“The OTO hereby invites written comments on the eFiling profile hijacking draft report. By inviting public participation, the OTO aims to develop a robust and effective response to eFiling profile hijacking, thereby ensuring protection of taxpayers’ rights and enhancing trust in South Africa’s tax administration system,” the OTO said in a statement on Wednesday 1 October 2025.

The draft report was drafted by the ombud following its investigation into alleged eFiling profile hijacking.

“Between 3 February and 5 March 2025, the OTO conducted the eFiling Profile Hijacking Survey to capture taxpayers’ experiences and challenges related to eFiling profile hijacking. Preliminary findings from the survey were presented during a public workshop held on 28 May 2025.

“Initially, the OTO planned to publish the draft report for public comment in July 2025. However, SARS formally requested additional time to respond to the draft report and its recommendations. Consequently, on 2 July 2025, the OTO announced that the publication of the draft report would be postponed to 31 August 2025. Due to ongoing and extensive engagements with SARS, the publication was further delayed,” the statement read.

The report’s key findings include:
• eFiling profile hijacking is most prevalent among tax practitioners and individual taxpayers.
• The majority of cases involve Personal Income Tax and Value-Added Tax (VAT).
• Fraudulent transactions typically involve amounts under R10 000 but can reach up to R100 000.
• Vulnerabilities include inadequate authentication processes, challenges in fraud detection, delayed SARS response times, insider threats, and low digital security awareness among taxpayers.

The key recommendations include:
• South African Revenue Service (SARS): Enhance authentication protocols, improve fraud detection and refund verification systems, boost taxpayer education, and strengthen collaboration with banks, the Companies and Intellectual Property Commission (CIPC), and the South African Police Service (SAPS).
• Tax Practitioners: Implement stricter controls on third-party access and uphold high professional conduct standards.
• Taxpayers: Use strong passwords, activate two-factor authentication, and regularly monitor eFiling profile activities.
• National Treasury: Amend certain provisions in the Tax Administration Act and establish an Inspector-General as recommended by the Nugent Commission of inquiry.
• South African Reserve Bank: Investigate banking irregularities linked to eFiling profile hijacking.

The draft report can be accessed at https://www.taxombud.gov.za/oto-draft-report-on-the-investigation-into-alleged-efiling-profile-hijacking/

Written comments can be sent via: communications@taxombud.gov.za and for more information, visit www.taxombud.gov.za before the deadline on 31 October 2025.

The post Office of the Tax Ombud invites public comment on eFiling Profile Hijacking appeared first on ProtectionWeb.

In a joint statement issued on Friday 26 September, SARS and the OTO responded to a recent Sowetan article highlighting an increase in cybercriminals targeting taxpayer profiles and resulting in financial losses.

The institutions noted that at the time of publication, the OTO’s draft report had not yet been released for public comment and that the article contained “a number of factual inaccuracies.”

The organisations emphasised their distinct but complementary roles in South Africa’s tax administration. They are established in law to fulfil distinct yet mutually reinforcing roles for the sole benefit of taxpayers and the tax finance system for the country.

“SARS not only respects but considers the role of the OTO as an indispensable partner to ensure the functioning of the tax ecosystem is fair and beyond reproach. In this regard SARS has and continues to work hard to address whatever complaints that have been laid with the OTO,” the statement read.

The statement also emphasised that the two institutions play a paramount role in the functioning of tax administration. Each institution respects the other’s mandate, while both being the cornerstone for the fiscal integrity of South Africa tax ecosystem.

The OTO will release its draft report on 1 October 2025, following extensive engagement with all stakeholders.

Rising cybercrime risks

The OTO has been investigating compromised taxpayer profiles for more than a year, after receiving numerous complaints from both individuals and tax practitioners.

“In today’s digitally interconnected environment, cybersecurity risks have escalated dramatically, posing significant threats to individuals, businesses, and institutions.

“As personal and financial transactions increasingly migrate online, malicious actors exploit vulnerabilities in authentication protocols, data-sharing mechanisms, and user behaviour to perpetrate identity theft, fraud, and unauthorised system access. Even routine activities, such as accessing tax platforms or updating banking details, have become potential gateways for exploitation,” the statement said.

It added that SARS, as the custodian of revenue collection and refunds payment, is a prime target for cybercriminals exploiting vulnerabilities in online systems.

Cooperation and security measures

SARS and the OTO stressed that they maintain a cooperative relationship, with a shared goal of restoring public confidence in the eFiling system.

SARS said it continues to enhance security protocols to mitigate risks and urged taxpayers to remain vigilant by safeguarding login details and reporting suspicious activity through official channels.

“The release of the OTO’s draft report has been delayed allowing SARS to provide detailed input on preliminary findings, ensuring a comprehensive and balanced analysis.

“Whilst consultations have been extensive between the parties, parts of the draft may still carry areas of difference, which is to be expected in any review of this nature. This cooperative approach aims to strengthen the report’s recommendations and foster meaningful improvements,” the statement added.

Commitment to taxpayers

Both SARS and the OTO reiterated their unwavering commitment to enabling taxpayers to comply with their obligations safely and confidently.

The institutions urged taxpayers to remain cautious and report any irregularities through official SARS channels.

“We respect that the final report by the OTO will be made public soon, and SARS remain committed to continue its engagement with the public on its substance. The public must be assured though, that SARS continue to work with diligence to ensure the highest level of integrity and protection to taxpayers who uses the SARS digital platform,” SARS Commissioner Edward Kieswetter said.

The Tax Ombud added that OTO takes the hijacking of taxpayer eFiling profiles very seriously.

“As an independent institution, the OTO ensures objective oversight and the fair treatment of taxpayers. The OTO upcoming draft report reflects extensive engagement with all stakeholders and is aimed at driving real, practical solutions,” OTO said.

The post SARS, Tax Ombud join forces against cybercrime appeared first on ProtectionWeb.