It’s October, your tax deadline is bearing down, and an email from SARS lands in your inbox: a refund notice, or a final assessment demanding action. It looks exactly right — correct logo, proper letterhead, the tone SARS always uses. A few years ago, a scam email like this would have given itself away with bad grammar or a slightly-off logo. Not anymore.
On 2 October, IOL reported that cybercriminals are now using AI to generate SARS phishing emails that are genuinely difficult to tell apart from the real thing. For small-business owners, who are already juggling invoices, payroll and a dozen other things during filing season, that’s a serious problem — and exactly the moment scammers are counting on.
For years, the advice on spotting a scam email was fairly simple: look for spelling mistakes, a wrong logo, or phrasing that doesn’t sound like an official body. Those red flags worked because scammers writing in a hurry, often in a second language, left clues behind.
AI tools have erased most of those clues. Experts quoted by IOL point out that AI can now produce a SARS-style email with perfect spelling, the correct branding, and language that reads exactly like a real government notice. The old gut check — “this looks a bit off” — simply doesn’t work as reliably as it used to, because the thing that used to look off has been polished away.
Scammers are deliberately timing these emails around the 23 October non-provisional filing deadline, because urgency makes people act before they think. A few specific patterns to watch for:
None of these are new tactics on their own. What’s new is how convincing the wrapping around them has become.
With the content of these emails no longer a reliable giveaway, the advice has to shift from “does this look right?” to “did this arrive through the right channel?” As the experts IOL spoke to put it, trust should attach to the channel, not the content.
In practice, that means one simple habit: never act on a tax-related email by clicking the link or attachment inside it. Instead, open a browser yourself and log into SARS eFiling directly, the same way you always do. If there’s a genuine refund, assessment or notice waiting for you, it will be sitting there in your eFiling profile — no email required to find out. If you’re not sure whether something is genuine, that’s also exactly the kind of question your accountant or bookkeeper should be fielding for you, rather than you guessing on your own.
Some things haven’t changed, no matter how good the scam emails get: SARS will never ask you to send a password, PIN or one-time PIN (OTP) by email, SMS or on social media. Any message that asks for this, however official it looks, is a scam.
It’s also worth a word of caution about AI in the other direction. If you’re tempted to paste your tax return or financial details into a public AI chatbot to get a quick explanation, don’t. A tax return reveals a detailed financial profile of your business, and you have no control over what happens to that information once you’ve typed it into a tool that isn’t built to protect it. Use AI, if you use it at all, to understand a concept in general terms — not as a stand-in for your accountant on your actual numbers.
Filing season already brings enough pressure without having to play detective on every email that lands in your inbox. At FAASTT, we only ever raise genuine tax matters with clients through channels you already know are us — never by asking you to click a link or hand over login details by email or SMS.
If an email claiming to be from SARS ever lands in your inbox and something feels slightly off — or even if nothing feels off and you’d simply rather check — forward it to us before you click anything. A thirty-second question to your accountant is a lot cheaper than a scam that gets through.