South African taxpayers are being warned to ignore and delete a new scam email that falsely claims the recipient owes SARS money and is facing legal action in the High Court. The South African Revenue Service says the message is fraudulent and is designed to trick people into clicking a link that can be used to steal personal and financial information.
The scam is spreading at a sensitive time for many taxpayers, when outstanding returns, statements of account and payment arrangements can feel urgent. Scammers rely on that pressure. They use official looking formatting, legal language and fear of court action to push recipients into acting quickly before they verify anything.
This specific scam is framed as a High Court matter, with the email carrying a heading that imitates court documentation. It also includes a supposed case number and claims the recipient failed to pay outstanding tax for one or more years. The email then prompts the recipient to click a link to view the “legal document” and “case details”. SARS has warned that taxpayers must not click, must not share any information, and must only verify their tax affairs through official SARS channels.
What the scam email looks like
Reports describing the scam say the email is designed to look like a formal notice and may include:
- A heading that reads like a High Court document, including a Pretoria reference
- A case number style reference
- Allegations that tax is outstanding for one or more years
- Claims that “prior correspondence and lawful demands” have been ignored
- A call to action with a link to “view” the case file, legal document, or instructions
The link is the danger point. Once clicked, it can lead to a fake SARS page that asks for eFiling usernames and passwords, banking details, identity numbers, or other sensitive information. In some cases, scammers also use attachments, including PDFs, to make the email feel authentic and to hide malicious links.
SARS has stressed that scams change frequently, including the subject lines and formatting, so a message does not have to match one example exactly to be dangerous.
Why the “High Court” angle is used
The High Court framing is a psychological pressure tactic. Most people understand that court matters are serious, expensive and time sensitive. Fraudsters exploit that fear to reduce the chance that a person pauses to verify the claim.
South Africa’s justice system also has clear procedures for how legal documents are served. The Department of Justice and Constitutional Development has warned that summons type documents are typically served in person by the sheriff of the court or another authorised person. A surprise email demanding urgent action and directing a recipient to click a link is a red flag, especially when it claims court consequences.
SARS’s core message to taxpayers
SARS’s warning is clear. Taxpayers must not click on links in suspicious messages and must not share any personal or financial information.
SARS advises taxpayers to confirm their tax position using trusted channels only, such as:
- Logging into eFiling by typing the address into the browser or using the eFiling link from the official SARS website
- Calling SARS using official contact details published on the SARS website
- Using SARS branches or official service channels where appropriate
SARS also urges the public to report suspected phishing attempts so that the latest examples can be tracked and published in SARS scam alerts.
How to spot fake SARS messages quickly
SARS has published practical indicators that can help taxpayers identify scams before any damage occurs. Key warning signs include:
- Urgent threats of court action, blacklisting, or arrest if payment is not made immediately
- Links that ask you to “log in” outside the normal SARS website route
- Requests for passwords, pins, banking details, or card details
- Attachments that ask you to open a form, confirm details, or update banking information
- Unusual sender addresses or spelling errors, even if a SARS logo is used
- Pressure to act quickly and privately, or to avoid calling SARS
SARS has also cautioned that scammers often imitate SARS branding and may spoof email addresses to appear legitimate. Visual appearance alone is not proof.
What SARS does and does not do in real communications
This is one of the most important points for taxpayers.
SARS says it will not ask for sensitive banking details via email, SMS, or post. SARS also warns that it does not send hyperlinks to other websites, including banks, and that it will not ask for credit card details.
The safest habit is to avoid clicking embedded links and instead type the SARS website address directly into the browser. If a message claims to be from SARS, the taxpayer should verify it by checking eFiling messages inside their account, or by contacting SARS through official contact channels.
What to do if you received the scam email
Taxpayers who receive this type of email should take these steps:
- Do not click any link or open any attachment.
- Delete the email.
- If uncertain, verify your status through official SARS channels, not through the email.
- Report the email to SARS using the phishing reporting channels listed on the SARS website.
- Warn family members or staff, especially if the message was received on a shared business mailbox.
For businesses, it is also worth alerting the internal IT team or service provider, because phishing emails can be sent to multiple employees to increase the odds that someone clicks.
What to do if you clicked the link or entered details
If a taxpayer clicked the link or entered eFiling credentials, immediate action can reduce harm:
- Change the eFiling password as soon as possible using the official eFiling platform.
- If the same password is used elsewhere, change it on those services too.
- Contact your bank using official banking contact details if any banking information was shared.
- Run a security scan on the device used to open the link, especially if an attachment was downloaded.
- Report the incident to SARS, even if you are unsure what information was captured.
Taxpayers who suspect that their eFiling profile has been compromised should also review recent activity and correspondence within eFiling. Unexpected changes to personal details, banking details, or return submissions should be treated as urgent and addressed through SARS support channels.
Why this matters right now
Tax scammers are persistent because the potential payoff is high. A single successful phishing attempt can expose identity data, banking information, and access to accounts used for filing and refunds. For taxpayers, the harm can include stolen refunds, unauthorised changes to banking details, and long resolution timelines to restore account integrity.
For SARS and the wider tax system, scams also damage trust and increase administrative load as more people request verification and support.
SARS has responded by publishing scam examples and reinforcing a simple rule: taxpayers should treat unexpected legal threats delivered by email and paired with a link as suspicious until proven otherwise.
What happens next
SARS is expected to continue issuing scam alerts as new variations appear. The public can also expect more collaboration between institutions, banks, and cyber security responders as phishing tactics evolve.
For taxpayers, the most effective protection remains basic digital hygiene:
- Verify, then act.
- Use official channels.
- Avoid clicking links in tax related emails.
- Report suspicious messages quickly.
