The Office of the Tax Ombud (OTO) has called on the public to submit written comments on its Draft Report into alleged eFiling profile hijacking, a growing cybercrime affecting South African taxpayers.
The draft report, released after months of investigation and stakeholder engagements, highlights systemic vulnerabilities in the South African Revenue Service (SARS) eFiling system and proposes stronger measures to protect taxpayers’ rights.
Background
Between 3 February and 5 March 2025, the OTO conducted the eFiling Profile Hijacking Survey to gather insights into taxpayers’ experiences. Preliminary findings were presented in a public workshop on 28 May 2025.
Although the draft report was initially scheduled for publication in July 2025, SARS requested additional time to respond. After delays, the draft was officially released for comment on 31 August 2025.
Key Findings
- eFiling profile hijacking is most common among tax practitioners and individual taxpayers.
- Cases predominantly involve Personal Income Tax and Value-Added Tax (VAT).
- Fraudulent transactions usually fall below R10,000, but some exceed R100,000.
- Security gaps include:
- weak authentication protocols,
- delayed SARS fraud response,
- insider threats,
- and limited taxpayer digital security awareness.
Recommendations
The OTO outlined several reforms:
- SARS: Introduce stronger authentication, enhance fraud detection, improve refund verification, and collaborate more closely with banks, CIPC, and SAPS.
- Tax Practitioners: Strengthen third-party access controls and adhere to high professional conduct.
- Taxpayers: Use complex passwords, enable two-factor authentication, and regularly monitor profiles.
- National Treasury: Amend provisions of the Tax Administration Act and consider establishing an Inspector-General, as recommended by the Nugent Commission.
- South African Reserve Bank: Investigate suspicious banking activity linked to profile hijacking cases.
Public Participation
The draft report is available on the OTO website: Read here.
Written comments must be sent to communications@taxombud.gov.za before the deadline of 31 October 2025.
For more details, visit www.taxombud.gov.za.
