Kaspersky: SARS AI Phishing Warning South Africa Tax Scams Evolve

• Fraudsters are using artificial intelligence to create highly convincing phishing emails and fake SARS eFiling websites, making scams harder to detect.
• Kaspersky researchers identified malicious attachments and deceptive refund scams, with SARS confirming a R48,900 refund offer as fraudulent.
• AI makes traditional scam warning signs, like poor grammar, unreliable as communications appear more professional and personalized.
• Taxpayers risk exposing sensitive financial data by uploading tax documents to public AI tools for assistance, which can also provide erroneous information.
• Experts warn that AI significantly amplifies the threat, necessitating that tax professionals evolve their competence and ethical guidance to protect clients.

The integration of AI significantly amplifies the threat landscape for both taxpayers and SARS, according to Mark Walker, a director at T4i and former Managing Director of IDC South Africa.

Fraudsters are leveraging artificial intelligence (AI) to craft increasingly sophisticated phishing emails and deceptive websites impersonating the South African Revenue Service (SARS). This surge in advanced scams coincides with the approaching tax filing deadline for non-provisional individual taxpayers, set for October 23. The use of AI allows criminals to generate highly convincing digital communications, making it significantly more challenging for individuals to discern fraudulent messages from legitimate SARS correspondence.

Security firm Kaspersky has issued a warning after its researchers identified numerous phishing websites mimicking SARS eFiling portals, alongside malicious email attachments disguised as official tax-related documents. This alert followed a previous wave of SMS and email scams that falsely promised tax refunds. In one notable instance, SARS itself confirmed that a message offering a R48,900 refund was a phishing attempt, underscoring the prevalence of these deceptive tactics.

A key concern highlighted by Kaspersky is that AI capabilities are rendering fraudulent communications increasingly difficult to detect. SARS had already cautioned in July that scammers were utilizing AI to produce professional-looking email templates. This development means that traditional indicators of fraud, such as poor grammar or an amateurish appearance, are becoming unreliable as warning signs, as a polished message no longer guarantees its authenticity.

Beyond direct phishing attempts, another significant AI-related risk emerges from taxpayers' use of public artificial intelligence tools. Individuals seeking assistance with tax returns or general tax queries might turn to chatbots and other AI services, inadvertently exposing sensitive personal and financial information. Tax documents inherently contain a detailed overview of an individual's financial life, and uploading such confidential data, including tax records, identity documents, or banking details, to external AI services could compromise privacy.

Kaspersky emphasizes that while AI can simplify complex information, taxpayers must exercise extreme caution regarding the data they share with external platforms. Chris Norton, Kaspersky’s General Manager for Sub-Saharan Africa, underscored this point, advising that sensitive records should be kept out of public AI tools. He further recommended that crucial tax information always be verified through trusted, official sources, especially given that AI-generated responses can sometimes contain inaccuracies.

The integration of AI significantly amplifies the threat landscape for both taxpayers and SARS, according to Mark Walker, a director at T4i and former Managing Director of IDC South Africa. He notes that taxpayers are now encountering highly personalized and professionally branded communications, ostensibly from SARS, which may direct them to a "tax assistant or advisor" to help complete their returns. These sophisticated scams are designed to be extremely convincing, easily trapping unsuspecting or hurried individuals into potentially damaging situations.

Specific examples of these deceptive tactics include fake eFiling pages designed to solicit usernames, passwords, and phone numbers, as well as fraudulent Adobe PDF sign-in screens aimed at capturing email credentials. Kaspersky has also identified malicious attachments with filenames such as "Tax Returns Of RXX,XXX.XXX" and "Final_Assessment_Notification-2026-0X-0X.pdf," often accompanied by emails using urgent phrases like "Refund due" or "SARS letter of demand" to prompt recipients to open them. The timing of these scams, coinciding with the period when people expect tax-related communications, further enhances their effectiveness.

In light of SARS's ongoing modernization efforts, Professor Keith Engel, former CEO of the South African Institute of Taxation (SAIT), stresses the evolving role of tax professionals. This professional evolution is crucial for guiding clients through an increasingly complex and threat-laden tax season.

Lawyers and compliance officers must update client advisories and internal cybersecurity protocols to address the heightened sophistication of AI-driven SARS phishing scams. They should also warn clients about the data privacy risks associated with using public AI tools for tax-related queries involving sensitive financial information.

Source: Original reporting via security industry analysis