Africa-Press – South-Africa. The Office of the Tax Ombudsman (OTO) is investigating 16,000 South African Revenue Service (Sars) e-filing profile hijackings that has seen taxpayers lose their tax refunds to cyberfraud criminals.
TimesLIVE’s sister publication, Sowetan reported on Friday the number of hijacked profiles has increased as criminals adapt tactics to breach the tax authority’s platform. This raises concerns about the security of taxpayers’ information with Sars.
Profile hacking is when criminals impersonate taxpayers, take control of their online accounts, file fraudulent returns and pocket the refunds. The hijacking of a taxpayer’s profile usually happens from targeted identity theft, through the misuse of login credentials, phishing and SIM swaps, among other things.
The hijacking incidents were most common with personal income tax accounts, followed by VAT accounts.
The OTO launched an investigation into the profile hijackings a year ago after receiving complaints from several taxpayers.
Sowetan’s sister publication, Sunday Times, reported in 2024 that a Sandton-based IT firm lost about R20m after its e-filing profile was hijacked.
The ombud’s office conducted the review after obtaining permission from finance minister Enoch Godongwana. At the time, the office said just more than 305 “participants” — including taxpayers and tax practitioners — had attended their public engagements.
Sowetan can reveal the number of allegedly hijacked profiles has risen to close to 16,000. Individual taxpayers have lost up to R100,000 through this fraud.
The release of the report has been delayed for months. It was initially scheduled to be released for public comment on July 7 but later pushed to August 31.
At the time, the OTO said the decision followed a formal request from Sars commissioner Edward Kieswetter for an extension to allow the revenue service additional time to respond to the preliminary findings and recommendations contained in the draft report.
The Sowetan understands the delay has been caused by disagreements between tax ombud Yanga Mputa and Kieswetter about the contents of the report.
After the Sunday Times story was published in 2024, Sars denied any negligence. “We have found no negligence or liability can be imputed to Sars, meaning Sars can therefore not be held liable for the criminal action reported by the Sunday Times,” Kieswetter said at the time.
The Sowetan understands Sars has maintained this position.
The ombud’s senior manager for communications, Pearl Seopela, did not respond to Sowetan’s questions but said: “We will keep you updated once the report is released.”
Sars spokesperson Siphithi Sibeko also did not answer specific questions about the number of profiles hijacked. “Sars is committed to enable and empower taxpayers to engage the organisation by providing clarity and certainty and making it easy and simple for them to meet their legal obligation,” he said.
“In this respect, it works closely with role players in the tax ecosystem, including the OTO. Sars has collaborated extensively in this regard with the OTO. Such co-operation enables the organisation to resolve matters that affect taxpayers, including compromised profiles. This work is ongoing between [the] parties.”
For More News And Analysis About South-Africa Follow Africa-Press
