Cybersecurity & eFiling Profile Recovery
Report Digital Fraud & Profile Hijacking
Report unauthorized SARS eFiling profile takeovers, suspicious RAV01 banking detail changes, identity theft, or phishing scams directly to SARS Digital Security.
Explore 100+ accounting & tax services with transparent fixed prices and clear completion times in our online store.
Accredited Professional Memberships & Regulatory Compliance
CIBA MemberBiz Accountant
SAIT MemberTax Practitioner
S
SARS RegisteredTax Practitioners
CIPC AgentCompany Registry
4.9 / 5.0
Verified Google Reviews • South Africa's Top Online Accounting & Tax Practice
Emergency Action & Turnaround
Emergency Freeze & Profile Recovery SLA
Refund Stop: 24–48 Hours | Forensic Recovery: 7–21 Business Days
eFiling Security Path: Log into eFiling (if accessible) → Home → User → Change Password & Inspect SARS Registered Details (RAV01 Bank Account)
Verified SARS Portal
Lodge an Urgent Digital Fraud Report with SARS
Use official SARS digital security portals to freeze compromised profiles and report unauthorized access.
Fraud Reporting Steps
How to Report Digital Tax Fraud & Recover Your Profile
01
Open the SARS Report Digital Fraud Portal on SOQS Immediately
Navigate to tools.sars.gov.za/sarsonlinequery/ReportDigitalFraud as soon as you receive an unexpected SARS SMS/email about a login, password reset, representative transfer, or RAV01 bank account change.
02
Select the Compromise Category & Enter Your SA ID + Tax Number
Select "Unauthorized eFiling Profile Access", "Fraudulent Banking Detail Change", or "Identity Theft / Fake Return Submitted" and provide your 13-digit SA ID number and 10-digit tax reference number.
03
Depose a Sworn SAPS Affidavit & Gather Bank Proof
Visit your nearest South African Police Service (SAPS) station to obtain a sworn affidavit or CAS case number confirming unauthorized access to your SARS profile, plus a stamped bank confirmation letter (< 3 months old).
04
Upload Verification Selfie, ID, Bank Letter & SAPS Affidavit
Upload: (1) Certified SA ID copy, (2) Photo of yourself holding your ID ("selfie with ID") with a handwritten note reading "Update my details", (3) Official bank confirmation letter, and (4) SAPS affidavit.
05
SARS Fraud Unit Freezes Refunds & Restores Profile Ownership
SARS Digital Fraud places an immediate protective stop on outgoing refund payouts (within 24–48 hours) and restores your verified login and RAV01 contact details after forensic review (7–21 business days).
Hijacking Vectors & Recovery Rules
Common eFiling Hijacking Scenarios & Verification Requirements
Tax Season Refund Hijacking via Cloned SIM / Phishing OTPs
Syndicates use phishing emails ("SARS Refund Available – Click to Verify") or SIM-swap attacks to hijack eFiling profiles during July–October, submit inflated fictitious ITR12/VAT201 refunds, and divert payouts to mule accounts.
Unauthorized Tax Practitioner / Representative Transfer Requests
If you receive an eFiling email asking to approve a profile transfer to an unknown practitioner, NEVER click approve—lodge a Digital Fraud report immediately to block the shared access request.
Missing "Selfie Holding ID" on Profile Recovery Submissions
SARS Digital Security will not reset compromised login credentials or RAV01 email/mobile numbers unless the submission includes a clear photo of the taxpayer holding their original green barcoded ID or Smart ID card.
FraudulentIRP5s or Fake Medical Credits Submitted Under Your Name
If a hijacker submitted a falsified ITR12 or VAT201 before you regained control, a formal Section 104 objection and forensic reversal request must be lodged so you are not held liable for the clawback debt.
Frequently Asked Questions
What should I do in the first hour if my SARS eFiling profile is hacked?
Immediately submit an urgent report at tools.sars.gov.za/sarsonlinequery/ReportDigitalFraud to trigger an emergency refund freeze, forward phishing emails to phishing@sars.gov.za, call 0800 00 7277 to place a security stop on your tax number, and obtain a SAPS affidavit.
How fast does SARS freeze a compromised profile after reporting Digital Fraud?
Filing a Digital Fraud report on SOQS places a high-priority security flag on your tax number within 24 to 48 hours to block unauthorized bank detail changes and refund payouts. Full profile credential recovery and forensic investigation typically take 7 to 21 business days.
What documents does SARS require to recover a hijacked eFiling profile?
You must upload: (1) a certified copy of your SA ID or passport, (2) a clear photograph of yourself holding your ID next to your face, (3) a bank-stamped confirmation letter (< 3 months old), (4) proof of residential address, and (5) a sworn SAPS affidavit detailing the unauthorized access.
What if the fraudster already filed a fake tax return and stole the refund?
Once SARS Forensic Investigation confirms the profile was hijacked and the refund was paid into a third-party fraudulent bank account without your negligence, SARS reverses the fraudulent assessment from your Statement of Account after completing its investigation.
Can My Accountant help recover our company or personal eFiling profile and secure it?
Yes! As accredited SARS Registered Tax Practitioners (PR-0098553), we assist clients with RAV01 identity verification, portfolio linking, and reversing unauthorized changes made on hijacked profiles.
Related SARS Security & Recovery Guides
Registered SARS Tax Practitioners
Need Expert Assistance? Let My Accountant Handle SARS For You
Avoid SARS penalties, audit complications, or endless waiting on hold. Our registered SAIT tax practitioners can resolve your query, submit outstanding returns, and represent you directly with SARS.
Fast SARS Dispute & Debt Relief Verified TCS & Direct Power of Attorney