Fake Tax Settlement Notification and Final Demand messages claiming you owe SARS money.
Home / Scam guides / Government (SARS / SASSA / NSFAS)
SARS has warned of fake 'Settlement Notification' and 'Final Demand' emails and SMSes demanding payment. Here are the seven red flags, the rules SARS never breaks, and what to do if you receive one.
Published 21 May 2026 · Last reviewed 21 May 2026
The hook An email or SMS claiming you owe SARS and must pay immediately
Common subject lines "Tax Settlement Notification", "Final Demand", "Legal SARS Demand"
Why now It lands just before the 2026 tax season, when real SARS contact is expected
Report it to phishing@sars.gov.za
South Africa’s tax authority has issued an urgent warning about a wave of fraudulent communications circulating under subject lines like “Settlement Notification” and “Final Demand.” The messages are convincing, they are widespread, and they are arriving at exactly the wrong time of year.
Here is what you need to know.
The South African Revenue Service confirmed on 13 May 2026 that fraudulent emails and SMS messages are being sent to taxpayers across the country. The communications claim that the recipient owes SARS money and demand immediate payment, often with a link to complete the transaction.
The subject lines vary but typically include phrases like “Tax Settlement Notification”, “Final Demand”, “Outstanding Settlement Notification”, or “Legal SARS Demand.” SARS has logged multiple variants in recent months alone, including a fake summons notification in February 2026 and several settlement-themed messages from late 2025 through to May 2026.
What makes these messages particularly dangerous is how closely they mirror genuine SARS communications. The formatting replicates official documents. The tone is formal and authoritative. The language references legal enforcement, outstanding liabilities, and collection processes. For anyone who has received legitimate correspondence from SARS before, the scam version can be genuinely difficult to distinguish from the real thing.
The timing is not accidental.
South Africa is approaching its 2026 tax season, which is expected to open in mid-July and run through to 23 October 2026 for individual taxpayers. In the weeks before and during tax season, millions of South Africans are actively expecting communication from SARS. That expectation makes them more likely to open, read, and act on messages that appear to come from the revenue service.
There is a second factor at play. SARS has significantly increased its enforcement and collection activity under its Modernisation 3.0 strategy. Enhanced data analytics, third-party data matching, and improved banking integration have made SARS more visible and assertive in pursuing outstanding amounts. The result is that more taxpayers than ever before are receiving genuine compliance correspondence. Scammers have noticed this shift and are using it to their advantage. A message demanding payment no longer seems unusual when the real SARS is sending similar-sounding letters to more people than at any previous point.
Tax Consulting SA, commenting on the current wave of scams, noted that the problem is particularly dangerous precisely because it mirrors the reality of South Africa’s current tax environment.
SARS has been unambiguous about its own rules. Knowing those rules is your best defence.
Any payment link in the message. SARS does not send payment links in emails or SMS messages, other than links pointing directly to sars.gov.za or sarsefiling.co.za. A link pointing anywhere else is a red flag regardless of how the surrounding message looks.
A request for your banking details. SARS will never ask you to provide banking details directly via email or SMS. If a message is asking you to confirm, update, or supply account information, it is not from SARS.
A request to deposit into a personal account. SARS does not accept direct deposits into personal accounts under any circumstances. Payments are made through official channels only, using a pre-registered bank beneficiary set up through your bank’s app.
An attachment with an .htm or .html file extension. These file types are used to deliver fake websites locally on your device. If an email arrives with an attachment of this type, do not open it.
Urgent language combined with a short deadline. Phrases like “immediate payment required”, “failure to comply within 24 hours”, or “legal action will follow” are designed to pressure you into acting before you have time to think. Legitimate SARS communications do not typically demand same-day payment.
A sender address that does not end in @sars.gov.za. Fraudsters use addresses that look plausible, such as sars-notifications@gmail.com or noreply@sars-tax.co.za. The only legitimate SARS email domain is sars.gov.za. If the address is anything else, the email did not come from SARS.
Generic addressing. Legitimate SARS correspondence is addressed to you by name and references your taxpayer number. A message addressed to “Dear Taxpayer” or “Dear Client” is a warning sign.
Do not click anything. Do not reply. Do not call any phone number listed in the message.
