How to protect your money and your data against CRA scammers

If you’ve ever received a phone call or message from the Canada Revenue Agency (CRA), you likely took it seriously. After all, who wants to be in trouble with the organization that handles your taxes?

But cybercriminals are eager to exploit this normal reaction to steal your personal or financial details and your money, specially when it comes to seniors.

Scams aren’t new, but advances in technology have given fraudsters more ways to pose as institutions like the CRA. Common digital communications — emails, texts and instant messages — are all opportunities to scam. Even electronic tax filings, which is how more than 92% of Canadian taxpayers file their tax returns, can present a security risk.¹

It’s crucial to stay on top of the latest scams so you can keep your money and your data safe. Read on to learn all about CRA scams, how to identify them and what you should do if a scammer contacts you.

CRA scams are fraudulent calls, emails, letters or text messages from someone claiming to be an agent with the Canada Revenue Agency.

Scammers use many methods to try and trick you. Some claim that there’s a problem with your tax return or account. To fix it, they want you to click a link and input personal details, or download an attachment that installs malware onto your smartphone or computer. They may also intimidate you into sending them money.

If these fraudsters get their hands on your personal data, they can use it to break into your bank or tax accounts, or for identity theft. If you make a payment to a scammer, your money might be tough to recover.

Cybercriminals have all sorts of ways to try to steal your money or identity by claiming to be with the CRA. Here are some of the most common scams to watch out for.

With impersonation scams, the criminal claims to be a CRA agent or other official to trick or pressure you into sending money or giving them your personal or banking details.

For instance, a scammer may call you and claim to be a CRA agent and say something is wrong with your tax return. They may threaten to arrest you, then later, call back posing as an RCMP officer who tells you to send money to cancel the arrest.

With email phishing scams, cyber criminals use email to trick you into giving them personal data like your passwords, social insurance number or credit card numbers. You may get an email claiming that something’s wrong with your CRA account and asking for information, or the sender might try to get you to click a link.

Smishing scams are similar, except fraudsters make contact using SMS (text messages). For instance, you may receive a text message saying you have a tax refund. But to get it, you have to click a link. Once you click, you’re prompted to enter your personal information.

Whenever someone uses the mail for fraudulent purposes, it’s called mail fraud and it’s a crime. Although less common than other types, some CRA scammers rely on the mail. To get your personal information, they may send you a letter, asking you to fill out and return a form to claim a benefit. Then, once they get their hands on your data, they use it to file a fake tax return in your name — committing identity theft.

The very first thing you should know is what you can expect from a legitimate contact from the Canada Revenue Agency. After all, the CRA does contact people via phone, email and mail.

It’s also a good idea to visit the Canada Revenue Agency website, which has a running list of the latest CRA scams. Since many use the same basic tactics, here’s a closer look at what you should watch out for.

To learn how to bank with confidence for customers 60+, refer to the Scotiabank Seniors Resource Centre.

While the CRA might ask you for verifying information, you can (and should) also verify the agent by asking for their name, phone number, and office location.

• Ask you to verify your identity using personal information like your SIN or date of birth.
• Call you on the phone to discuss tax debt or offer free tax help.
• Send an automated phone message.
• Send an email to notify you that there's a new message in your account.
• Send you a link to a webpage while you're talking to an agent.
• Use text to send you a verification log-in code.

• Ask you for personal or financial information by email or text, or ask you to click a link.
• Send a link to a form where you input personal or financial information.
• Use text or instant messaging platforms like Facebook Messenger or WhatsApp to start a conversation with you.

While it’s possible that you might owe the CRA money, the agency will never reach out unexpectedly to demand payment — or ask you to meet in a public place to give it to them. Beware of embedded links to make an Interac e-Transfer, or a payment request for cryptocurrency, gift cards or prepaid credit cards. The CRA doesn’t accept any of these types of payment.

• Ask for payment on outstanding taxes through any of the payment options accessed through your CRA account.
• Take legal action to recover money you owe.

• Ask to meet in a public place for payment.
• Ask for payment by Interac e-transfer, cryptocurrency, prepaid credit cards, or gift cards.
• Threaten you with arrest.

If you receive a communication that contains aggressive language or threats — including the threat of arrest — it's not a legitimate CRA communication. The CRA doesn't threaten or intimidate taxpayers.

• Send a message that you owe money.

• Threaten to arrest you.

Another tip-off that a communication is fake is if there’s a sense of urgency in the request for money or information. The CRA doesn’t use high-pressure tactics and pressing deadlines.

• Inform you of deadlines.

• Contact you for the first time with an urgent deadline or use high-pressure tactics to get you to click a link or send payment.

If you’re not sure whether a letter, text, call or email from the CRA is fake, look for these warning signs:

• Spelling or grammar mistakes
• An unknown sender email or phone number
• Communications through services like Facebook Messenger or WhatsApp
• A logo or letterhead that doesn’t look quite right.
• Embedded links in an email, especially to send an Interac e-transfer.
• Unexpected attachments

If you're in doubt about any communication claiming to be from the CRA, you can log in to your My Account or My Business Account on the CRA site. Alternatively, you can call them directly. Find the appropriate number for your inquiry on their site.

For more on what to watch for, check out the Canada Revenue Agency’s samples of scam letters, emails, texts and telephone calls. 

If you think a CRA scammer has tried to contact you, remember the three Rs: recognize, reject and report.

Take your time reviewing any communications claiming to be from the CRA. Look it over carefully for the warning signs of a scam. If you’re ever in doubt, you can log in to your CRA account or call the agency directly at 800-267-6999.

Don’t click links, download attachments or even respond to an email or text message. If you’re on the phone, hang up immediately. 

Make a report, even if you didn’t respond, because it gives law enforcement the intel they need to combat CRA scams. You should tell your local police and the Canadian Anti-Fraud Centre.

You can make a report with the Canadian Anti-Fraud Centre at 888-495-8501 (open business hours, Monday through Friday, 9 a.m. to 4:45 p.m.) or online.

If you decide to report online, you’ll need to log in to the Centre’s secure reporting system one of two ways:

• Use your GC Key. “GC” stands for Government of Canada and the key is a log username and password that you may have already set up to access other services. You can also register for one if you’re a new user.
• Use an Interac sign-in partner if you have an existing login with one of these financial institutions. If you use this method, use the same login information you’d use for other services, such as to access your online banking.

Scammers want your money and personal data, and they’ll go to great lengths to get it — even posing as the CRA. Your best defence is to recognize, refuse and report.