A taxpayer who discovers that fraudulent VAT returns have been submitted through its SARS eFiling profile may understandably contend that its account has been compromised. But alleging unauthorised access and proving it are two different matters.

This distinction was central to the Tax Court's judgment in Taxpayer TQ v CSARS (VAT 2138), delivered by Mali J on 13 August 2026. The Court dismissed the taxpayer's appeal against the disallowance of approximately R6.37 million in input tax deductions and the imposition of a 150% understatement penalty.

The judgment provides useful guidance on the evidentiary requirements applicable to allegations of electronic fraud, the responsibilities of taxpayers using SARS' electronic systems and the circumstances in which understatement penalties may be justified.

The disputed VAT claims

The taxpayer, a company involved in information technology consulting, submitted VAT returns for August and October 2017 claiming input tax deductions totalling R6 372 565.69.

The claims attracted SARS' attention because the taxpayer had previously submitted nil returns. The sudden appearance of substantial input tax deductions prompted verification audits.

During these audits, SARS contacted the purported suppliers identified in the supporting tax invoices. The suppliers denied issuing the invoices or conducting the transactions concerned. SARS also established that the taxpayer's banking records did not reflect payments to the purported suppliers.

SARS consequently disallowed the input tax deductions and imposed an understatement penalty of 150%, categorising the conduct as intentional tax evasion.

The taxpayer's defence was unusual. Rather than attempting to substantiate the underlying transactions, it maintained that neither the returns nor the supporting documents had been submitted with its knowledge or authority.

According to its director, the company's eFiling profile had been compromised and used by unknown third parties to submit fraudulent refund claims.

Allegations of fraud require evidence

The taxpayer relied principally on evidence that the IP address associated with the submissions originated in Zimbabwe, whereas its director was in South Africa at the relevant time.

It also contended that its registered email address and telephone numbers were no longer operational, potentially exposing its eFiling profile to unauthorised access.

However, the taxpayer presented no expert information technology evidence establishing that its profile had actually been compromised.

By contrast, SARS called a digital fraud investigator who explained the operation of the eFiling system, including password encryption, user identification and access records.

Importantly, the investigator found no evidence of password compromise. The taxpayer's banking details had also remained unchanged, notwithstanding the substantial refunds ostensibly sought by the alleged fraudsters.

The Court considered this significant. A third party attempting to obtain fraudulent refunds would ordinarily be expected to redirect payment to an account under that person's control.

The taxpayer's failure to provide its laptop for forensic examination further weakened its case.

Electronic evidence and the burden of proof

A particularly useful aspect of the judgment is its discussion of the Electronic Communications and Transactions Act 25 of 2002.

The Court confirmed that section 15 facilitates the admission of electronic evidence but does not dispense with the ordinary requirements of relevance, authenticity and reliability.

It distinguished between automatically generated electronic records, whose credibility depends principally on the operation of a computer system, and electronic communications containing human statements.

The former may constitute real evidence, whereas the latter may attract the rules governing documentary evidence and hearsay.

Where allegations concern technical matters such as unauthorised access, password integrity or system manipulation, appropriate expert evidence may be essential.

The Court found that the taxpayer had failed to discharge its evidentiary burden.

Of particular importance was section 250(2) of the Tax Administration Act, which provides that a return purporting to have been made or signed by a taxpayer is regarded as duly made unless the taxpayer proves otherwise.

The taxpayer's mere denial of responsibility was insufficient to displace this statutory presumption.

No refund paid: no prejudice?

The taxpayer also argued that SARS had suffered no prejudice because the disputed refunds had never been paid.

The Court rejected this argument.

Relying on the Supreme Court of Appeal's decision in Purlish Holdings v CSARS, it confirmed that prejudice is not confined to an actual financial loss.

The potential payment of an unjustified refund, together with the expenditure of SARS' resources in investigating and preventing that payment, may constitute prejudice.

Accordingly, the fact that SARS' verification procedures prevented the refunds from being paid did not preclude the imposition of understatement penalties.

The appeal was dismissed with costs.

Practical implications

The judgment illustrates that taxpayers cannot successfully resist assessments merely by alleging that their eFiling credentials have been misused.

Where electronic fraud is suspected, the taxpayer should act promptly, preserve relevant electronic records, notify SARS and obtain appropriate forensic evidence.

The central lesson is straightforward: an allegation of electronic fraud is not a substitute for proof

Where the taxpayer seeks to distance itself from returns submitted through its own eFiling profile, credible technical evidence may determine whether that defence succeeds or fails.