If you are uncertain whether you have a genuine outstanding amount with SARS, go directly to the official SARS eFiling portal by typing sarsefiling.co.za into your browser yourself. Do not follow any link from the message to reach eFiling. Your actual tax status will be visible in your profile. If there is nothing outstanding there, the message is a scam.
For payments, use only the pre-registered bank beneficiary you have set up through your bank’s own app. Do not make any payment to an account number provided in an unsolicited email or SMS.
If you receive a suspicious message, forward it to phishing@sars.gov.za. SARS monitors this address and uses the reports to track active scam campaigns.
If you have already clicked a link or provided personal information in response to one of these messages, contact your bank immediately to report potential fraud. Change your eFiling password without delay and enable two-factor authentication on your eFiling profile if you have not already done so. You can also report the incident to the South African Police Service by calling 10111.
The SARS settlement scam is one variant of a wider category of institutional impersonation fraud that has increased sharply across South Africa. The same mechanics appear in scams impersonating couriers, banks, SASSA, and NSFAS. A trusted institution is named, urgency is manufactured, a payment or personal detail is requested, and the victim acts before scrutinising.
What changes between variants is the institution being impersonated and the pretext for the demand. What stays the same is the structure. Recognising that structure, regardless of which institution the scammer claims to be, is the single most reliable defence.
If a message arrives unexpectedly, requests urgent action, and asks you to pay something or hand over personal information, pause before doing anything. Check the sender. Check the domain. Check your actual account status through an official channel you navigate to yourself.
Verifyd is a free tool built specifically for moments like this. Paste the suspicious message, forward the email, or scan the QR code, and receive an instant verdict telling you whether the message shows signs of being a scam. The SARS whitelist in Verifyd includes verified SARS sender identifiers and the negative rules that apply to all SARS communications, so the tool can tell you not just whether the sender looks legitimate, but whether what the message is asking you to do is consistent with how SARS actually communicates.
If you received a message claiming to be from SARS and you are not sure, check it at verifyd.co.za before you pay anything or click anything.
Sources: South African Revenue Service (sars.gov.za), SARS Scam Alert SARS-SCAM-394 (13 May 2026), Tax Consulting SA, BusinessTech, Arcadia Finance.
01 Does SARS send payment links by email or SMS? No, with one narrow exception. SARS does not send payment links other than links pointing directly to sars.gov.za or sarsefiling.co.za. A link pointing anywhere else is a red flag, no matter how official the surrounding message looks. The safest habit is to ignore the link entirely and reach eFiling by typing the address into your browser yourself.
02 Will SARS ever ask for my banking details or a deposit into a personal account? Never. SARS will not ask you to confirm, update or supply banking details via email or SMS, and it does not accept deposits into personal accounts under any circumstances. Legitimate payments are made only through a pre-registered SARS beneficiary set up through your bank's own app. Any message asking you to supply account details or pay into an account number is a scam.
03 How can I tell a real SARS email from a fake one? Check the sender domain and how you're addressed. The only legitimate SARS email domain is sars.gov.za. Addresses like sars-notifications@gmail.com or noreply@sars-tax.co.za are fake. Real SARS correspondence also addresses you by name and references your taxpayer number, so a generic "Dear Taxpayer" or "Dear Client" is a warning sign. When unsure, don't judge by the email at all: log into eFiling directly and check your actual status.
04 What should I do if I receive a suspicious SARS message? Don't click anything, don't reply, and don't call any number in the message. If you want to check whether you really owe anything, type sarsefiling.co.za into your browser yourself and check your profile there. Forward the suspicious message to phishing@sars.gov.za, which SARS monitors to track active scam campaigns.
05 I already clicked a link or gave away information. What now? Act quickly. Contact your bank immediately to report potential fraud. Change your eFiling password without delay and enable two-factor authentication on your eFiling profile if you haven't already. You can also report the incident to the South African Police Service by calling 10111. Keep the message as evidence.
##
Got a message like this? Check it first.
Paste the SMS, email or WhatsApp into Verifyd and get a clear
verdict in seconds, with plain-language reasoning for exactly
what we found.
Get the app More scam guides
Other Trending scams in South Africa Courier & delivery Fake courier delivery-fee SMS