Security under the Spotlight appeared first on FurtherAfrica.