South Africa’s 2023 tax season will open next week, and criminals will be looking to take advantage of taxpayers who may be new to the process.

According to Aamir Lakhani, a senior security strategist at Fortinet, the room for social engineering and other cyber attacks has grown because of the work-from-home trend seen over the last few years.

“Tax-return time is open season for cybercrime, and it’s likely to be worse this year because so many people continue to work from home on various devices that are connected to unsecured networks,” he said.

Although cybercriminals use other sophisticated tactics to steal information, social engineering scams are low-hanging fruit, especially during tax season. And because of the ‘newness’ to the tax system, young taxpayers are most at risk of falling to scams, he said.

“During tax season, the prime targets for tax refund scams are small business owners, new taxpayers under the age of 25, and older taxpayers over 60.

“Cybercriminals assume these people may be less informed about tax policies and what to expect, so they may be more vulnerable to emotional manipulation. For example, the scammer may claim that the potential victim has missed an important tax deadline and pressure the victim to act quickly,” Lakhani said.

The strategist noted that criminals home in on any uncertainty surrounding tax season, and take a “spray and pray” approach to scams, hoping to catch someone in their net.

The most common approach is the forms of phishing email campaigns or phone calls from people claiming to be from the South African Revenue Service (SARS).

To appear legitimate, scammers may use stolen data with personal information, such as identity numbers. 

“They send thousands of emails, hoping that at least one person will fall victim to the attack. On the other hand, spear-phishing attacks are a targeted form of phishing that can be more difficult to detect because the emails are personalised to appear as if they were sent by someone the recipient knows,” Lakhani said.

In the past, spear phishing was challenging to implement, but now some advanced cybercriminals use machine learning and artificial intelligence to execute these attacks more efficiently.

SARS itself has already started issuing alerts about tax scams, and has over 300 different examples of how these scams could look.

How to Protect Yourself Against Tax Scams

According to Lakhani, taxpayers – young taxpayers in particular – need to be on alert for these targetted campaigns and consider the following:

• Look for grammatical issues and typos. Often, phishing emails contain errors that are easy to spot. If a message includes several spelling or grammar errors, odds are good that it is not legitimate.

• Be sceptical. Always consider any unexpected emails or phone calls claiming to be from SARS or other governmental agencies to be suspect. If you are concerned about the legitimacy of a sender or caller, don’t give the person any information. Instead, contact SARS directly to verify the caller’s identity. 

• Don’t share personal information. Don’t give out your identity number or credit card information over the phone or via email. Scammers may pressure you to do so and try to convince you that something terrible will happen if you don’t act immediately. Hang up or delete the email. 

• Warn family and friends who may be vulnerable to attacks. Share cybersecurity information with others and encourage them to get educated.

• Use a VPN when connecting to public Wi-Fi. Public Wi-Fi is a convenient way for attackers to spread ransomware. Whenever you are connected to a public Wi-Fi network, it’s important to connect to a virtual private network (VPN) to create a sort of “tunnel” that your data passes through, which can only be accessed with an encryption key.

• Use firewalls and advanced endpoint protection to help prevent attacks. Organisations need to make sure they have next-generation firewalls (NGFW) that can scan the traffic coming from both sides, examining it for malware and other threats.

“Knowing what is and isn’t normal communication from SARS is critical, particularly during tax season. If you do encounter a SARS-related phone or email scam, you can report it by sending an email to [email protected] or call the Fraud and Anti-Corruption Hotline on 0800 00 2870,” he said.

Tax season 2023

Tax season 2023 for income tax kicks in on 7 July 2023, and will run until 23 October for individual taxpayers, and until 24 January 2024 for provisional taxpayers.

• Individual taxpayers (non-provisional): 7 July 2023 @ 20:00 to 23 October 2023
• Provisional taxpayers: 7 July 2023 @ 20:00 to 24 January 2024

From 1 July 2023, SARS will be starting its auto-assessments.

With auto-assessments, taxpayers will be notified by SMS or email if they were selected to receive an auto-assessment.

Once the notification is received, the next step is to review the auto-assessment on the SARS MobiApp or eFiling. If the auto-assessment is correct and accepted, no further action is required. If not, taxpayers will have until the seasonal deadline to correct the information and submit their return.

---

Read: These taxpayers don’t have to submit a tax return this year