How to know you’re really hearing from the CRA

Most Canadians rarely have reason to interact with the tax authorities, and for most people, that’s the way they like it. In the vast majority of cases, Canadians file their tax returns each spring, receive their refund or pay any balance of taxes owing, and forget about taxes until filing season rolls around the following year.

In many cases, however, things don’t run that smoothly, and it’s necessary for the Canada Revenue Agency to contact a taxpayer, to request additional information or seek confirmation of a deduction or credit amount claimed on the return. As our tax system is a self-assessing one, and nearly all returns are filed by electronic means (in which no receipts or other documentation are filed) it’s not surprising that the CRA would need to follow up with some taxpayers with respect to tax matters.

The difficulty for such taxpayers is that a communication – a letter or unsolicited telephone call purporting to be from the CRA – might be legitimate, or it might be part of a scam seeking to defraud the taxpayer. A legitimate communication from the tax authorities can’t be ignored, but clicking on a link in a fraudulent text or email, or providing personal financial information to a scammer over the phone (or worse, sending money), could be disastrous for the taxpayer. And, to add to the difficulties, scammers have become more and more sophisticated in their approaches. A fraudulent phone call from a scammer might show a legitimate CRA phone number on the recipient’s call display, leading him or her to conclude that the call is in fact from the Agency. And, according to the CRA, some fraudulent text messages now include images taken from Government of Canada social media accounts to make their scam messages look more legitimate.

The CRA is well aware of these problems, as tax frauds and scams have become so pervasive that on occasion CRA employees who contact taxpayers on genuine CRA business have had difficulty convincing the recipients of such calls that the call is a legitimate one. To address this problem, the Agency has posted information on its website on how (and how not) to make that determination. The Agency’s goal is two-fold: the first, of course, is to help taxpayers avoid becoming yet another victim of such frauds; the second is to prevent situations in which taxpayers ignore legitimate communications from the Agency, having dismissed them as just another phishing or scam attempt.

To help taxpayers verify that a contact is legitimately from the CRA, the Agency utilizes a number of strategies and security measures. First, any initial contact from the CRA will usually be by way of letter or phone call. The CRA does not send or receive emails or texts containing confidential personal tax information, or communicate with taxpayers on such matters through social media. When the CRA wants to initiate contact with a taxpayer who has not registered for the CRA service My Account, it will send the taxpayer a letter by regular mail, or will contact the taxpayer by phone call. Taxpayers who have registered for My Account may receive an email from the CRA letting them know that there is a communication for them to view in their online CRA account. The taxpayer will then be able to access any letters or electronic communication from the Agency on the CRA website, but only after signing into My Account. My Account, like all of the CRA’s online services, now requires user ID, password, and multi-factor authentication.

Where an unsolicited contact from the CRA to an individual taxpayer is made by telephone, it can be difficult to determine whether that unfamiliar voice on the telephone is in fact a CRA employee (remembering that call display is no longer an effective means of determining whether the call is actually from the Agency).

The Agency suggests that where the taxpayer wishes to verify that the call is in fact from a CRA employee (which is always the best approach when receiving any such phone call), that they take the following steps to ensure that that is the case.

1. Tell the caller you would like to first verify their identity.
2. Request and make a note of their:

• name,
• phone number, and
• office location.

End the call. Then check that the information provided during the call was legitimate by contacting the CRA at 1-800-959-8281. It is important to do this BEFORE providing any information at all to the caller.

Not infrequently, a taxpayer will contact the CRA through one of its individual or business tax help lines, which are answered by call centre agents. Each of those telephone services offers an automated callback service – when wait times reach a certain threshold, the taxpayer is given the option of receiving a callback rather than continuing to wait on hold. Where the taxpayer chooses the callback option, they are provided with a randomized four-digit confirmation number. The CRA call centre agent who returns the taxpayer’s call will repeat that number, so that the taxpayer can be certain that it is a CRA employee who is calling.

Finally, there are some actions which, if taken by anyone purporting to be from the CRA, should lead the taxpayer to immediately end the telephone call or delete the text or email, including the following:

• the caller does not give proof of working for the CRA, for example, their name and office location;
• the caller pressures the taxpayer to act now, uses aggressive language, or issues threats of arrest, deportation, or sending law enforcement;
• the caller asks for information that the taxpayer would not enter on his or her return – for example, a credit card number; or
• the caller recommends that the taxpayer apply for benefits, or offers to apply for benefits on the taxpayer’s behalf.

Any unsolicited email or text which purports to be from the CRA should be immediately deleted WITHOUT clicking on any links. The only instances in which the CRA will email a taxpayer is to notify them that something is available for them to view in their online CRA account (which requires log-in with ID, password, and multi-factor authentication). The Agency will also email a form or publication where the taxpayer has previously requested it during a call or a meeting with a CRA agent. Information on how to ensure that such an email is legitimate can be found on the Agency’s website at What to expect when the Canada Revenue Agency contacts you – Canada.ca.

Finally, a CRA representative will never

• demand immediate payment from the taxpayer by any of the following methods:
  • Interac e-transfer,
  • cryptocurrency (Bitcoin),
  • prepaid credit cards,
  • gift cards from retailers such as iTunes, Amazon, or others;
• ask the taxpayer for a fee to speak with a contact centre agent;
• set up a meeting in a public place to take a payment from the taxpayer;
• leave voicemails that are threatening to the taxpayer, or that include the taxpayer’s personal or financial information; or
• send an email or text message with a link to the taxpayer’s refund.

While scams and frauds and their perpetrators have been around for literally centuries, changes in how we communicate and how we conduct our financial affairs have made it significantly easier to carry out such deceptions. Most taxpayers are now accustomed to and at ease with conducting much of their personal and financial lives online, and replying instantly to any communication has become the norm. And even newer technology, like AI, poses additional threats for the future.

In such an environment, the best protection for a taxpayer who has received an unsolicited communication purporting to be from the CRA is to do … nothing, in the moment. Responding immediately without taking the time to assess and verify the legitimacy of the communication is exactly the response the scammers count on and profit from. (As well, any communication which requires the taxpayer to act immediately with respect to a tax matter is almost certainly fraudulent – if the CRA contacts a taxpayer requesting information or documentation, or payment, a reasonable time period in which to respond will be provided and a date by which that response is required will be specified as part of the communication.) The taxpayer’s best protection is to double check in order to verify the legitimacy of any unsolicited contact received with respect to matters of tax or personal finances. Doing so is no longer just prudent, it’s a necessity.

More information on how to avoid become the victim of a tax scam can be found on the CRA website at Security and privacy of your information with the CRA – Canada.ca.