An email lands in your inbox. SARS owes you a refund, or your bank account has been blocked pending verification. 

Your stomach drops before your brain catches up, and that split second is exactly what scammers are counting on. 

Fake SARS and bank emails in South Africa are built to make you click first and think later. But once you know what to look for, spotting them takes seconds.

This guide breaks down the exact red flags in these scam emails, then walks through what to do instead. 

So, you can protect your business and your money without second-guessing every message that lands in your inbox.

Red Flags in SARS and Bank Emails

Scammers rely on you being busy, not careless. 

Most fake SARS and bank emails share the same handful of tells, and once you’ve spotted them once, they jump out every time.

Suspicious Sender Addresses

Genuine SARS emails come from an address ending in @sars.gov.za.

 Scam emails often use close lookalikes, such as @sars.co.za or a random public domain like @gmail.com, hoping you won’t check closely.

Bank scam emails follow the same pattern. A misspelled domain, an extra letter, or a completely unrelated address dressed up with the bank’s logo are all common. 

Always check the full address, not just the display name shown in your inbox.

On a phone, this takes an extra tap that most people skip. 

Mobile mail apps often show only the sender’s display name by default. 

So tap or press on the name to reveal the full email address before you trust anything in the message.

Hyperlinks and Attachments

SARS has stated plainly that it never sends hyperlinks to external websites or links to bank login pages.

 It also never sends HTML or HTM file attachments, since these are commonly used to disguise phishing pages as legitimate documents.

Banks follow a similar practice. Legitimate bank emails don’t embed direct login links asking you to enter your username and password.

If a message pushes you to click through and log in immediately, treat it as a red flag first and a real request second.

False Urgency and Fear

Scam emails lean hard on panic.

Expect claims of an urgent outstanding tax settlement, threats of imminent arrest, or warnings that your bank account is about to be frozen unless you act within hours.

Real institutions don’t operate this way. 

SARS and South African banks give you proper notice and formal channels for anything serious, not a countdown timer buried in an unsolicited email.

Unexpected good news deserves the same suspicion as threats.

A surprise SARS refund you weren’t expecting, arriving out of nowhere with a link to “claim it now,” follows the same playbook as a threat email. 

Both are designed to short-circuit careful thinking, just from opposite directions.

Requests for Confidential Data

No legitimate email from SARS or your bank will ask you to hand over your eFiling password, a one-time PIN, your card number, or your CVV through a link or reply. 

These details should never leave your device through an email thread.

SARS has confirmed directly that it will never ask for your bank account number for payment purposes via email.

Any message requesting this is a scam, regardless of how official it looks.

How to Verify and Protect Yourself

Spotting the red flags is half the job. Here’s what to do once something looks off, so you can confirm it safely instead of guessing.

Navigate Directly

Never click a link inside a suspicious email, even out of curiosity. 

Open a new browser tab and type in the official SARS eFiling address or your bank’s website yourself, then log in from there to check your actual account status.

This one habit closes off almost every phishing attempt in one move, since the scam depends entirely on you clicking through their link rather than typing the address yourself.

Report Suspicious Messages

Forward any suspicious SARS email to [email protected], or call the SARS fraud hotline on 0800 00 2870 if you’re unsure. 

Reporting it helps SARS flag and shut down the scam campaign faster for everyone else, too.

For bank emails, use your bank’s official fraud helpline number, found on the back of your card or on their verified website, never a number listed inside the suspicious email itself. 

Most major South African banks also have a dedicated email address for reporting phishing attempts.

Keep a screenshot of the email before you delete or report it. 

If the scam escalates, for example, if someone in your business later clicks a similar link, having the original evidence on hand makes it much faster for your bank or SARS to investigate.

Frequently Asked Questions

1) Does SARS ever email you legitimately?

Yes. SARS does send legitimate emails, including eFiling notifications and correspondence tied to submissions you’ve actually made. The difference is that genuine SARS emails come from a verified @sars.gov.za address, don’t contain external login links, and never pressure you to act within hours.

2) What should I do if I’ve already clicked a suspicious link?

Don’t enter any information if a login page has loaded, and close the page immediately. 

Change your SARS eFiling and online banking passwords straight away from a separate, trusted device, and contact your bank’s fraud line to flag your account for monitoring. If you entered any details before realising, report it to SARS and your bank without delay so they can act quickly.

3) Can I trust an SMS claiming to be from SARS or my bank?

Treat SMS messages with the same caution as email. SARS and South African banks have both issued repeated warnings about fake SMS messages using the same fear tactics and fake refund or blocked-account claims. The same rule applies: don’t click, navigate directly, and verify through official channels.

Protecting Your Business Inbox

Spotting a scam email takes seconds once you know the signs, but the safest position is one where fewer of these messages reach your inbox in the first place. 

Business email hosting with built-in anti-phishing filtering catches a large share of these attempts before your team ever sees them.

Truehost’s Workplace plans include anti-phishing filters and antivirus checks by default, alongside 2FA protection and enterprise-grade encryption, on every mailbox from Workplace Starter upward. 

That’s a real layer of defence sitting ahead of your team’s judgement, not a replacement for it, but a meaningful one when a single click can compromise a bank login or an eFiling account.

Stay a Step Ahead

Fake SARS and bank emails work by rushing you. 

Slow down, check the sender address, skip the links, and go straight to the source when anything feels off. 

That habit alone protects you from almost every version of this scam.

If you want that protection built into your everyday inbox, set up your business email on Truehost and let the filtering do some of the watching for you.