Digital Fraud and eFiling

With the rise of technology, the risk of data breaches and digital fraud has also escalated. The South African tax system is not exempt from these threats.

In 2019, SARS Commissioner Mr. Edward Kieswetter dedicated himself to transforming SARS into a digital organization through technology and artificial intelligence. Thanks to these efforts, SARS is now recognized as one of the most technologically advanced revenue services globally. However, between 2021 and 2024, SARS has faced unprecedented levels of digital fraud, leaving users to suffer from eFiling profile hijackings.

In February of this year, eFiling users, particularly tax practitioners, began to observe an increasing trend of breaches in eFiling profiles, with some instances resulting in complete hijackings. This issue intensified in March and April 2024, with reports of at least 10 eFiling breaches occurring each week. Such a situation is concerning for any organization that manages sensitive taxpayer information.

• The registered representative plays a crucial role in gaining access to an eFiling profile. This individual serves as the custodian of the eFiling profile and has the authority to approve the transfer of the profile between users. Typically, the designated registered representative is one of the directors listed with the CIPC. Consequently, a change in directorship at the CIPC enables fraudsters to update the registered representative information at SARS using the newly revised director details from CIPC. This paves the way for an effortless fraudulent transfer of the eFiling profile.
• In some cases, even if the registered representative stays the same, a fraudulent SIM swap may occur to acquire the necessary cell phone number for receiving a One-Time Pin (OTP). After the SIM swap is completed, the eFiling profile username can be accessed, and password changes can be made with OTP authorization.
• Despite being less advanced, fraudsters would set up new eFiling profiles for individuals and establish 'shared access' to infiltrate existing profiles. This tactic enabled them to file fraudulent income tax returns with fictitious refunds, all while keeping the designated tax practitioner unaware of any misconduct. They would also modify the banking details in the system to ensure these fabricated refunds were received.

Despite SARS establishing a dedicated channel for reporting incidents of digital fraud, this initiative has had minimal impact on dissuading fraudsters from their activities. Trust among tax practitioners and the public appears to decline daily, as SARS is perceived to be doing little to actively investigate and address the reported cases of digital fraud. Although SARS has firmly stated that no employees are involved in submitting tax returns or altering banking details to receive refunds, many continue to speculate that some breaches might stem from insider involvement. Regrettably, the defensive and denial-based stance taken by SARS has done little to restore public confidence.

Following the hijacking of eFiling profiles, there is a significant amount of work required to restore these profiles to their rightful owners, rectify the fraudulent returns, and recover the fictitious refunds. Tax practitioners often find themselves in a relentless struggle, desperately seeking feedback from SARS regarding ongoing fraud cases. It’s important to note that in 9 out of 10 instances, debt collection actions proceed against the taxpayer without regard for the background or the ongoing fraud investigation. Reports indicate that some cases dating back to 2021 remain unresolved, while penalties and interest continue to accumulate against the taxpayer.

In response to the hijacking of eFiling profiles, SARS has recently introduced a series of measures aimed at reducing the risk of future breaches and preventing the payment of fraudulent refunds:

1. SARS has effectively programmed its systems to automatically impose stoppers on accounts as soon as a digital fraud case is reported. This ensures that, regardless of any changes to banking details, refunds will not be processed from those accounts unless the Cyber-Crimes Task Team (CCTT) has granted permission to lift the stopper.
2. SARS has introduced a multifactor authentication feature for eFiling. Current eFiling users can activate this option, which requires both a password and either a one-time password (OTP) or authorization through the SARS Mobile App. Additionally, all new eFiling registrations will automatically come with multifactor authentication enabled.
3. SARS has limited tax practitioners from updating security details on behalf of their clients, even when they hold a valid power of attorney. The rationale is that only the rightful owners of eFiling profiles are permitted to make these changes and maintain complete control over their profiles.
4. SARS has begun to limit taxpayers from creating an eFiling profile if their contact information (emails and cell phone numbers) is already associated as security details with another profile. This action taken by tax practitioners was recently deemed fraudulent by SARS, since one individual cannot feasibly manage multiple eFiling profiles. Unfortunately, many tax practitioners found themselves at a disadvantage, as they were locked out of their profiles on May 31, 2024, due to this new regulation.

While SARS attempts to keep pace with fraudsters, there is a notable lack of collaboration with other financial institutions to address the issue effectively. It is well-known that most fraudulent refunds were funneled into bank accounts held with just two banks. One might expect that SARS would proactively engage with these institutions to identify and prosecute the offenders, but this has yet to occur.

Digital fraud continues to be a relentless game of cat-and-mouse between institutions and criminals, with fraudsters already seeking new methods to exploit the system. It remains uncertain whether SARS will transition from a defensive stance to a more proactive approach in the near future.

Original author: YOLISA DYASI, Tax Technical Specialist: Operations and Tax Administration at SAIT