Most Canadians live their lives with only very infrequent contact with the tax authorities and are generally happy to keep it that way. Sometime between mid-February and the end of April 2025 the majority of Canadian taxpayers will file a return for 2024 with the Canada Revenue Agency. Once that return is processed, the CRA will issue a Notice of Assessment. Most taxpayers will then receive a tax refund, usually by direct deposit to their bank account, while in a minority of cases the taxpayer will have to pay a tax amount owing on or before April 30, 2025.
Sometimes, however, the process does not play out in quite that straightforward a way. In some cases, the CRA will have questions about information reported on the taxpayer’s return – perhaps an income amount reported does not match up with the amount reported to the CRA by the payor of that income. In other cases, the taxpayer may have claimed a deduction or credit, and the CRA wants the taxpayer to provide them with the receipt or other documentation to support that deduction or credit claim. In both cases, the CRA may contact the taxpayer to resolve the discrepancy or to obtain the information needed to finish processing the taxpayer’s return. In some cases, that contact will occur before the CRA issues the Notice of Assessment with respect to the taxpayer’s return, while in others it will not take place until after the Notice of Assessment has been issued.
While no one particularly likes hearing from the tax authorities, it is critical that the taxpayer respond to any inquiry from the CRA. Failing to do so will mean, at a minimum, that the processing of one’s tax return will be delayed, or worse, a claim made on the return will be denied because the taxpayer has not responded to requests to provide the CRA with supporting documentation.
The problem which arises for the taxpayer is determining whether a communication received is in fact a legitimate request from the CRA or is part of a scam, phishing, or fraud attempt. Scams in which fraud artists claim to be from the CRA have become so commonplace over the past decade or so that by now almost everyone has received a fraudulent communication which purports to be from the tax authorities and which requests that the taxpayer provide financial or other information – or threatens dire consequences if the taxpayer fails to make an immediate payment. And, in the past several years, those fraudulent communications have become more and more sophisticated and hard to detect
Receipt of any communication which purports to be from the tax authorities therefore puts the taxpayer in a quandary. A legitimate query from the CRA cannot be ignored, but responding to a fraudulent communication (which can be as simple as clicking on a link in a fraudulent text message or email) can result in significant financial losses, or even identity theft. The resulting (and understandable) level of concern and suspicion on the part of taxpayers has even led to instances in which taxpayers refuse to speak to genuine CRA employees who are contacting the taxpayer in connection with legitimate CRA enquiries.
Some of the difficulty, ironically, likely arises from the fact that the CRA now utilizes most of the currently available communications technology to contact taxpayers. It’s certainly more efficient, but that expanded use of communications technology has had the inadvertent effect of making it easier for scammers to fraudulently represent themselves as being from the Agency. The CRA now contacts taxpayers by phone, by regular mail, by automated voicemail, by email, and by text. About the only method the CRA doesn’t use in communicating with taxpayers is social media. Consequently, a taxpayer who receives a communication by phone, email, or text (the favourites of scammers) can’t automatically assume that such communication is not legitimate. To protect themselves, taxpayers need to know the purposes for which and circumstances in which the CRA will use different communications methods.
To that end, the CRA has made ongoing efforts, primarily through its website, to provide information on how it uses different communication methods to contact taxpayers. The Agency’s goal is two-fold: the first, of course, is to help taxpayers avoid becoming yet another victim of scams and frauds, and the second is to prevent situations in which taxpayers ignore legitimate communications from the Agency, having dismissed them as just another fraud or phishing attempt.
The following summary outlines just when the CRA will (and perhaps more importantly, when it will not) use a particular communication method to contact a taxpayer, and how to know whether a particular communication is in fact a legitimate one.
If you receive a phone call or an automated message
In a phone call, the CRA may ask for any of the following:
- personal information to verify the taxpayer’s identity, including their name, date of birth, or Social Insurance Number (SIN);
- details or additional information needed for the taxpayer’s tax account, such as receipts or supporting documents;
- tax returns which the taxpayer has not filed; or
- financial information, such as the taxpayer’s bank’s name and location.
