PRETORIA, South Africa — As the 2026 tax season officially kicks off on July 1, South African taxpayers are being urged to remain highly vigilant against a sophisticated new wave of tax season cyber scams and phishing attacks. Cybersecurity experts warn that criminals are increasingly leveraging artificial intelligence to hijack accounts and steal sensitive financial information through fake fraud notifications.
Lucas Molefe, a cybersecurity expert at ESET, notes that the current financial year’s tax filing period has become a prime “hunting season” for cybercriminals. The most prevalent threats involve phishing emails, fraudulent SMS messages, and deceptive communications designed to harvest account details. According to Molefe, the ultimate goal for these attackers is account hijacking, which provides them with direct access to victims’ funds.
While traditional phishing attempts were often riddled with spelling mistakes and poor grammar—making them relatively easy to identify—technology has significantly evolved. Molefe explains that artificial intelligence has allowed scammers to craft highly legitimate-looking messages. These AI-enhanced scams frequently incorporate a sense of hurry and urgency to pressure taxpayers into making mistakes, such as expecting a refund and hastily clicking on a malicious link.
“AI has modified them to do more things, but essentially they still use the same spamming tactics,” Molefe explained, emphasizing that the core objective remains getting users to click on fraudulent links to gain unauthorized access.
To combat these advanced threats, Molefe advises taxpayers to adopt a “stop and verify” approach. When receiving an unexpected email or notification, users should hover over embedded links to reveal the actual destination URL. Even if the display text claims to be from the South African Revenue Service (SARS), the underlying link may direct to a malicious site.
Instead of clicking on email links, Molefe recommends navigating directly to the official SARS website or using the official, highly secured SARS mobile application to verify if any information requests are legitimate. He stresses that SARS has invested heavily in technology to ensure the mobile app is a secure platform for taxpayers.
Molefe also highlights the importance of self-education, urging users to pay attention to security alerts provided by SARS and their banking institutions. He shared a personal example of receiving a notification on his banking app detailing the latest SARS scams to watch out for. He notes that these phishing attempts affect everyone, whether in the workplace or outside the workplace, as criminals are ultimately after the same sensitive information regardless of the environment.
Beyond vigilance, implementing robust technical safeguards is critical. Molefe strongly recommends enabling two-factor authentication (2FA) or multi-factor authentication on all financial and tax-related accounts, including setting it up to send a verification code to a cell phone.
Comparing cybersecurity to home security, Molefe illustrated the necessity of layered defenses: “If someone has a house and a yard, they’ll have a dog, a camera, and also have a service to protect them. Why are they putting all those layers? Because one layer can never be enough.”
He concluded that even if a password is compromised through a deceptive link, multi-factor authentication ensures that only the legitimate user can access the account, providing a vital final layer of protection during this year’s tax season.
