Preventing Fraud: Beware of Common CRA Scams

What’s a CRA phishing scam?

“Phishing” is when scammers pretend to be from a legitimate company or institution so as to get you to share your financial information or personal information (like your Social Insurance Number) or take money from you. These scams are conducted via email, text messages, phone, online forms, and fake websites. Scammers get access to your information in a number of ways, including when you: 

• Click on a link in an email or a text
• Fill out an online form with financial or personal info
• Make what you believe is a legitimate payment
• Provide your information over the phone

CRA scams are a type of phishing scam in which someone poses as the CRA. For example, a popular CRA phishing scam involves criminals posing as the CRA and texting you to say you have an unclaimed tax refund. In this scam, the text might say, “The CRA has a $387 refund waiting for you. Click here to claim it.” When you click on the link, it would lead you to a form where you input your personal information that they use to steal money or your identity from you.

Does the CRA send text messages?

With all the CRA text message scams going around, you might wonder whether the CRA even sends text messages. The CRA does not send test messages asking for any personal information or to click on any links that ask you to input sensitive information. The CRA may send you a text message with a code to authenticate you when you log in to your CRA account. They do not use text messages asking you to fill out a form, click on a link, give them access to your account, or verify your personal and financial information. That means if you get a text message claiming to be from the CRA and asking for information, you can be certain it’s a phishing scam. 

What’s the best thing to do? Don’t respond. Just delete the text and block the number.

Types of CRA text scams

There are a few CRA text message scams out there that you should be aware of. Here are the most popular ones: 

• CRA inflation aid text message: You might be excited to receive a text message saying you can receive a rebate. However, the CRA won’t contact you asking for personal or banking info in order to give you the rebate. Instead, any rebates will be sent out to eligible individuals or direct deposited into your account.
• CRA goods and services tax/harmonized sales tax (GST/HST) refund or credit text message: If you get a fake CRA text message asking you to fill out a form to get a GST/HST refund, it’s a scam. The scammers will ask for your personal or financial info and might even ask you for payments via e-transfer or gift cards. 
• CRA text with your personal info: To make their CRA text messages seem more legitimate, scammers often include some of your personal information. Typically, they get details about you from a company that was hacked. Scammers use that info to gain your trust.

How do I know if an email from the CRA is real?

Types of CRA email scams

There are a number of CRA email scams that you should be aware of. Here are some to look out for: 

• Emergency or disaster benefit CRA email scam: You’ll get a message saying that you’re eligible for emergency or disaster benefits and asking you to fill out a form to provide personal and banking information. 
• Refund CRA email scam: Scammers will tell you they have a refund for you and that all you have to do is fill out a form so they can give it to you. 
• My Account CRA email scam: This is a phishing scam to get access to your CRA account to get your personal info, such as your Social Insurance Number (SIN), or to file fake returns or benefit applications. The scammers will send you an email saying there is an error in your account and it needs to be updated, and then they’ll ask for your access info.

Would the CRA call me from a private number?

In rare circumstances, the CRA does call taxpayers. That means you need to know how to distinguish a CRA employee from someone posing as the CRA as part of a scam. 

If the CRA does call, the number you see on your caller ID might not be the same number as the CRA’s helpline. When you get a phone call from someone claiming to be with the CRA, the first thing you should do is check their identity. Here’s how: 

• Tell them you want to verify their identity before you give them any information. 
• Request and write down their name, phone number, and office location.
• End the call. After you hang up, make sure to verify that the information was legitimate by contacting the CRA yourself. You can call the CRA customer service number at: 
  • CRA toll-free number in the provinces:
    • 1-800-959-8281 (individual)
    • 1-800-959-5525 (business)
  • CRA toll-free number in the territories:
    • 1-866-426-1527 (individual)
    • 1-800-841-1876 (business)
• Once you’ve verified that the person who called you is an actual employee of the CRA, you can call the employee back. Do not provide your SIN or other personal information or your financial information to a caller until you’ve gone through this process.

Types of CRA phone scams

CRA phone scams can be particularly convincing since you’re speaking directly to a scammer. Be on the lookout for the following:

• Payment demand CRA phone scam: This involves either a robocall or a call from a real person who informs you that you owe money to the CRA and threatens to arrest or jail you. The goal of this scam is to scare you so you’re not thinking clearly and will do whatever they ask. They’ll often try to get you to send them gift cards or prepaid credit cards to cover your tax payment. 
• Cryptocurrency demand CRA phone scam: This scam is similar to the payment demand scam; however, in this case they want you to send them cryptocurrency to pay off your CRA debt. Just like the CRA does not take payment in gift cards or prepaid credit cards, they also don’t take payment via cryptocurrency.

How to report a CRA scam