SARS ‘Confirm Epayment Notice’ Phishing Scam Email

According to this “credit notice” email, which claims to be from South African tax agency SARS, you need to confirm your epayment  returns by opening an attached file

However, the email is not from SARS.  It is a phishing scam designed to steal your personal and financial information.

If you click on the attachment, a fraudulent webpage will load in your browser. The page includes the SARS logo and other elements in an effort to make it appear legitimate.

Once on the fake page, you will be told that to receive your refund,  you must choose your financial institution from a list and provide your details. Clicking on the name of your financial institution takes you to another fraudulent website that asks you to login with your account username and password.

Once you have “logged in” on the bogus site,  you will be instructed to complete a tax refund claim form that asks for your credit card number, your name and contact details, and other identifying information.

At the end of the process, you may see a final message claiming that your refund will soon be deposited in your account.

But, now, criminals can use the information you provided to hijack your bank account, commit credit card fraud, and steal your identity.

Tax refund phishing scams continue to be very common. They target taxpayers in a number of countries. Be very cautious of any email or text message that claims that you are eligible for an unexpected refund and should open an attached file or follow a link to get the supposed refund.

Legitimate tax agencies will not send you unsolicited emails that make such requests.

SARS has information about identifying and reporting phishing scams on its website.

A screenshot of the scam email:

Transcript of the scam email:

Subject: Returns credit notice

Dear Taxpayer

Please confirm epayment returns made to you by SARS.
See attached reference to process epayment.

SARS.eFiling

(HTML attachment)