Draft report on eFiling hijacking: Almost 16 000 cases and R21 million

The Office of the Tax Ombud published the draft report on alleged eFiling Profile Hijacking for public comment on Wednesday. The report shows that eFiling hijacking is most prevalent among tax practitioners and individual taxpayers.

The purpose of the report is to assess the scope and impact of eFiling profile hijacking, identify factors that make taxpayers vulnerable, evaluate South African Revenue Service’s (Sars) response mechanisms to taxpayers who report profile hijacking and suggest areas for improvement.

After the survey was conducted, Sars shared these figures with the Ombud about eFiling hijacking:

• Sars receives, on average, a monthly intake of 387 new e-filing profile hijacking cases
• A total of 15 968 cases were reported to Sars
• 94% of cases Sars finalised in 2024 were resolved in favour of taxpayers
• Sars refunded approximately R21 169 678.91 to victims of eFiling hijacking over the past two years.

ALSO READ: Report by Sars and Tax Ombud to reveal pattern of e-filing hijackings

Survey to identify eFiling challenges and experiences

The Ombud conducted the eFiling Profile Hijacking Survey earlier this year to capture taxpayers’ experiences and challenges with eFiling profile hijacking. About 393 taxpayers and tax practitioners responded to the survey questions.

According to the Ombud the integrity of the Sars eFiling system is critical for efficient tax administration and taxpayer compliance.

“The rapid increase in eFiling profile hijacking has presented significant challenges for South African taxpayers and tax practitioners and raised concerns regarding the security of the Sars eFiling system.

“Fraudsters exploited vulnerabilities of the Sars system to gain unauthorised access to taxpayer accounts, modify banking details and redirect tax refunds for fraudulent gain.

“These unauthorised activities often lead to significant fraudulent conduct, such as the redirection of tax refunds to bank accounts the fraudsters control. Victims of these hijackings suffer not only financial loss but also compromised personal and tax information, as well as administrative challenges in regaining control over their tax affairs.”

ALSO READ: Investigation into eFiling hijackings highlights the vulnerabilities

Key findings include majority of cases involve personal income tax and Vat

Key findings highlighted in the report include:

• The eFiling profiles of tax practitioners and individuals are mostly targeted in hijacking profiles on the platform.
• The majority of cases involve personal income tax and value-added tax (Vat).
• The fraudulent transactions usually involve amounts under R10 000, but they could be up to R100 000.
• Vulnerabilities to eFiling hijacking include inadequate authentication processes, challenges in fraud detection, delayed Sars response times, insider threats and low digital security awareness among taxpayers.

The report’s key recommendations include:

• Sars must enhance authentication protocols, improve fraud detection and refund verification systems, boost taxpayer education and strengthen collaboration with banks, the Companies and Intellectual Property Commission (CIPC) and the South African Police Service (Saps).
• Tax practitioners must implement stricter controls on third-party access and uphold high professional conduct standards.
• Taxpayers must use strong passwords, activate two-factor authentication and regularly monitor eFiling profile activities.
• National Treasury must amend certain provisions in the Tax Administration Act and establish an Inspector-General as recommended by the Nugent Commission of Inquiry.
• The South African Reserve Bank must investigate banking irregularities linked to eFiling profile hijacking.

ALSO READ: Phishing scams target eFiling: How taxpayer profiles are being hijacked

Stakeholders and tax payers can comment on report

Stakeholders and tax payers can comment on the report by 31 October by visiting the Ombud’s website at www.taxombud.gov.za.

The Ombud’s office says by inviting public participation, the Ombud aims to develop a robust and effective response to eFiling profile hijacking to ensure the protection of taxpayers’ rights and enhance trust in South Africa’s tax administration system.

For more information and to submit comments, stakeholders are encouraged to visit the OTO website at www.taxombud.gov.za before the deadline on 31 October 2025.

NOW READ: Tax Ombud working with Australia to stop e-Filing profile hijackings