Is This Email from CRA a Scam?

Since it’s now tax time, the scammers start to ramp up their efforts, and no doubt you’ll get an email claiming to be from Canada Revenue Agency (CRA). Every year the scammers are out, and every year, they get better at what they do.

As a taxpayer, you should be vigilant when you receive a fraudulent communication that claims to be from the Canada Revenue Agency (CRA) requesting personal information such as a social insurance number, credit card number, bank account number, or passport number.

These scams may insist that this personal information is needed so that you can receive a refund or a benefit payment. Cases of fraudulent communication could also involve threatening or coercive language to scare individuals into paying fictitious debt to the CRA. Other communications urge you to visit a fake CRA website where the taxpayer is then asked to verify their identity by entering personal information. These are scams, and taxpayers should never respond to these fraudulent communications or click on any of the links provided.

If you receive an email saying you owe money to the CRA, you can call them or check My Account to be sure. If you have signed up for online mail (available through My Account, My Business Account, and Represent a Client), the CRA will do the following:

• send a registration confirmation email to the address you provided for online mail service for an individual or a business; and
• send an email to the address you provided to notify you when new online mail is available to view in the CRA's secure online services portal.

The CRA will not do the following:

• send email with a link and ask you to divulge personal or financial information;

• ask for personal information of any kind by email or text message.
• request payments by prepaid credit cards.
• give taxpayer information to another person, unless formal authorization is provided by the taxpayer.
• leave personal information on an answering machine.

Exception: If you call the CRA to request a form or a link for specific information, a CRA agent will forward the information you are requesting to your email during the telephone call. This is the only circumstance in which the CRA will send an email containing links.

Fraud Scenario – E-mail phishing

At 80 years old, Irene is excited to use her new computer to keep in touch with her family. One afternoon, she receives a message that seems to be from the CRA claiming that she is entitled to a significant tax refund. The email includes a link to a website asking for personal information, including address, date of birth, and banking information, so that the money can be direct-deposited into her bank account.

Irene doesn’t remember giving the CRA her new email address and is surprised that the CRA is contacting her. What’s more, she has never qualified for similar tax refunds in the past. However, Irene is still getting used to her computer, and assumes that since the email is addressed from the CRA it must be real. She follows the link and fills out her personal information.

Does this scenario sound familiar? Every year, Canadians lose millions of dollars to email phishing scams that result in identity and financial theft. Beware of emails claiming to be from the CRA. The CRA never requests personal information of any kind from a taxpayer by e-mail. Delete phishing emails and do not click on any links; they can carry harmful viruses that can infect your computer.

When in doubt, ask yourself:

• Am I expecting additional money from the CRA?
• Does this sound too good to be true?
• How did the requester get my email address?

Remember if it sounds too good to be true, it probably is.

You can download this PDF from CRA