Tax season brings more than just paperwork — it brings an uptick in fraudulent activity targeting Canadians. CRA scam emails, phishing texts, and fake phone calls have become increasingly sophisticated, and thousands of Canadians fall victim every year. Understanding how the real Canada Revenue Agency communicates — and how fraudsters impersonate it — is the most effective defence you have.
Before you can spot a scam, you need to know what legitimate CRA contact looks like. The agency follows specific communication protocols, and understanding them removes the ambiguity that fraudsters exploit.
By mail (paper): The CRA's primary method of official communication is Canada Post. Assessment notices, balance owing letters, requests for documentation, and benefits information all arrive by paper mail. If you receive something important from CRA, expect a physical envelope with a return address bearing a CRA processing centre.
By phone: CRA agents may call you, but they will never threaten arrest, deportation, or immediate police involvement. A real CRA agent will provide their name and a callback number, and they will allow you time to verify the call. If you feel pressured or threatened during a call claiming to be from CRA, hang up — it is not the CRA.
By email: This is where most confusion occurs. The CRA will only send you an email to notify you that a new message is waiting inside your secure My Account portal. The actual content — your notice, your refund details, your tax information — is never included in the email itself. The email simply says something like: "You have a new message in your CRA My Account." You then log in directly at canada.ca to read it.
Never by text message: The CRA does not contact taxpayers via SMS or text message under any circumstances. If you receive a text claiming to be from the CRA, it is a scam — full stop.
Never by gift card or cryptocurrency: The CRA accepts payment through your financial institution, online banking, cheque, or money order. They will never, under any circumstances, ask you to pay a tax debt using iTunes cards, Google Play cards, Bitcoin, wire transfer to an unknown account, or any other unusual method.
Fraudsters are adaptive and creative. These are the most active CRA impersonation scams Canadians are encountering right now.
You receive an email with a subject line like: "CRA Tax Refund Notification — Action Required" and a message reading: "Dear Taxpayer, you have a tax refund of $847.00. Click here to claim within 48 hours or your refund will be forfeited."
This is entirely fabricated. The CRA issues refunds by cheque mailed to your address or by direct deposit to your bank account — they do not send refunds through email links. No legitimate refund ever requires you to click a link and enter your banking information to "receive" it. The link leads to a phishing site designed to steal your financial credentials.
An automated or live caller claims to be a CRA officer and warns that a warrant has been issued for your arrest due to unpaid taxes or tax fraud. They demand immediate payment to avoid being taken into custody. Some versions add a threat of deportation for non-citizens.
The CRA has no authority to arrest anyone. Tax enforcement goes through the courts and proper legal channels. Hang up immediately.
A caller insisting they are a CRA collections agent tells you that you owe back taxes and must pay immediately using iTunes or Google Play gift cards. They may stay on the line while you go to a pharmacy or grocery store to purchase the cards, then ask you to read the numbers aloud.
Once those card numbers are shared, the money is gone and unrecoverable. No government agency in Canada accepts gift cards as payment.
A text message arrives claiming your CRA account has been compromised or that you need to verify your Social Insurance Number to unlock your benefits. There is a link that leads to a convincing fake CRA website.
The CRA does not send texts. Your SIN should never be provided in response to an unsolicited contact of any kind.
Fraudsters create near-perfect replicas of the CRA's My Account login portal. These phishing sites capture your username, password, and sometimes your SIN. You may arrive at these pages through a fake email notification or a search engine ad. Always navigate directly to canada.ca — never through links in emails or texts.
An email arrives claiming to contain your T4 or another tax document as an attachment. Opening the attachment installs malware, or the email directs you to a fake login page. Employers deliver T4s through payroll systems or physical copies — not through generic email blasts from unknown senders.
Whether the contact arrives by email, phone, or text, watch for these warning signs:
Reporting scams helps protect other Canadians. If you receive a suspicious communication, here is exactly what to do:
Forward phishing emails directly to the CRA at phishing@cra-arc.gc.ca. Include the original email as an attachment if possible.
Report to the Canadian Anti-Fraud Centre (CAFC) at antifraudcentre.ca or by calling 1-888-495-8501. The CAFC is Canada's central repository for fraud and cybercrime reporting and shares intelligence with law enforcement agencies.
Report fake websites to the Canadian Radio-television and Telecommunications Commission (CRTC) through their Spam Reporting Centre at fightspam.gc.ca.
Contact the CRA directly at 1-800-959-8281 to verify whether any communication you received is legitimate before taking any action.
If you realise you have sent money or shared personal information with a fraudster, act quickly — every hour matters.
It is important to understand that the CRA itself cannot help you recover funds paid to a fraudster. The agency has no mechanism to intervene in financial transactions made under false pretenses. Acting immediately through your bank gives you the best — and often only — chance of recovery.
CRA fraud is not seasonal. While phishing activity spikes around tax filing deadlines in April and benefit payment dates, scammers operate continuously. Bookmark canada.ca and access your CRA My Account only through that address. Enable multi-factor authentication on your My Account. Never share your SIN, banking details, or CRA login credentials with anyone who contacts you unsolicited — including people claiming to be your accountant.
If you work with Swift Accounting Calgary, we will never contact you asking for your CRA login credentials or request payment through unusual methods. Any legitimate request from our office arrives through established communication channels you can verify.
If you have received a suspicious communication and are unsure whether you actually owe the CRA money, the safest step is to speak with a qualified accountant before taking any action. Many scams succeed precisely because the target has a legitimate concern about a past filing or an outstanding amount and the fraudulent contact feels plausible in that moment.
The team at Swift Accounting in Calgary can review your CRA correspondence, log into My Account on your behalf with proper authorisation, and tell you plainly whether a balance owing is real and what your options are. Do not pay anything under pressure — get a second set of eyes first.
If you have received a suspicious CRA communication or want to confirm your actual account standing, contact Swift Accounting today for a straightforward conversation with no pressure and no countdown timers.
It is uncommon but possible. In most cases, the CRA will send a written notice before making phone contact, particularly for audits or collections matters. However, the CRA does place outbound calls — the key distinction is that a legitimate CRA agent will never threaten you, will provide a verifiable callback number, and will give you time to confirm their identity. If you are uncertain about any call, hang up and call the CRA directly at 1-800-959-8281 to verify.
Possibly — but you should not click any link in that email to find out. Instead, close the email, open your browser, and navigate directly to canada.ca, then sign into My Account manually. If there is genuinely a new message, you will see it there. This habit protects you whether the email was legitimate or a phishing attempt.
You cannot fully verify an inbound call from the CRA, because telephone numbers can be spoofed to display any caller ID. The safest practice is to take the caller's name and employee number, then hang up and call the CRA's main line (1-800-959-8281) to confirm whether the contact was genuine. A legitimate CRA agent will not object to this process.
Recovery is difficult and depends on how quickly you act and the payment method used. Gift card and cryptocurrency payments are nearly impossible to recover. Bank transfers may have a small window for reversal if your bank is contacted immediately. Contact your financial institution the moment you realise you have been defrauded, then file reports with the CAFC and RCMP. The CRA itself has no authority to facilitate recovery of funds sent to fraudsters.
Free 30-Min Consultation · No Obligation
Our Calgary team handles personal tax, corporate returns, GST/HST, payroll, and bookkeeping — all under one roof.
Swift Ltd · Calgary, Alberta · swiftltd.ca