What To Do If Your SARS eFiling Profile Is Hijacked

If your SARS eFiling profile has been hijacked, act the same day. Report it to SARS through the online digital fraud reporting tool or at a branch, call the SARS Anti-Corruption and Fraud Hotline on 0800 00 2870, change your password, and check whether your banking details or returns were changed without your permission. If SARS does not put it right through its normal channels, you can escalate to the Office of the Tax Ombud.

A hijacking usually starts with phishing. A criminal who gets your login details signs in, changes the banking details on your profile so a refund is paid into their account, or files a fraudulent return in your name to create a refund. SARS will never ask for your password, one-time PIN (OTP), banking PIN or eFiling login details by email, SMS, social media or phone, so treat any message that asks for those details as a scam.

Report the hijacking to SARS first

A diverted refund is far easier to stop before it is paid than to recover once it has left SARS, which is why the first few hours count. The quickest route is the SARS online digital fraud reporting tool at https://tools.sars.gov.za/sarsonlinequery/ReportDigitalFraud. You register a case for the compromised profile and follow the prompts, which lets SARS investigate and track it. SARS also asks you to report unauthorised changes online for investigation, or to make an appointment at your nearest branch.

You can report suspicious activity on the SARS Anti-Corruption and Fraud Hotline on 0800 00 2870, or through the SARS Contact Centre on 0800 00 7277. If your identity was used, SARS advises you to notify SARS immediately, report the matter to the police, and close any affected bank accounts.

To have the profile corrected at a branch, book an appointment and take:

• your valid ID (green ID book, ID card, passport or driving licence) and a certified copy;
• a bank statement not older than three months showing your account details, or a letter from your bank if the account was opened in the last 30 days;
• proof of your residential address, or a completed CRA01 form; and
• a power of attorney if a tax practitioner acts for you.

Re-secure the profile

Start by changing your eFiling password to a strong one you do not use on any other site. A hijacker who swapped the cellphone number or email address on your profile can keep receiving the security codes SARS sends, so confirming that the contact details on the profile are yours, and correcting them if they were changed, is part of the branch verification above. Until that is done, the profile stays exposed to whoever altered it.

Because SARS never requests your login details or OTP, do not act on any email or SMS that does, and do not click links in messages claiming to be from SARS, even ones that look like a bank.

Reverse fraudulent banking-detail changes and refunds

Once you report the compromise, restoring your correct banking details runs through SARS's normal bank-detail verification. When banking details are changed, SARS verifies them before paying a refund, and that check can take up to 21 business days from the date SARS receives all the required supporting documents, after which a refund that is due is paid within 72 hours. This is why the ID, bank statement and proof of address listed above matter: they are what SARS uses to confirm the account is yours.

If a fraudulent return was filed in your name, the assessment it produced is wrong and should be disputed once the profile is secured, which is the route covered in the article on how to object to a SARS assessment. If the hijacking left returns unfiled or in a mess, see how to file outstanding tax returns. A refund is only paid where it is more than R100 and where your banking details are correct with no debt, outstanding return, verification or audit in the way, so a corrected profile also stops a future refund going astray.

A worked example

Nomsa is under 65. For the 2026 year of assessment (1 March 2025 to 28 February 2026) her taxable income is R300,000 and her employer withheld R50,000 in PAYE. Her correct tax works out as follows, using the 2026 individual tax table and primary rebate:

Tax before rebate: R42,678 + 26% x (R300,000 - R237,100) = R42,678 + 26% x R62,900 = R42,678 + R16,354 = R59,032

Less primary rebate (2026 YoA): R59,032 - R17,235 = R41,797

Refund due: R50,000 - R41,797 = R8,203

Her R8,203 refund is more than R100, so it is payable, normally within 72 hours of a finalised assessment. A hijacker who changed her banking details would have that R8,203 paid into their own account. Reporting the compromise and restoring her own banking details is what keeps the refund with Nomsa. You can estimate your own refund with the TaxRationale tax refund calculator, and checking your assessment early, especially when SARS auto-assesses you, is often how a changed refund or banking detail is first spotted.

Escalate to the Tax Ombud if SARS does not resolve it

If SARS does not fix the problem through its normal channels, lodge a formal complaint first. You can lodge a complaint on eFiling or through the SARS Complaints Management Office, and SARS sets a resolution target of a maximum of 21 business days after the complaint is logged.

If you are still not satisfied, you may approach the Office of the Tax Ombud. The Tax Ombud reviews complaints about a service, procedural or administrative matter arising from how SARS applies a tax Act. You must normally exhaust SARS's internal complaint mechanisms first, unless there are compelling circumstances, which include a complaint that raises systemic issues, one where exhausting SARS's process would cause you undue hardship, or one where that process is unlikely to produce a result in a reasonable time.