← Guides / Canada

Canada CRA Scams & Identity Protection Guide

the CRA scams and the identity protection in Canada. The CRA phone scams are the most common — the scammer calls the taxpayer, claims to be the "CRA agent", demands the immediate payment of the "tax debt", and threatens the "arrest", the "deportation", or the "legal action". The CRA NEVER calls the taxpayer to demand the immediate payment (the CRA's official policy: the CRA does NOT demand the payment by the "Interac e-transfer", the "gift cards", the "prepaid credit cards", or the "cryptocurrency"). The CRA email scams (the "phishing") — the scammer sends the email that appears to be from the CRA (the "CRA email" — the "myCRA security alert" — the "CRA refund notification"). The CRA does NOT send the emails with the links to the login pages (the "CRA does NOT use the email links to the My Account"). The CRA text scams (the "smishing") — the scammer sends the text message with the "urgent CRA message" and the link to the "fake CRA website". The CRA does NOT send the text messages. The SIN (Social Insurance Number) protection — the "SIN fraud" (the "identity theft using the SIN") — the "SIN is the key to the identity theft" (the "SIN is used to file the fraudulent tax returns, to open the bank accounts, to apply for the credit cards"). The CRA My Account — the "secure login" (the "GCKey" or the "Sign-In Partner" — the "two-factor authentication" — the "CRA My Account security"). The credit monitoring — the "Equifax" and the "TransUnion" (the "credit report" — the "credit freeze" — the "fraud alert").

CRA Phone Scams

• Common tactics: The scammer claims to be the "CRA agent" and demands the immediate payment of the "tax debt" through the "Interac e-transfer", the "gift cards" (the "iTunes cards, the Google Play cards, the Amazon gift cards"), the "prepaid credit cards", or the "cryptocurrency" (the "Bitcoin").
• CRA's real policy: The CRA NEVER demands the payment by the gift cards, the prepaid cards, or the cryptocurrency. The CRA does NOT threaten the "immediate arrest" or the "deportation". The CRA does NOT leave the "threatening voicemail messages".
• What to do: Hang up immediately. Do NOT press "1" to speak to the "agent". Do NOT provide the personal information (the SIN, the date of birth, the bank account, the credit card). Report the scam to the "Canadian Anti-Fraud Centre" (the "CAFC" — the "1-888-495-8501").

CRA Email & Text Scams

• Phishing emails: The scammer sends the email that appears to be from the CRA (the "CRA refund" — the "CRA My Account alert" — the "CRA security update"). The email contains the link to the "fake CRA website" that steals the login credentials. The CRA does NOT send the emails with the links to the login pages.
• Smishing (text messages): The scammer sends the text message with the "urgent CRA message" (the "CRA alert — your account has been compromised"). The text message contains the link to the "fake CRA website". The CRA does NOT send the text messages.
• What to do: Do NOT click the links in the suspicious emails or the text messages. Forward the phishing email to the CRA at "phishing@cra-arc.gc.ca". Delete the email or the text message immediately.

SIN Protection

• SIN fraud: The "SIN identity theft" — the scammer uses the SIN to file the fraudulent tax return (the "tax refund fraud"), to open the bank account (the "SIN-based identity fraud"), to apply for the credit cards, and to obtain the government benefits.
• SIN protection tips: Keep the SIN card in the safe place (do NOT carry the SIN card in the wallet). Share the SIN ONLY with the "authorized organizations" (the employers, the banks, the financial institutions, the government agencies). Do NOT provide the SIN over the phone or the email.
• Identity theft recovery: Contact the CRA (the "CRA identity theft report" — the "CRA Identity Fraud Callback" — the "1-800-959-8281"). Contact the "Equifax" and the "TransUnion" (the "credit freeze" — the "fraud alert" — the "credit report" review). File the police report (the "identity theft report" with the local police).

For the CRA My Account and the online security, see our Tax Return Guide →. For the voluntary disclosures and the taxpayer relief, see our Tax Audit & Appeals Guide →.