TL;DR: Signs your CRA My Account may be compromised include unrequested changes to your banking, address or personal information, a benefit application you didn’t make, or unexpected “new mail” notifications. Contact the CRA right away (individuals in the provinces: 1-800-959-8281) to report it and disable online access if needed, then tell your bank, police and the credit bureaus. The CRA never emails or texts a link to your refund.
Why CRA accounts are targeted
Your CRA My Account holds your income, benefits, direct deposit details and tax slips. Change the bank account, and refunds and benefit payments go to the criminal. In 2020, credential-stuffing attacks hit CRA accounts (CRA), and in 2021 the CRA locked about 800,000 accounts as a precaution (VOCM). It’s a good reminder that reused passwords are the usual way in (credential stuffing explained).
Signs something’s wrong
From the CRA’s fraud guidance, contact the CRA if:
- your user ID or password may be compromised;
- you see changes you didn’t request to your banking, address or personal information in My Account;
- a benefit application was made without your knowledge.
Also watch for unexpected “you have new mail” emails. The CRA notifies you by email when something is waiting in your account, but those emails tell you to sign in; they never contain a link to pay or claim anything.
What to do
- Call the CRA. Individuals in the provinces: 1-800-959-8281; in the territories: 1-866-426-1527. Businesses: 1-800-959-5525 (provinces) or 1-866-841-1876 (territories).
- Ask to disable online access to CRA sign-in services if needed; you can re-enable it later.
- Call your bank and watch for unexpected deposits or redirected refunds.
- Tell the credit bureaus and add a fraud alert (how).
- Report to police and the Canadian Anti-Fraud Centre.
- Change passwords for your email and any account that used the same password.
What the real CRA never does
- demand immediate payment by e-Transfer, crypto, prepaid card or gift card;
- threaten arrest, deportation or police involvement;
- email or text you a link to your refund;
- leave voicemails with personal or financial information.
See our full guide to CRA scams.
Prevent it
Use a unique password, keep your email secure with two-factor authentication, and read every CRA notification email. If your SIN was exposed elsewhere, follow Service Canada’s steps. A free email exposure check shows whether your email is in breach data, which is often how passwords leak.
Frequently Asked Questions
How do I know if my CRA My Account was hacked?
Look for banking, address or personal details you didn’t change, benefit applications you didn’t make, or unexpected new mail notifications.
What is the CRA phone number for individuals?
1-800-959-8281 in the provinces and 1-866-426-1527 in the territories.
Can the CRA disable my online access?
Yes. You can contact the CRA to disable and later re-enable online access to its sign-in services.
Does the CRA email links to refunds?
No. The CRA never emails or texts a link to your refund.
Sources
- CRA: How to recognize fraud, scams and tax schemes
- CRA: Cyber incidents (2020)
- VOCM: 800,000 people locked out of CRA My Account (2021)