Tax Ombud releases draft report on eFiling Profile Hijacking for public comment

THE Office of the Tax Ombud (OTO) has this week published the Draft Report into alleged eFiling Profile Hijacking for public comment.

- DIEKETSENG MALEKE

The report aims to unpack the scope and impact of this growing threat, assess how vulnerable taxpayers are to it, evaluate the South African Revenue Services (Sars)'s response mechanisms, and offer recommendations for improvement.

At the heart of the issue is the Sars eFiling profile, a digital identity created by taxpayers or tax practitioners on the Sars eFiling portal. When this profile is hijacked, it means that unauthorised individuals have unlawfully accessed, taken over, or manipulated it, often with serious financial consequences.

According to the OTO, eFiling profile hijacking can occur through various methods of identity theft.

"Criminals may physically steal wallets, documents, or mail containing sensitive data. Others resort to dumpster diving, sifting through discarded paperwork to extract personal information. But the most prevalent and dangerous methods are rooted in cybercrime," the report says.

Fraudsters use phishing emails, spoofed websites, and malicious software to trick individuals into revealing confidential data.

Social engineering tactics are also common, where scammers manipulate victims through fake customer service calls, deceptive SMS messages, or social media interactions to gain access to personal details, the report revealed.

The report outlines several types of eFiling profile hijacking. Phishing scams are among the most widespread, with fraudsters impersonating legitimate organisations, often government agencies or banks, to lure victims into clicking on fraudulent links and entering sensitive information.

Sars has reiterated that it will never request eFiling details, passwords, or banking information via email or phone.

Another common tactic is the tax refund scam, where criminals use stolen identities to file fraudulent tax returns and redirect legitimate refunds into their own accounts by altering banking details on hijacked profiles.