How to check whether a message from SARS or SASSA is real

How to check whether a message from SARS or SASSA is real

"SARS: you have a refund of R3 421,80 waiting. Confirm your banking details here." Or the opposite: "You have an outstanding tax debt. Avoid legal action by paying here." Or: "SASSA: your grant has been approved. Update your details to receive payment." Public bodies such as the South African Revenue Service (SARS) and the South African Social Security Agency (SASSA) make an excellent disguise for fraud: everyone knows them, nobody wants trouble with them, and their real procedures are confusing enough for a fake message to seem believable.

These campaigns come in waves and repeat the same skeleton as the fake traffic-fine SMS and the fake parcel SMS: a well-known body + money waiting (for you or from you) + urgency + a link. Learn to check one and you can check them all.

The key rule: public bodies do not do business through links in SMSs

Remember two things:

1. SARS will never ask for your passwords, OTPs, banking PINs or eFiling login details by email, SMS, social media or phone, and it never asks for banking details in a post, email or SMS. SARS says so itself on its scams and phishing page. You deal with SARS through eFiling or the SARS MobiApp, which YOU open with your own login.
2. A real refund does not need you to "confirm your details" from a link. Anything to do with your refund or your banking details is handled inside eFiling or the MobiApp, or at a SARS branch. The same goes for SASSA: treat any SMS about your grant that contains a link, or asks for your bank details or PIN, as fake until you have checked it through SASSA's official channels.

Any message that pushes you to tap a link to receive, pay or "sort out" something with a public body is suspicious by default. Not because these bodies never send messages, but because a link is not how they handle your affairs.

What the fake message looks like

• The refund. The most effective hook around tax filing season: "you have a refund waiting", with a specific, believable amount. It takes you to a fake site that imitates eFiling, where you enter your personal and banking details.
• The debt or legal action. "Final warning before legal action", "outstanding tax debt". It plays on fear instead of hope, but the destination is the same: your details and your card.
• The grant or benefit. "Your SRD grant has been approved", "update your details to keep receiving your grant", or a "UIF payout" waiting for you. These lures target people who can least afford to lose money.
• Lookalike domains. Links containing "sars", "efiling", "sassa" or "srd" plus hyphens and extra words, on domains that are not the official ones. The real SARS website is sars.gov.za, and South African government websites use gov.za addresses. Rather than judging a link, type the address yourself and use the site's own links, for example to log in to eFiling.
• A sender that proves nothing. As with every SMS: the sender can be faked and proves nothing either way.

How to check whether anything is real

The method is the usual one: close the message and go to the official channel yourself. With public bodies it is even clearer, because the official channels are few and well known:

1. Do not tap the link. Close it.
2. Go to the official site yourself. Type sars.gov.za into your browser and log in to eFiling from there, or use the official SARS MobiApp. For a grant, use SASSA's official channels or visit a SASSA office; SASSA falls under the Department of Social Development. Do not arrive through the link in the message or a hurried search.
3. Log in with your own details and check. If there is a refund, a debt, a case or a message, it will be there. If there is nothing, the message was fake.
4. If you are not comfortable online, call the official contact numbers (looked up yourself on the official website, not taken from the message) or visit a branch in person.

If something real exists, you deal with it inside eFiling or at the office. Never through a link in a message. It is exactly the same habit we recommend for checking a call or SMS from your bank.

What to do if you already tapped or gave details

• You only tapped and closed it: almost certainly nothing happened. Block, delete and move on.
• You entered card details: call your bank's fraud line now (the number on the back of your card), block the card and ask for a new one. Watch your account over the coming weeks.
• You entered your eFiling username or password: change your password on the real eFiling as soon as possible and check your profile for changes you did not make, especially to your banking details.
• Report it to SARS: forward suspected SARS phishing to [email protected] or call the SARS Fraud and Anti-Corruption Hotline on 0800 00 2870. If you lost money, also open a case at your nearest police station (SAPS).
• Report the sender's number in the spam numbers directory.

Quick questions

Does SARS ever really send SMSs? SARS does contact taxpayers, but you never need the link in a message: you can always check for yourself on eFiling or the MobiApp. SARS also keeps a list of current scam emails and SMSs on its scams and phishing page. When in doubt, treat the message as unchecked and look in eFiling.

And SASSA? The same logic: information, yes; sorting out your grant through a link in an unexpected message, no. Never share your PIN, your OTPs or your banking details with anyone who contacts you about a grant, and check anything about your grant through SASSA's official channels.

Are these messages more dangerous during filing season? Yes, because the context helps the scammer: everyone is thinking about their tax return, and "a refund waiting" fits right in. During filing season, be twice as suspicious of any tax message with a link.

Is an email with the official logo more trustworthy than an SMS? No. A logo can be copied in a minute and the email sender can be faked too. Apply the same rule: no links from the message; go to the official site yourself.

If you have received one of these messages, report it in the NoCall spam numbers directory: these campaigns change their disguise with the season, and your report helps the next person recognise the pattern in time.