Scam message warning: How to spot a fake before harm

A scam message can arrive when you least expect it. It often appears during busy periods, when people are waiting for an important email, parcel or tax refund.

That is exactly why cybercriminals like to strike during South Africa’s tax season.

The latest warning from the South African Revenue Service (SARS) shows that scammers are now using artificial intelligence (AI) to create polished emails and SMSs that look almost identical to official communication.

Fortunately, a convincing appearance is only one part of the trick. There are still reliable ways to separate genuine messages from dangerous fakes.

WHY IS A SCAM MESSAGE SO CONVINCING?

Today’s fraudsters no longer rely on poor spelling and obvious mistakes. AI can produce professional language, realistic logos and formal layouts within seconds.

SARS recently warned that scammers are sending messages claiming taxpayers qualify for refunds of as much as R50 000, directing them to fraudulent websites designed to steal personal information.

The Southern African Fraud Prevention Service (SAFPS) says criminals depend on urgency and fear. They pressure victims to “act now”, verify banking details or update an eFiling profile before an imaginary deadline expires.

That emotional pressure is often a bigger warning sign than the message itself.

Cybercrime is also growing rapidly. According to INTERPOL’s African Cyberthreat Assessment Report 2025, phishing remains among the continent’s most common cybercrimes, with increasingly sophisticated social engineering techniques making scams harder to recognise.

HOW CAN YOU TEST A SCAM MESSAGE?

Pause before clicking anything.

Genuine organisations rarely demand immediate action through unsolicited emails or SMSs.

Look closely at the sender’s address. Official SARS correspondence comes from an @sars.gov.za domain. Even then, criminals can spoof addresses, so the safest option is to ignore embedded links and log directly into the official SARS eFiling platform or MobiApp.

Question the message itself.

Does it promise an unusually large refund? Does it ask for passwords, PINs or banking details?

Neither banks nor SARS request sensitive information through email, SMS or WhatsApp.

Messages that create panic or promise unexpected rewards deserve extra scrutiny.

WHAT SHOULD YOU DO IF YOU ARE UNSURE?

Delete suspicious messages and block the sender. If the communication appears to impersonate a bank or SARS, forward it to the bank or SARS for investigation.

Protect your accounts with strong, unique passwords and multi-factor authentication.

Avoid using public Wi-Fi when accessing financial information, and monitor your profile regularly for unauthorised changes. Fraudsters who steal details sometimes alter banking information so legitimate payments are paid into criminal accounts instead.

Technology has made fraud more convincing, but not impossible to defeat. A few extra seconds spent checking the sender, questioning urgent demands and using official platforms instead of email links can prevent financial loss.

In an age where AI helps criminals sound more believable than ever, healthy scepticism remains one of the strongest forms of protection.