Tax season may be behind us, but scammers aren’t taking the summer off. According to the Canada Revenue Agency (CRA), fraudsters operate year-round and continue to target Canadians by impersonating the CRA to steal money, personal information, and account credentials.

Protecting your CRA account is especially important because it can contain sensitive tax, payment, payroll, and business information.

At The TaxForce, protecting our clients means more than filing returns and tracking deadlines. It also means helping you recognize when something isn’t legitimate. Here’s what the CRA is currently warning Canadians and business owners about, based on its official guidance.

The CRA Is Warning About Account Takeovers and “Email Bombing”

In a June 2026 news release, the CRA confirmed that fraudsters are attempting to access taxpayer accounts using sign-in information obtained from sources outside the CRA, including phishing schemes and third-party data breaches. The CRA said that in 2025, it proactively revoked more than 50,000 CRA user IDs and passwords identified as potentially available to threat actors.

The CRA has also identified a tactic known as “email bombing.” In this type of attack, scammers use stolen login information to access an account and make changes. They then flood the account holder’s inbox with large numbers of unwanted emails. The goal is to bury legitimate CRA notifications, including alerts about important account changes, among the unwanted messages.

What the CRA recommends if this happens to you:

• Do not click on links in, or reply to, the unwanted emails.
• Sign in to your CRA account directly to check for new mail and account changes.
• Monitor your account and change your password regularly.
• Report suspicious activity to the CRA.

Warning Signs of a CRA Impersonation Scam

The CRA has published a clear list of things it will not do. If someone claiming to be from the CRA does any of the following, treat it as a red flag:

• Send refunds or payments by e-transfer or text message.
• Provide or accept payments by cryptocurrency.
• Demand or pressure you to make an immediate payment by Interac e-transfer, cryptocurrency, prepaid credit card, or gift card.
• Threaten to deport or arrest you, or put you in prison.
• Use aggressive or threatening language.
• Set up an in-person meeting in a public location to collect a payment.
• Charge a fee to speak with a CRA call centre agent.
• Ask for personal or financial information through voicemail or email.

At the same time, the CRA can legitimately contact you by phone, automated message, letter, or email, depending on the situation. For example, CRA representatives may request identity information, receipts, supporting documents, or other tax-account information by phone or letter. The CRA may also contact you about a review, audit, filing requirement, or outstanding balance.

The important distinction is how the communication asks you to respond.

What a Legitimate CRA Email Looks Like

This is an area where scammers can be especially convincing.

The CRA says it will only send emails in two situations:

• You have registered for email notifications and have a new message to view in your CRA online account.
• You have asked a CRA agent during a meeting or call to send you a CRA link, form, or publication.

CRA emails will not ask you to reply to the email or include a link asking you to enter personal or financial information.

For business accounts, CRA email notifications can alert you when important changes are made to your account, such as changes to your address, direct deposit information, authorized representative, owner information, CRA user ID or password, or multi-factor authentication enrollment. They can also notify you when new CRA mail is available in My Business Account.

So, if you receive an email saying there has been a change to your CRA business account, don’t ignore it, but don’t click links in the email either. Sign in to your CRA account directly and check what happened.

Text Messages: A Common Scam Channel

The CRA’s guidance on text messages is very specific: the CRA only sends text messages for multi-factor authentication (MFA) if you enrolled using the telephone option. The CRA does not use text messages or instant messaging services such as Facebook Messenger or WhatsApp to communicate with you.

The CRA currently lists several scams that use text messages, including:

• Fake messages offering a fraudulent Interac e-transfer refund, followed by a link to a convincing fake banking sign-in page.
• Messages referring to a line from your “most recent tax assessment” and asking you to respond “Y” before clicking a fraudulent link.
• Messages claiming there is an “error” with your CRA account and asking you to reply “HELP” and provide personal information.

If you receive a text message claiming to be from the CRA about a refund, benefit, or account problem, do not click, do not reply, and do not provide personal or financial information. Instead, verify the information through your CRA account or by contacting the CRA through an official channel.

