Know how to recognize a scam
Examples of fraudulent communications
How to protect yourself from identity theft
Have you been a victim?
Scam stories
External resources
Print-ready posters and handout for service providers
Know how to recognize a scam
There are many fraud types, including new ones invented daily.
Taxpayers should be vigilant when they receive, either by telephone, mail, text message or email, a fraudulent communication that claims to be from the Canada Revenue Agency (CRA) requesting personal information such as a social insurance number, credit card number, bank account number, or passport number.
These scams may insist that this personal information is needed so that the taxpayer can receive a refund or a benefit payment. Cases of fraudulent communication could also involve threatening or coercive language to scare individuals into paying fictitious debt to the CRA. Other communications urge taxpayers to visit a fake CRA website where the taxpayer is then asked to verify their identity by entering personal information. These are scams and taxpayers should never respond to these fraudulent communications or click on any of the links provided.
To identify communications not from the CRA, be aware of these guidelines.
If you receive a call saying you owe money to the CRA, you can call us or check My Account to be sure.
If you have signed up for online mail (available through My Account, My Business Account, and Represent a Client), the CRA will do the following:
- send a registration confirmation email to the address you provided for online mail service for an individual or a business; and
- send an email to the address you provided to notify you when new online mail is available to view in the CRA’s secure online services portal.
The CRA will not do the following:
- send email with a link and ask you to divulge personal or financial information;
Exception:
If you call the CRA to request a form or a link for specific information, a CRA agent will forward the information you are requesting to your email during the telephone call. This is the only circumstance in which the CRA will send an email containing links.
- ask for personal information of any kind by email or text message.
- request payments by prepaid credit cards.
- give taxpayer information to another person, unless formal authorization is provided by the taxpayer.
- leave personal information on an answering machine.
When in doubt, ask yourself the following:
- Did I sign up to receive online mail through My Account, My Business Account, or Represent a Client?
- Did I provide my email address on my income tax and benefit return to receive mail online?
- Am I expecting more money from the CRA?
- Does this sound too good to be true?
- Is the requester asking for information I would not provide in my tax return?
- Is the requester asking for information I know the CRA already has on file for me?
If you do have a debt with the CRA and can’t pay in full, take action right away. For more information, go to When you owe money – collections at the CRA.
How to protect yourself from identity theft
- Never provide personal information through the Internet or by email. The CRA does not ask you to provide personal information by email.
- Be suspicious if you are ever asked to pay taxes or fees to the CRA on lottery or sweepstakes winnings. You do not have to pay taxes or fees on these types of winnings. These requests are scams.
- Keep your access codes, user ID, passwords, and PINs secret.
- Keep your address current with all government departments and agencies.
- Choose your tax preparer carefully! Make sure you choose someone you trust and check their references. Always review your return, agree with the content before filing, and follow up to make sure you receive your notice of assessment, since it contains important financial and personal information that belongs to you.
- Before supporting any charity, use the CRA website at www.cra.gc.ca/charities to find out if the charity is registered and get more information on the way it does business.
- Be careful before you click on links in any email you receive. Some criminals may be using a technique known as phishing to steal your personal information when you click on the link.
- Caller ID is a useful function. However, the information displayed can be altered by criminals. Never use only the displayed information to confirm the identity of the caller whether it be an individual, a company or a government entity.
- Protect your social insurance number. Don’t use it as a piece of ID and never reveal it to anyone unless you are certain the person asking for it is legally entitled to that information. If an organization asks for your social insurance number, ask if it is legally required to collect it, and if not, offer other forms of ID.
- Pay attention to your billing cycle and ask about any missing account statements or suspicious transactions.
- Shred unwanted documents or store them in a secure place. Make sure that documents with your name and SIN are secure.
- Immediately report lost or stolen credit or debit cards.
- Carry only the ID you need.
- Do not write down any passwords or carry them with you.
- Ask a trusted neighbour to pick up your mail when you are away or ask that a hold be placed on delivery.
Have you been a victim?
You should report deceptive telemarketing to the Canadian Anti-Fraud Centre online or by calling 1-888-495-8501.
If you suspect you may be the victim of fraud or have been tricked into giving personal or financial information, contact your local police service.
If the CRA has confirmed that a taxpayer’s information has been compromised, the Agency will act to prevent the fraudulent use of the information involving systems and processes for which the CRA is responsible.
If your social insurance number (SIN) has been stolen, you should contact Service Canada at 1-800-206-7218. For more information, see Social Insurance Number (Service Canada website).
You can ask the CRA to disable online access to your information on the CRA login services by contacting us. After access to your information is disabled, you may change your mind and want access again. If so, you can contact us and ask that your access be re-activated.
If you think your CRA user ID or the password you use in personal dealings with the CRA has been compromised, contact us.
