SARS E-FILING IDENTITY THEFT
It has been communicated to SAICA members over the last few weeks that there appears to be an increasing incidence of cases where certain individuals are defrauding the South African Revenue Services (SARS).
The fraud involves using taxpayer eFiling profiles to create fictitious refunds or divert actual refunds. The former is done by submitting fictitious returns on random taxpayers’ profiles and changing relevant banking details, resulting in refunds which are paid into bank accounts of those perpetrating the fraud.
In addition to the submission of fictitious returns, in some instances individuals perpetrating the fraud are redirecting valid taxpayer refunds into different bank accounts, by changing the banking details on the taxpayer’s profile. There have also been cases of fictitious IRP5 certificates being created to facilitate submission of the fictitious personal income tax returns.
From a value-added tax (VAT) perspective, there have been a few cases reported of unauthorised VAT registrations, followed by the submission of fictitious VAT returns in order to create refunds due to the taxpayer, to be paid into the incorrect bank account. Fictitious returns are also being submitted in respect of valid VAT registered taxpayers. submission of the fictitious personal income tax returns.
SAICA and other recognized controlling bodies have been engaging with SARS since these cases first came to light and we are constantly updating SARS on new cases that have been reported. SARS is working directly with the affected tax practitioners to address specific cases. SARS has also provided its assurance that it shares all concerns in this regard and it has taken steps to mitigate the taking of profiles. According to recent engagement, SARS advised that there have been no new incidences of such profiles being moved after additional checks and balances have been put in place by SARS and thus far 3 different categories of cases have been reported. SARS indicated that it has set up a dedicated team that has been focused on this risk, to deal with the cases/taxpayers impacted by these events.
It remains unclear how fraudsters are getting access to taxpayer profiles and even tax practitioner profiles where clients’ details are changed. SAICA has requested SARS to investigate the matter given the short timeframes during which details are being changed, including banking details. SARS has noted that it has not found any reason to regard this as a breach of its systems, and in SARS’ view, every tax practitioner and taxpayer can place reliance on the eFiling system.
Taxpayers and tax practitioners are warned to be cautious against third parties using or obtaining access to their eFiling profile logins as they could potentially be held liable for losses resulting from such action.
Reporting to SARS and the South African Police Service
Given the criminal nature of the matter, SAICA members are advised that as soon as they become aware of the identity theft/fraud, they should report this directly to SARS via the channels available on the SARS website, preferably by calling the SARS Anti-Corruption and Fraud Hotline on 0800 00 2870. SARS has advised that cases will be allocated a case number and SARS’ dedicated team will revert to the impacted parties while at the same time ensuring that no further malicious moving of profiles takes place. SAICA members may also escalate this via SAICA’s member portal, indicating the SARS case reference number when logging the query.
Furthermore, tax practitioners and/or taxpayers should also report the matter as a case of fraud, to the South African Police Services via the relevant channels. Ensure that this is done as soon as the issue is identified and that you retain copies of the statement as well as the relevant case reference number.
Next steps
Tax practitioners have raised many concerns regarding the steps to be taken once the matter has been reported to relevant parties and they now need to regain control of profiles and correct the tax returns submitted. We understand that SARS is working with tax practitioners directly to address the issue of the unauthorised access to profiles. However, affected tax practitioners are of the view that this is not happening quickly enough thereby enabling the fraud to continue unabated.
With respect to the unauthorised, fictitious returns submitted, it is concerning that there is an apparent expectation that tax practitioners and/or taxpayers are responsible for fixing this by lodging a dispute in respect of the incorrect tax returns submitted. In such cases, the relevant
dispute process must be followed which may involve submission of affidavits, supporting schedules and other documents that SARS requires before it will accept the revised return.
SAICA is engaging with SARS as we do not believe this to be the best approach to burden taxpayers with this additional cost for matters which are not proper disputes, but a fraud on SARS. With an already over-burdened disputes team, including a significant backlog of unresolved matters, we do not support this approach. In our view, this approach is administratively unfair to taxpayers and tax practitioners, as they are effectively being expected to pay the price for their profiles being compromised.
SAICA Tax Practitioner members have further raised concern with respect to who will bear the liability for any valid refunds paid into incorrect bank accounts where valid refunds were diverted. In this regard, SARS has advised that it has taken steps to rectify any cases where returns have been filed with malicious intent. Where refunds have been paid, SARS has provided its assurance that steps will be taken to recover such amounts. The recent events have severely impacted affected tax practitioners’ ability to adequately perform other planned services as they have had to keep a constant eye on their eFiling profiles to make sure it has not been compromised.
Some tax practitioners have also expressed concern from a Protection of Personal Information Act (POPIA) and personal safety perspective, as personal information of both tax practitioners and taxpayers have been compromised in these cases, with those perpetrating the fraud now
having access to the physical address and other financial and personal information of affected persons. Therefore, an obligation may arise in terms of POPIA on SARS to report the breach to the information regulator and inform the relevant parties. These concerns have been shared with SARS and we await urgent feedback as to how this is being addressed.
Be vigilant and check eFiling profiles
Based on the cases that have been escalated by tax practitioner members, it seems that many changes to the profiles are identified only by chance, when accessing client profiles on eFiling. We encourage tax practitioner members to be vigilant and advise their clients to immediately contact them if they receive notification of any changes to their registered details.
In addition, tax practitioners can check the returns history for all tax types to identify if any unauthorised returns have been submitted in respect of relevant clients. SARS has indicated that it has tightened up its processes regarding the verification on registration of new profiles and more validation checks will now take place. Further checks have also been implemented before a refund will be paid and some tax practitioners have already noted a higher incidence of verifications as well as recalled refunds.
Source: Faber.P, Integritax, SAICA