Tax and SARS knowledge base
How do I report a compromised SARS eFiling profile?
How do I report a compromised SARS eFiling profile?
Last reviewed:
Direct answer
If you think a SARS eFiling profile has been compromised, use the SARS Online Query System Report Digital Fraud query. SARS says the taxpayer, a registered representative or a tax practitioner can make the report, provided the required supporting documents are attached. SARS creates a case to investigate possible fraud.
Do not send passwords, one-time pins, banking PINs or eFiling credentials to anyone. SARS says it does not request those details by email, SMS, social media or phone.
What this means in practice
A compromised profile can involve suspicious changes, messages, login activity or account information. The safe first response is to preserve what you can see without sharing secrets or following links in a suspicious message. Use a web address or app route you opened independently, not a link the message supplied.
SOQS has a specific digital-fraud query. Select it only for suspected profile compromise, then follow the on-screen fields and document requirements. SARS says a case is created for it to investigate possible fraud. A case number is important, but it is not an immediate finding that fraud occurred or a promise that an assessment, refund or bank detail will be reversed.
The report should be accurate. Identify the taxpayer, describe the concern using the available evidence and attach only the documents the SOQS screen asks for. Keep copies of all evidence and the confirmation.
Step-by-step
- Stop and protect your information.
Do not reply to suspicious messages or disclose passwords, OTPs, banking PINs or eFiling credentials. Avoid a link embedded in an unexpected email or SMS.
- Preserve limited evidence.
Save screenshots of suspicious messages, visible account changes, dates, sender details and references. Do not alter the records you intend to report.
- Open SOQS through the SARS website.
Locate the Report Digital Fraud query in the SARS Online Query System. SARS says this query is used where a taxpayer profile has been compromised.
- Select the correct reporting capacity.
The taxpayer may report for themselves. A tax practitioner or registered representative may report for someone else in the relevant capacity. Choose only the role that applies.
- Complete the mandatory information and upload required evidence.
Follow the form, complete the CAPTCHA and attach the specific documents shown on the upload screen. Check details before submission and do not attach confidential information that SARS has not requested.
- Submit the report and retain the case number.
SARS says a case is created for investigation. Save the confirmation, query details and document copies. Respond only through official SARS channels if SARS later requests more information.
Documents and records to keep
- Screenshots or copies of suspicious messages.
- Dates, sender details and visible profile or account changes.
- SARS notices or account records that help identify the concern.
- The SOQS confirmation and case number.
- Any later official SARS correspondence.
Important limits and exceptions
Reporting digital fraud does not decide whether a message is fraudulent, establish liability or guarantee a recovery. SARS investigates the case. Do not make assumptions about a refund, assessment or account correction while the matter is unresolved.
This process is for suspected compromise of a SARS taxpayer profile. It does not replace checking a genuine tax assessment, lodging a formal tax dispute or correcting third-party certificate data through the provider that supplied it.
If a scammer has contacted you, the message can look professional. SARS has warned that scammers use sophisticated templates. A convincing appearance is not a reason to share access or banking information.
When to get tailored advice
Get tailored help if an assessment, bank detail, refund or submitted return appears to have changed, or if you cannot identify the account activity. Help is also useful if the taxpayer is represented and the authority records need checking.
TaxProof can help organise the evidence and chronology for the digital-fraud report. SARS investigates possible profile fraud and controls any account-level action.
Related TaxProof guides
- How do I identify a fake SARS email, SMS, or refund message? (B03-ADM-005)