To curtail ongoing eFiling profile hacking, the Office of the Tax Ombud (OTO) recommends that all stakeholders adopt enhanced security practices.
The OTO yesterday (1 October 2025) published the Draft Report into alleged eFiling Profile Hijacking for public comment. The closing date for submissions is 31 October 2025.
Key findings highlighted in the report include:
- eFiling profile hijacking is most prevalent among tax practitioners and individual taxpayers.
- The majority of cases involve Personal Income Tax and Value-Added Tax (VAT).
- Fraudulent transactions typically involve amounts under R10 000 but can reach up to R100 000.
- Vulnerabilities include inadequate authentication processes, challenges in fraud detection, delayed SARS response times, insider threats and low digital security awareness among taxpayers.
Key recommendations included in the report include:
- South African Revenue Service (SARS): Enhance authentication protocols, improve fraud detection and refund verification systems, boost taxpayer education, and strengthen collaboration with banks, the Companies and Intellectual Property Commission (CIPC) and the South African Police Service (SAPS).
- Tax Practitioners: Implement stricter controls on third-party access and uphold high professional conduct standards.
- Taxpayers: Use strong passwords, activate two-factor authentication and regularly monitor eFiling profile activities.
- National Treasury: Amend certain provisions in the Tax Administration Act and establish an inspector-general as recommended by the Nugent Commission of inquiry.
- South African Reserve Bank: Investigate banking irregularities linked to eFiling profile hijacking.
The draft report follows a systemic investigation conducted by the OTO into alleged eFiling profile hijacking. The investigation commenced in August 2024, following approval from the Minister of Finance on 12 August 2024.
Between 3 February and 5 March 2025, the OTO conducted the eFiling Profile Hijacking Survey to capture taxpayers’ experiences and challenges related to eFiling profile hijacking. Preliminary findings from the survey were presented during a public workshop held on 28 May 2025.
Initially, the OTO planned to publish the draft report for public comment in July 2025. However, SARS formally requested additional time to respond to the draft report and its recommendations. Consequently, on 2 July 2025, the OTO announced that the publication of the draft report would be postponed to 31 August 2025. Due to ongoing and extensive engagements with SARS, the publication was further delayed.
For more information and to submit comments, stakeholders are encouraged to visit the OTO website at www.taxombud.gov.za before the deadline on 31 October 2025.