If the taxpayer has an outstanding debt owed to the CRA, the Agency may:
- ask for payment of any amount owing, using the CRA’s payment options, or
- notify the taxpayer about possible legal actions to recover unpaid debts.
Finally, the CRA may notify a taxpayer by telephone or automated message about any of the following events:
- a tax return is being reviewed;
- a recent GST/HST registration is being reviewed;
- a GST/HST registration requirement is being reviewed;
- a CRA user ID and password have been revoked;
- a Notice of assessment or reassessment is being sent; or
- an audit process is being initiated.
Finally, the CRA may contact a taxpayer by phone or automated message to offer a service, including a reminder of an upcoming income tax filing or payment deadline or a tax instalment payment due date, or support to help the taxpayer access benefits and credits. It’s important to note that the Agency’s automated system only leaves a message and never includes or asks for taxpayer personal information.
If you receive an email
The CRA will send an email to a taxpayer in only two situations:
- the taxpayer has registered for email notifications and is being notified that there is a new message to view in their CRA online accounts; or
- the taxpayer has requested, in a phone call or a meeting with a CRA client services agent, that a CRA link, form, or publication be sent.
When an email purporting to be from the CRA is received, it’s important to remember that legitimate emails from the Agency will not be from a specific user, will not ask the taxpayer to reply to the email and will not include a link asking the taxpayer to enter personal or financial information. Any emails which include any of these features should be deleted.
If you receive a text or instant message
The CRA does utilize text messaging, but only for very limited and specific purposes. The Agency only sends text messages as part of multi-factor authentication for all of its online sign-in services and only if the taxpayer enrolled in that service (like My Account) and selected the telephone option.
As well, the CRA will not use instant messaging such as Facebook Messenger or WhatsApp.
Phone calls from someone claiming to represent the CRA are among the most difficult communications for taxpayers to assess with respect to authenticity, as the recipient of the call has to make an on-the-spot determination about whether the unfamiliar voice on the telephone is, in fact, a CRA employee. There are, however, procedures and processes in place to help.
Legitimate CRA employees will identify themselves when they contact a taxpayer and will provide that taxpayer with their name and phone number to call them back, if asked. (Taxpayers should be aware that relying on call display to verify the source of the call is not a good idea, as scammers have been able to manipulate technology to “spoof” a legitimate CRA phone number.)
The Agency suggests that where there is any doubt about the identity of a caller claiming to be from the CRA, taxpayers consider taking the following steps to ensure that they are in fact speaking to a CRA employee.
- Tell the caller you would like to first verify their identity.
- Request and make a note of their:
- name,
- phone number, and
- office location.
- End the call. Then check that the information provided during the call was legitimate by contacting the CRA. The CRA now provides an online service (available at Verify it’s the CRA calling – Scams and fraud – CRA – Canada.ca) which allows the taxpayer to enter the ten digit phone number which was provided by the caller, to find out whether it is in fact a legitimate CRA phone number.
Each of these verification steps should be taken before providing any information to the caller.
Especially during tax filing season, taxpayers often contact the CRA through one of its individual or business tax help lines, which are answered by call center agents. Each of those telephone services offers an automated callback service – when wait times reach a certain threshold (as they often do during the busiest times), the taxpayer is given the option of receiving a callback rather than continuing to wait on hold. Where the taxpayer chooses the callback option, they are provided with a randomized four-digit confirmation number. The CRA call center agent who returns the taxpayer’s call will repeat that number, so that the taxpayer can be certain that it is a CRA employee who is calling.
While scams and frauds and their perpetrators have been around for literally centuries, changes in technology mean that most taxpayers are now accustomed to and at ease with conducting much of their personal and financial lives online or on their cell phones, making it much easier to carry out such deceptions. And even newer technology, like AI, poses additional threats for the future. In such an environment, the taxpayer’s best protection is to double check in order to verify the legitimacy of any unsolicited contact received with respect to matters of tax or personal finances. Protecting one’s financial and personal information in this way is no longer just prudent, it’s a necessity.
The information presented is only of a general nature, may omit many details and special rules, is current only as of its published date, and accordingly cannot be regarded as legal or tax advice. Please contact our office for more information on this subject and how it pertains to your specific tax or financial situation.
