Skip to main content
Book a free consultation

CRA & compliance

How to spot a CRA scam: warning signs and what to do

Scam messages that claim to be from the CRA reach individuals and business owners all year, and they are timed to filing season and benefit payment dates. The message is rarely the hard part to spot once you know what the CRA does not do. This article sets out the CRA’s own warning signs, a short routine for checking a call, text, email or website, how scammers go after CRA accounts directly, and the people to contact if you have already shared information or sent money.

Sora Accounting & Tax · General information · Editorial policy
Updated · 6 min read

From a suspicious message to a verified answer

A flow showing the steps for a suspicious CRA message: stop, end the contact, verify through your CRA account or an official number, then report if information was shared.

Visual labels: Stop and share nothing; End the call or close it; Check your CRA account; Report if you paid.

What to take away

  • The CRA will not demand immediate payment by e-transfer, cryptocurrency, prepaid card or gift card, and will not threaten arrest.
  • Do not trust caller ID or a link. End the call or close the message, then sign in to your CRA account or call a number you found yourself.
  • If you shared information or paid, contact the CRA, your financial institution, the credit bureaus, the police and the Canadian Anti-Fraud Centre.

What the CRA says it will not do

The CRA lists behaviours that mark a message as a scam. It will not send refunds or payments by e-transfer or text message, and it does not provide or accept payment in cryptocurrency. It will not demand or pressure immediate payment by Interac e-transfer, cryptocurrency, prepaid credit card or gift card.

It also will not threaten to deport, arrest or imprison you, use aggressive or threatening language, arrange to meet in a public place to collect a payment, charge a fee to speak with a call centre agent, or ask for personal or financial information in a voicemail or email. Any one of these is enough to stop and verify, however official the logo or the caller’s manner appears.

Why the CRA genuinely might contact you

Real contact exists, which is why scams work. By phone or letter the CRA may ask for information to verify your identity, for receipts or supporting documents, or for returns you have not filed. If you owe a debt, it may ask you to pay using its official payment options. It notifies you when a return is under review, when a GST/HST registration is being reviewed, when a notice of assessment or reassessment is sent and when an audit is starting.

The CRA may also use an automated message as a courtesy reminder about filing, instalments or deadlines for a business with a new GST/HST account. The CRA says that automated message gives information only and does not ask for personal information. A call that asks you to confirm your SIN or banking details is not that.

Texts, emails and messaging apps

The CRA says it sends emails in only two situations: you registered for email notifications and have a new message in your online account, or you asked during a call or meeting for a link, form or publication to be sent. A genuine email will not come from a named individual, ask you to reply, or contain a link asking for personal or financial information.

Texts are narrower still. The CRA says it sends text messages only for multi-factor authentication codes if you enrolled with the phone option, and it does not use text or instant messaging such as Facebook Messenger or WhatsApp. A text about a refund, a penalty or a benefit with a link is not from the CRA.

Check the web address, not the logo

Fake sites can look convincing. The CRA says look-alike addresses often add words, use unusual endings such as .info or .com, or add odd characters or abbreviations. Its examples include cra-login-canada.com and crareturnreview.cfd. The official CRA address either starts with canada.ca or ends with cra-arc.gc.ca, and the dot before .ca matters, since scammers have used hyphens in its place.

The most reliable habit is to type the address yourself or use a bookmark rather than click a link in a message. Website advertisements and pop-ups can also lead to a different site, and the CRA notes that government websites do not carry non-government advertising.

A short routine for a suspicious call

The CRA advises that a genuine caller gives their name and a number to call back, but you should not rely on caller ID and should never use a number the caller gives you unless you have verified it. Share nothing. Ask for the caller’s name, office location and callback number, say you will verify them, and end the call.

Afterwards, check the number using the CRA’s phone verification tool or its published list of contact numbers. If you are still unsure whether a CRA employee tried to reach you, the CRA gives 1-800-959-8281 for individuals and trusts and 1-800-959-5525 for businesses. For a letter, sign in to your CRA account to see whether the same message appears there. Our CRA letter guide covers what to do when the letter is real.

Scams that go after your CRA account

Some fraud targets the account instead of the person. In a June 2026 tax tip, the CRA described a tactic in which people use sign-in details obtained elsewhere to get into an account, change it, and then send a flood of unwanted emails so that genuine notices are buried. It also reported that in 2025 it revoked more than 50,000 user IDs and passwords that may have been available to threat actors.

The CRA recommends a strong password that is unique to your CRA account, checking that your email address on file is current, and treating a notification about a change you did not make as urgent. Check your account regularly for changes to personal information, benefit applications you did not make and changes to your return. Business owners should do the same in My Business Account, and an accountant with online access should have only the authorization you meant to give.

If you already shared information or paid

Act the same day. Contact the CRA if you think your account was compromised, if there are unauthorized changes to banking, address, business or personal details, or if a benefit application was made without your consent. The CRA offers an online form, a phone line and an automated service. For personal accounts the CRA gives 1-833-995-2336, and for business accounts 1-800-959-5525. It says an officer will contact you within 14 business days after an online or automated submission.

Then contact your financial institution, credit reporting agencies such as Equifax or TransUnion, and your local police. If someone may be using your SIN, report it to Service Canada. The CRA also asks you to notify the Canadian Anti-Fraud Centre, even if a scammer did not get any of your information, because reports help law enforcement.

Protecting a business and the people in it

Owners and bookkeepers are often targeted with messages about GST/HST accounts, payroll remittances or unpaid balances. Agree on a rule inside the business: no one pays a CRA demand from a call, text or email, and every demand is checked in My Business Account or with your accountant first. That rule also protects staff who pay bills while you are away.

Keep a record of what you were sent, with dates, numbers and screenshots, before you delete anything. Bring it to your accountant along with any real CRA letters you have received, so the genuine items can be separated from the fraudulent ones. For general advice on securing online access, see our article on setting up CRA accounts for a new business.

Sources & editorial notes

Sources checked October 24, 2026. The examples are illustrative and provide general information. Discuss how the guidance applies to your circumstances with your accountant.

Rules and guidance can change. Use the current official source and confirm the treatment for your facts. To flag an error, contact Sora.