Fraudsters are increasingly using artificial intelligence (AI) to make phishing e-mails and fake South African Revenue Service (SARS) websites more convincing, as taxpayers feed sensitive information into bots with tax filing deadline approaching.
This is according to Kaspersky, whose researchers have identified phishing websites imitating SARS eFiling, as well as malicious e-mail attachments disguised as tax-related documents just ahead of the 23 October filing deadline for non-provisional individual taxpayers.
Kaspersky’s warning followed a new wave of SMS and e-mail scams claiming that taxpayers were owed refunds and directing them to fraudulent websites. In one case, SARS confirmed that an SMS or e-mail offering a R48 900 refund was a phishing scam impersonating the tax authority.
The security company adds that AI is making fraudulent correspondence harder to spot. In July, SARS warned that scammers were using AI to generate professional-looking e-mail templates that were more difficult to identify as fraudulent.
This means some of the traditional warning signs, including poor wording and amateur-looking correspondence, are becoming less reliable, says Kaspersky, noting that a professional-looking message is not necessarily legitimate.
Help, I need somebody
There is another AI-related risk during tax season, cautions Kaspersky. Taxpayers may turn to chatbots and other AI tools for help understanding returns or tax questions, but it warns that tax documents contain sensitive personal and financial information, while AI-generated responses can contain errors.
Uploading tax records, identity documents, banking information or other confidential data to an AI service could therefore expose information that would otherwise remain private, says the online security company.
“AI can make complicated information easier to work through, but taxpayers should be careful about the information they provide to an external service. A tax return contains a detailed picture of someone’s financial and personal life,” says Chris Norton, general manager for Sub-Saharan Africa at Kaspersky.
Norton adds: “Sensitive records should stay out of public AI tools, and important tax information should be checked through trusted sources.”
Mark Walker, T4i director and former MD of IDC South Africa, says: “With AI, the threat is amplified significantly, both from the taxpayer and the SARS perspectives.”
Taxpayers now receive highly-personalised and professionally-branded communications, purportedly from SARS, that connect to a “tax assistant or advisor” to help complete returns, says Walker. “These are extremely convincing and easily trap the unaware or rushed taxpayer into a world of pain.”
South African Institute of Taxation CEO Professor Keith Engel says the tax profession has an important role to play as SARS modernises its administration.
“Tax professionals must also evolve. Professional competence, ethical conduct and a strong understanding of the changing tax environment will remain essential to building confidence in the tax system.”
Thousands and thousands
One fake eFiling page asks victims for their username, password and phone number, while another uses what appears to be an Adobe PDF sign-in screen to obtain e-mail credentials, Kaspersky notes.
The security company has also detected attachments with filenames such as “Tax Returns Of RXX,XXX.XXX” and “Final_Assessment_Notification-2026-0X-0X.pdf”. The accompanying e-mails use phrases such as “Refund due” or “SARS letter of demand” to encourage recipients to open the files.
“By this point in the tax season, people are used to receiving messages about returns, assessments and refunds, so an e-mail like this may not immediately look out of place,” Norton says.
“This is what scammers rely on. The closer we get to the deadline, the easier it is to act quickly because you think you are dealing with something that needs your attention.”
Caught red-handed
This journalist received an e-mail, which purported to be a “SARS refund notification”, via a legacy e-mail address that had never been provided to SARS. While the displayed sender tried to make the message appear to originate from SARS eFiling, including using the taxman’s logo, the underlying e-mail data told a different story.
ChatGPT’s analysis indicated the actual sender was mail@jfgroup-kw.com, with the message-ID also generated from the jfgroup-kw.com domain. When the domain was subsequently accessed, Bitdefender identified it as a phishing page that it had “blocked for your protection”.
The technical trail also pointed away from SARS, says ChatGPT. “The headers recorded an IP address identifying the internet connection or server involved in transmitting the e-mail, showed it passing through a UK-named mail server, and indicated it had been submitted using credentials associated with an e-mail account at inspirewmc.org,” the bot said.
ChatGPT uncovered that the e-mail originated from IP address 139.28.85.223 and was relayed through server816.bigwetfish.co.uk, while the authenticated account associated with the transmission appeared as dstsvsv@inspirewmc.org.
Mix-and-match
ChatGPT adds: “Most significantly, the message was authenticated using an account at inspirewmc.org, while the apparent sender and message-ID used jfgroup-kw.com. That mismatch is a strong indicator that the visible identity presented to the recipient was not the identity of the system actually transmitting the e-mail.”
The headers do not, however, establish who was behind the e-mail, or whether the unrelated domains and infrastructure were knowingly involved, says ChatGPT. “An e-mail account or server can itself be compromised or otherwise abused to distribute phishing messages,” the AI tool cautions.
This journalist also received four e-mails containing supposed SARS notices of assessment between June and July 2026. When ChatGPT examined the attached PDF files in a controlled environment, it found that the notices demanded payments of between R1 860 and R1 900 and instructed the recipient to pay the money directly into FNB bank accounts.
The notices used SARS branding and warned of legal action, additional penalties and even imprisonment for non-payment. However, the banking details varied, and there was also an instruction to send proof of payment to pop@sarscollections.com, rather than an official SARS e-mail address with a sars.gov.za domain. Chrome returned “this site can’t be reached” for the ‘sarscollections’ domain.
“The closer the deadline gets, the more tempting it can be to deal with a tax message immediately. Taking a few minutes to verify it through an official channel can be the difference between completing your return successfully and handing valuable information to a scammer,” says Norton.
Share
