CIRA’s guide to spotting CRA scams

As tax season approaches, many Canadians may be feeling overwhelmed and stressed. Unfortunately, scammers are aware of this and prey on people’s anxieties to extract money and obtain unauthorized access to personal data and financial information. With the dramatic increase in scale and sophistication of Canada Revenue Agency (CRA)  scam attempts, it is now more essential than ever to learn how to identify the difference between a legitimate communication from the CRA and a scam. The best way to protect yourself from potential fraud is by learning the telltale signs of CRA scams.  

Criminals are impersonating the CRA via phone, email, text, messaging apps, and even by mail. Scammers have been able to leverage the increasing prevalence of technology in our daily lives by creating more convincing scams, making it important to stay vigilant on how to spot and avoid CRA scams. With the emergence of generative AI platforms, malicious actors now have the tools to orchestrate more sophisticated attacks on a larger scale. As a result, 2024 is likely to witness the highest volume of CRA (and Revenu Québec) scams ever seen.

Fortunately, the CRA has some clear guidelines on how they communicate with Canadians. If you know the basics, you will be able to effectively tell what a scam is and what is not. 

How to identify CRA phone scams 

Be cautious if anyone calling claims to be from the CRA and requests personal information (SIN, bank account number, passport number.).  

Scammers use emotional manipulation to achieve their goals, often by claiming that sensitive information is necessary to receive a refund or benefit payment. Additionally, they may attempt to intimidate you by threatening legal action or arrest. It’s important to remember that a genuine CRA agent will never use these scare tactics or threaten you in any way. Stay alert and informed to avoid falling victim to these tactics, and always verify the legitimacy of any CRA communications before providing personal information. 

To confirm a call is in fact coming from the CRA, check the phone number. If you have a friend or family member who you believe might be susceptible to phone scams, print this and tape it by the phone for them or directly save the below numbers on their devices:  

Provinces: 
Individuals: 1-800-959-8281 
Businesses: 1-800-959-5525 
 
Territories 
Individuals: 1-866-426-1527 
Businesses: 1-866-841-1876 

When might the CRA contact me via phone?  

 Although the CRA may contact you via phone to review your income tax and benefit return, it’s important to note that legitimate CRA employees will always identify themselves with their name and phone number. If you receive a phone call from the CRA and are unsure whether it is genuine, it is always best to exercise caution. You can protect yourself by hanging up and contacting the CRA at a verified number or logging into your CRA portal to confirm any information provided during the call. 

How to identify CRA email scams 

The CRA will not ask for personal information by email or send you an unsolicited email asking you to click on a link. This includes links to a refund, a form where you fill in information, or to a portal.  

Additionally, the CRA WILL NOT demand immediate payment via Interac e-transfer, cryptocurrency, prepaid credit cards, or gift cards. The CRA will also never threaten you with arrest or a prison sentence.  

When might the CRA email me?  

The CRA might email you to let you know that a new message or document is available to you on a CRA portal (My Account, My Business Account, or Represent a client). These communications will not contain a link to the portal.  

The CRA might send you a link for a webpage, form, or publication that you asked for during a call or meeting with a CRA agent.  

The CRA might also email you about tax credits and benefits for individuals, or online services such as My account, but remember these emails will not contain links or solicit personal information.  

How to identify CRA letter mail scams  

Scammers are not limiting their attacks to digital means. Scam letters have been observed for quite some time, and many look very convincing. The most effective way to determine whether a letter claiming to be from the CRA is a scam is to pay attention to what the letter is asking you to do.  

As with other types of CRA scams, criminals are looking to scare Canadians into paying fake fines through untraceable payment methods. The CRA will never ask to set up a meeting in a public place to take payment. And again, they will never demand payment by Interac e-transfer, cryptocurrency, prepaid credit cards, or gift cards.  

When might the CRA send me mail?  

The CRA might send mail requesting financial information such as your bank’s name, send you a notice of assessment or ask you to pay an amount you owe through one of the CRA’s payment options. The CRA might also write to you to begin an audit, or to offer you free tax help (if you are a small business). If warranted, the CRA might mail you to take legal action to recover the money you owe.  

When you receive a letter from the CRA, ask yourself if the CRA has your most recent contact information on file, or if you have an installment payment due soon. If you are unsure about the legitimacy of a letter, log into your portal or call the CRA directly at one of the numbers listed above. 

How to identify scams by text 

The CRA will not send text messages, instant messages (Facebook Messenger, WhatsApp) to start a conversation with you under any circumstances.  

If you receive a text or instant message purporting to be from the CRA, prompting you to click on a link or requesting information, you can safely ignore it.  

Revenu Québec may send you text messages under specific circumstances, such as notifying you about changes to sensitive data in your file or alerting you if you’ve been affected by an incident. However, they never request personal information, ask users to click on links, or offer refunds via text or email.

When might the CRA send me a text?  

The only time the CRA might send you a text is as a part of multi-factor authentication for sign-in services. If you signed up for multi-factor authentication by phone, you would receive a one-time passcode whenever you log into your CRA account. NEVER divulge your multi-factor authentication code to anyone, even somebody purporting to be a CRA agent.  

Revenu Québec may send you text messages under specific circumstances, such as notifying you about changes to sensitive data in your file or alerting you if you’ve been affected by an incident. However, they never request personal information, ask users to click on links, or offer refunds via text or email. 

Six things to know about how the CRA contacts Canadians  

The scams outlined have elements in common — criminals are looking to imitate the CRA to trick Canadians, especially vulnerable people, into paying fraudulent fees or divulging sensitive information. With a little bit of knowledge, you can help stay one step ahead of the bad guys. To recap: 

1. The CRA will never use text messages or instant messages to start a conversation with you about your taxes, benefits, refund, or account. 

2. The CRA will never ask you for personal or financial information via text or email.  

3. The CRA does not accept payment in the form of cryptocurrency, prepaid credit cards, or gift cards. 

4. CRA employees will not use aggressive language, issues threats of arrest, or send law enforcement 

5. CRA employees will identify themselves and give you a name and phone number to call back if needed.  

6. The CRA will never recommend that you apply for benefits on the spot. 

What to do if you believe you have been the victim of a scam   

If you suspect that you have fallen prey to a scam or have disclosed personal information to a scammer, take immediate action and report it.  

1. Report the fraud to the Canadian Anti-Fraud Centre at 1-888-495-8501 or visit their website and follow the reporting procedure.  

2. Inform your local law enforcement agency, financial institutions, and relevant credit bureaus.  

3. If you suspect any unauthorized changes to your banking, address, personal or business information, or a benefit application has been made without your knowledge, contact the CRA. 

Scammers can be extremely convincing, and they often rely on people’s anxiety and fear to extract money and personal information. However, by following the tips outlined in this article, you can stay vigilant and protect yourself from potential fraud. If you receive a suspicious communication claiming to be from the CRA, always verify the legitimacy of the message before providing any personal information or making any payments. Stay informed and stay safe.