Practical accounting insight: A business’s SARS eFiling profile is part of its financial-control environment. If the wrong person gains access, the consequences can extend beyond a single tax return to payments, submissions, taxpayer information and compliance correspondence.

SARS continues to warn taxpayers about phishing and impersonation attempts. Its official guidance states that SARS will not request passwords, one-time PINs, banking PINs or eFiling login credentials through email, SMS, social media or telephone. Businesses should therefore treat unexpected requests for credentials or payment as a control risk, not simply an IT nuisance. Read SARS’s scams and phishing guidance.

Why eFiling access matters to finance teams

South African businesses use SARS digital channels to manage tax administration, including income tax, VAT, PAYE and other obligations. Access problems can delay submissions, prevent a finance team from checking account information and make it harder to respond promptly to SARS correspondence.

This is especially relevant where one employee, former employee, external bookkeeper or tax practitioner remains linked to the business’s security contact details. A change in staff or service providers should trigger a review of who can receive authentication messages and who is authorised to act on the company’s tax profile.

What SARS says businesses can update

SARS provides an option for registered South African eFilers to update security contact details from the eFiling login page without first logging in. The process uses biometric verification and an OTP sent to the new cellphone number or email address. SARS also allows users who are already logged in to update these details through the profile settings. See the official security contact detail instructions.

The pre-login option is limited to registered eFilers who are South African citizens and who can complete the required biometric verification. Other users may need to contact SARS or book an appointment for assistance.

Checks business owners should complete

  • Review access: Confirm which internal employees and external practitioners are authorised to work on the SARS profile.
  • Check security contacts: Make sure the email address and cellphone number receiving OTPs belong to an appropriate current contact.
  • Verify messages independently: Open eFiling or the SARS MobiApp directly rather than using links in unexpected emails or SMSs.
  • Control payments: Require a second person to verify SARS payment details and the relevant tax period before a payment is released.
  • Keep records: Retain evidence of access changes, payment approvals and important SARS correspondence.

Practical next steps

Businesses should add SARS access checks to their month-end or quarterly finance-control timetable. When a staff member leaves, a tax practitioner changes or the business suspects compromised credentials, access should be reviewed immediately.

These controls do not replace professional tax advice, but they can reduce avoidable delays, prevent unauthorised changes and help finance teams respond through official channels. Businesses that need broader support with tax administration, bookkeeping or compliance processes can explore Your Financial Partner’s accounting and tax services.