Call for comment on Draft Report into alleged eFiling Profile Hijacking

Image source: weerapat kiatdumrong – 123RF.com

“The OTO hereby invites written comments on the e-filing profile hijacking draft report. By inviting public participation, the OTO aims to develop a robust and effective response to e-filing profile hijacking, thereby ensuring protection of taxpayers’ rights and enhancing trust in South Africa’s tax administration system,” the OTO said in a statement on Wednesday.

The draft report was formulated by the ombud following its investigation into alleged e-filing profile hijacking.

“Between 3 February and 5 March 2025, the OTO conducted the eFiling Profile Hijacking Survey to capture taxpayers’ experiences and challenges related to e-filing profile hijacking. Preliminary findings from the survey were presented during a public workshop held on 28 May 2025.

“Initially, the OTO planned to publish the draft report for public comment in July 2025. However, Sars formally requested additional time to respond to the draft report and its recommendations. Consequently, on 2 July 2025, the OTO announced that the publication of the draft report would be postponed to 31 August 2025. Due to ongoing and extensive engagements with Sars, the publication was further delayed,” the statement read.

National Treasury confirms malware in IT system

24 Jul 2025

The report’s key findings include:

• E-filing profile hijacking is most prevalent among tax practitioners and individual taxpayers.
  
• The majority of cases involve personal income tax and value-added tax (VAT).
  
• Fraudulent transactions typically involve amounts under R10,000 but can reach up to R100,000.
  
• Vulnerabilities include inadequate authentication processes, challenges in fraud detection, delayed Sars response times, insider threats, and low digital security awareness among taxpayers.

The key recommendations include:

• South African Revenue Service (Sars): Enhance authentication protocols, improve fraud detection and refund verification systems, boost taxpayer education, and strengthen collaboration with banks, the Companies and Intellectual Property Commission (CIPC), and the South African Police Service (SAPS).
  
• Tax practitioners: Implement stricter controls on third-party access and uphold high professional conduct standards.
  
• Taxpayers: Use strong passwords, activate two-factor authentication, and regularly monitor e-filing profile activities.
  
• National Treasury: Amend certain provisions in the Tax Administration Act and establish an Inspector-General as recommended by the Nugent Commission of inquiry.
  
• South African Reserve Bank: Investigate banking irregularities linked to e-filing profile hijacking.

The draft report can be accessed here.

Please forward written comments via: az.vog.dubmoxat@snoitacinummoc and for more information, visit www.taxombud.gov.za before the deadline on 31 October 2025.