Whether you’re filing your taxes, expecting a refund, or updating your personal information, scammers are actively trying to intercept your data and money by posing as CRA agents.

With cybercrime becoming more advanced and targeted, it’s essential to understand what these scams look like and how you can protect yourself, your family, and your business.

The latest CRA scam tactics

Fraudsters have developed new ways to impersonate CRA communications. Some of the most common scam methods reported this year include:

• Emails claiming you’re eligible for a refund and asking you to ‘verify your banking details.’
• Texts alerting you to ‘suspicious activity’ on your tax account and asking you to log in via a fraudulent link.
• Robocalls saying you owe back taxes, threatening arrest if you don’t comply.
• Fake CRA portals, which look almost identical to the real thing, designed to capture your login credentials.
• Messages requesting gift card or cryptocurrency payments, claiming it’s a ‘secure’ method.

These scams may appear to come from familiar-looking email addresses or Canadian phone numbers, and often pressure you to act immediately.

Why businesses are vulnerable

Scammers are targeting Canadians across all provinces, especially during times when people are:

• Waiting on tax refunds or benefit payments
• Changing jobs or addresses
• Submitting tax information through a new preparer
• Receiving government assistance

They prey on uncertainty and urgency, using fear or false promises to push you into clicking links or sharing personal information.

Your 3-step protection guide

1. Stop and assess

If a message demands urgent action, claims your account is locked, or threatens penalties, pause before doing anything. CRA does not operate this way.

2. Check the message

CRA will never:

• Ask for personal or banking information by email or text
• Use social media DMs to contact you about your taxes
• Ask for payment by gift cards, crypto, or e-transfers
• Use aggressive or threatening language in a voicemail

3. Report and respond

If you think a scammer has contacted you or you’ve accidentally shared your information:

• Report it to the Canadian Anti-Fraud Centre at www.antifraudcentre-centreantifraude.ca
• Contact CRA directly
• Inform your bank and change your online passwords immediately
• Notify us

By reporting scams, you help protect others and support national cybersecurity efforts.

What CRA communication looks like

CRA may contact you by mail, phone, or in some cases, email, but they will never ask for confidential information through those channels. If CRA needs you to take action, they will direct you to log in securely through your CRA My Account.

If you receive a message that says ‘click here to claim your refund’, it’s almost certainly a scam.

What to do if you’ve been scammed

If you believe you’ve given scammers access to your CRA information:

1. Log into your CRA My Account and update your credentials.
2. Contact your financial institution and use CRA’s fraud page
3. File a report with the Canadian Anti-Fraud Centre.
4. Consider placing fraud alerts on your credit file with Equifax or TransUnion.

The faster you act, the more likely you are to minimise the damage.

Extra precautions for businesses

If you run a business or manage payroll:

• Ensure only authorised staff can access your business CRA account.
• Educate employees on how to identify scam emails and texts.
• Double-check the legitimacy of any CRA-related communication before responding.

Business scams often involve fake GST/HST filing requests or payroll document requests, so remain vigilant year-round.

Final reminder

If a message or phone call feels suspicious, hang up or delete it. Scammers want you to act fast and without thinking. CRA will never fault you for checking before responding.

In today’s digital world, staying informed and cautious is your best defence. When in doubt, verify independently using trusted sources.