Fake Websites: How to Spot Them

Scammers can create websites that look surprisingly similar to official Government of Canada pages.

The CRA advises checking the web address carefully. The official CRA website uses addresses that:

• Start with canada.ca, or
• End with cra-arc.gc.ca.

Official Government of Canada websites generally begin with canada.ca or end with .gc.ca.

Fake websites may use look-alike addresses with extra words, unusual endings, additional characters, or slightly altered spellings, for example, addresses such as “cra-login-canada.com” or “cra-account-notice.info.”

The CRA’s advice is simple: when in doubt, don’t click. Type the official website address directly into your browser instead of following a link in an unexpected email or text message.

A Growing Concern: AI-Generated Scams

The CRA has specifically identified generative artificial intelligence (GenAI) as a growing factor in tax-related scams.

According to the CRA, GenAI makes it easier for scammers to create sophisticated and convincing malicious content, including realistic-looking CRA forms and communications. Traditional warning signs such as typos, poor formatting, or blurry logos may no longer be as obvious.

The CRA’s recommendation is to apply the same scam-prevention principles to AI-generated communications as you would to any other suspicious message.

When in doubt, verify information directly through official Government of Canada websites or secure CRA channels rather than trusting an email, text, or website simply because it looks professional.

How to Protect Your CRA Business Account

Based on the CRA’s current recommendations, these are some of the most important habits business owners can build into their routine:

1. Use a strong, unique password for your CRA account. Do not reuse your CRA password on other websites, accounts, or devices. CRA sign-in credentials support passwords of up to 64 characters.
2. Keep your email address on file up to date. CRA email notifications can alert you when important changes are made to your business account, including changes to direct deposit information, authorized representatives, account credentials, and other account details.
3. Investigate unauthorized change notifications immediately. If you receive a CRA notification about a change you did not make, sign in to your CRA account directly and contact the CRA if you find suspicious activity.
4. Check your account regularly. Look for unsolicited changes to your personal or business information, unexpected benefit applications, or changes to your tax return. The CRA specifically recommends regularly monitoring your account.
5. Avoid clicking links in unsolicited texts or emails. Instead, type the official Government of Canada website address directly into your browser and navigate from there.

What To Do If You Suspect a Scam or Account Takeover

If you believe you’ve been targeted by a scam or that your CRA account may have been accessed without your permission, don’t wait to investigate.

The CRA recommends:

• Sign in to your CRA account directly and check for unauthorized changes.
• Contact the CRA if you find suspicious activity or believe your account has been compromised.
• If necessary, request protections to be placed on your account.
• Report the incident to the Canadian Anti-Fraud Centre and other appropriate authorities.

If you receive a suspicious phone call, don’t rely on caller ID. The CRA warns that phone numbers can be spoofed. Ask for the caller’s name, office, and callback number, end the call, and verify the number using the CRA’s official verification tools before providing information.

Where to Verify This Information

The information in this article is based on the CRA’s official scam and fraud guidance, including its June 2026 security alert.

• CRA – Recognize a scam
• CRA – Tax season may be over for most Canadians, but threats to their personal information are not (June 2026)
• CRA – Email notifications from the CRA for businesses
• CRA – Report a scam or identity theft

Scam tactics can change quickly. We recommend checking the CRA’s official scam alert page periodically for the latest examples and guidance, rather than relying on any single article — including this one, as a permanent reference.

This article is intended for general informational purposes only and does not constitute legal, tax, cybersecurity, or financial advice. If you believe you have been the victim of fraud or identity theft, contact the CRA directly and consider reporting the incident to the Canadian Anti-Fraud Centre and your local police.

Not Sure If Something From “The CRA” Is Legitimate?

Scam messages are designed to create urgency and confusion. If you’ve received a call, email, or text that doesn’t feel right, don’t respond until you’ve verified it through an official CRA channel.

The TaxForce is here to help you stay informed and make confident decisions about your tax matters.

📞 226-776-1219
🌐 www.thetaxforce.ca

Trusted tax advice. Year-round support.