Taxpayers routinely allow accountants, employees and other advisers access to their tax affairs. What happens, however, when a fraudulent return is submitted using the taxpayer's own eFiling credentials and the taxpayer tries to say: “I didn't do it”?

A recent Tax Court judgment illustrates just how difficult that defence may become.

In Taxpayer MLC v Commissioner for SARS, revised income tax returns were submitted for the taxpayer's 2020 and 2021 years of assessment. The revised returns suddenly reflected substantial farming expenditure and losses, despite the taxpayer subsequently admitting that she conducted no farming operation and had not purchased any farming equipment.

The result was an undue refund of approximately R1.38 million. SARS ultimately imposed a 150% understatement penalty for intentional tax evasion.

The taxpayer admitted that her eFiling credentials had been used, but denied submitting the fraudulent returns. Her case eventually became that a SARS official had obtained her login details and participated in the fraud.

The Tax Court rejected her version.

Your credentials, your problem?

An important feature of the judgment is the court's treatment of SARS’ eFiling rules.

Those rules require taxpayers to secure their user identity and access code and prohibit sharing an access code — even with a SARS official. The court held that a registered user is liable for activities and transactions performed using those credentials, subject to the taxpayer being able to establish a reasonable possibility that she was ignorant of the false returns.

That is commercially significant.

Businesses often regard control over eFiling profiles as an administrative or IT matter. It is not. Access to an eFiling profile is effectively access to the taxpayer's relationship with SARS and potentially to substantial amounts of money.

Evidence still matters

The taxpayer's real difficulty, however, went considerably further than compromised credentials.

She knew that the refunds were not due. She alleged that substantial portions had subsequently been paid into other people’s bank accounts somehow claiming to be SARS officials, yet she produced no bank records corroborating those payments. She retained and used part of the money herself. She also did not report the alleged fraud to the police.

More damaging still, the allegation of a fraudulent SARS official developed only later. During earlier discussions with SARS she had accepted responsibility for the returns and asked merely that penalties not be imposed. Even her objection was headed “Request for the withdrawal of penalties”; the allegation of third-party fraud emerged only at the appeal stage.

The court consequently upheld SARS’ classification of the conduct as intentional tax evasion and the 150% understatement penalty.

Understatement penalties are about behaviour

There is another useful reminder in the judgment.

Once an understatement has been established, the percentage penalty depends upon the taxpayer's behaviour. For a standard case, intentional tax evasion attracts 150%, compared with 100% for gross negligence and lower percentages for less culpable behaviour.

SARS bears the onus of proving the facts upon which the understatement penalty is based. But once intentional tax evasion was established in this case, the court considered its ability simply to reduce the penalty to be very limited.

The practical lesson

There are at least two.

First, taxpayers — particularly companies — should treat control over eFiling credentials with the same seriousness as control over banking credentials. Who has access, who may submit returns and what happens when an employee or adviser leaves should form part of basic tax governance.

Secondly, where fraud or unauthorised access genuinely occurs, the taxpayer should create the evidential trail immediately: preserve access records, bank statements and communications; report the incident; notify SARS; and maintain a consistent explanation from the outset.

A taxpayer may have a perfectly legitimate explanation for a return submitted through its profile.

But explaining it for the first time in the Tax Court is a decidedly uncomfortable place to start.