CRA Account Security: Protect Yourself From Identity Theft

This article is for informational purposes only and does not constitute tax or financial advice. Consult a qualified accounting professional before making any tax or financial decisions.

» Quick Answer

» Why CRA Account Security Matters Right Now

Canadians have never leaned on the Canada Revenue Agency’s online services more than they do today. Refunds land through direct deposit, benefit payments are set up online, and most correspondence now arrives inside CRA My Account rather than by mail. That convenience is real, and so is the growing target it paints on every taxpayer’s login.

Over the past two years, waves of CRA-branded phishing texts and reports of unauthorized account access have pushed identity-theft prevention from a background worry to a headline concern. The CRA itself has responded by making multi-factor authentication mandatory and by pushing security features like email notifications for account changes, but those tools only work if you turn them on and check on them.

The good news: securing your CRA account is a short, one-sitting job. This guide walks you through what to do, in what order, and what to watch for once you are set up. If your business also handles employee or client data, our guide to PIPEDA compliance and financial data security covers the wider picture.

» Quick Start: Pick Your Path

» How Fraudsters Actually Get Into a CRA Account

Understanding how a CRA account gets compromised makes the defence obvious. Most attacks do not involve any clever hacking of the CRA itself. They rely on information that has leaked from somewhere else and on human moments of inattention.

The most common entry points fall into five categories. First, credential stuffing: fraudsters take email-and-password pairs stolen from unrelated data breaches and try them on CRA login pages, betting that many people reuse passwords. Second, SIN theft from mailed documents, unsecured filing cabinets, or old tax slips left in shared inboxes.

Third, SIM-swap attacks that intercept text-message verification codes by convincing a mobile carrier to port your phone number to a new SIM. Fourth, phishing links delivered by text or email that lead to convincing fake CRA login pages. Fifth, unauthorized Represent a Client authorizations, where a fraudster who has already gathered enough personal details submits a request to be added to your file as an authorized representative.

Every defensive step in the rest of this article maps to one or more of these five threats. You do not need to memorize the attack methods to stay safe, but knowing they exist is why the specific steps below are worth doing.

» CRA Sign-In Options Compared

For most Ontario taxpayers, a CRA user ID with an authenticator app offers the strongest independent security. Sign-In Partner is fine if your bank uses strong authentication and you already treat that login as a critical credential.

» Step-by-Step: Lock Down Your CRA My Account in 20 Minutes

1. 1
   Set a unique password of at least 16 characters.Do not reuse a password from any other site. A password manager will generate and store one for you so you never need to type or remember it.
2. 2
   Turn on multi-factor authentication using an authenticator app.Authenticator apps such as Google Authenticator, Microsoft Authenticator, or Authy are more secure than SMS codes because they cannot be intercepted through a SIM-swap attack.
3. 3
   Enable email notifications for account changes.Inside CRA My Account, turn on email alerts for changes to address, direct deposit, marital status, and authorized representatives. If anyone tampers with your account, you will know within minutes.
4. 4
   Review the list of authorized representatives.Remove any accountant, bookkeeper, or ex-employee who no longer needs access. If you see a name you do not recognize, revoke the authorization immediately and call the CRA.
5. 5
   Verify your direct deposit details.Confirm the bank account number on file is yours. Direct-deposit fraud, where a fraudster redirects your refund or benefit payments to their account, is one of the most common outcomes of a CRA account breach.
6. 6
   Confirm your mailing address, phone number, and marital status on file.Fraudsters sometimes change these details first so that CRA follow-up mail or calls go to them instead of you.
7. 7
   Set a quarterly calendar reminder.A five-minute check every three months catches problems early. If you want a professional second set of eyes on your CRA setup, our accounting and tax services team can review it with you.

» Red Flags: How to Spot a CRA Scam Message

Real CRA correspondence has predictable patterns. Refund and benefit amounts are visible inside CRA My Account, not typed into a text message. Audit and collections letters arrive by mail or as secure messages in your account, not as SMS with a link. Verification calls will reference your file, but the CRA will not ask for your password over the phone.

Warning signs to watch for include: urgency claims like “you must click within 24 hours,” unfamiliar sender numbers or email domains, mismatched grammar in an otherwise official-looking message, links that hover-preview to a non-canada.ca domain, and any request to pay a tax debt through a method that is not one of the CRA’s published payment options.

When in doubt, do not click. Open a browser, type canada.ca directly, and sign in to My Account. If there is a genuine issue, it will be waiting for you there.

» What to Do If Your CRA Account Is Compromised

Move through the following steps in order. Speed matters because the sooner the account is locked, the less damage a fraudster can do.

1. 1
   Call the CRA immediately.Individuals: 1-800-959-8281. Businesses: 1-800-959-5525. Ask the agent to lock the account and flag it for suspected identity theft. Note the reference number they give you.
2. 2
   Report to the Canadian Anti-Fraud Centre.Call 1-888-495-8501 or file a report through their online reporting system. This creates the paper trail that other agencies and your bank may ask for.
3. 3
   Place a fraud alert with Equifax Canada and TransUnion Canada.A fraud alert typically requires lenders to take extra steps to verify your identity before opening new credit in your name.
4. 4
   Contact your bank if your direct deposit was changed.Any refund or benefit payment that has already been redirected may need to be traced and, where possible, recovered.
5. 5
   Request copies of any returns or changes filed without your authorization.The CRA can typically provide these, and you will need them to correct your tax record.

The CRA may reimburse a stolen refund, but outcomes are handled case by case and are not guaranteed. Business owners who suspect their file has been used to enable expense or invoice fraud should also review our guide to fraud-proofing your business.

» Common Mistakes That Leave Your CRA Account Exposed

• →Reusing the same password across CRA, banking, and email accounts. This is the single most common cause of unauthorized access.
• →Choosing SMS text codes over an authenticator app for multi-factor authentication, leaving the account vulnerable to SIM-swap attacks.
• →Leaving old accountants, bookkeepers, or former employees on the authorized representatives list long after they have moved on.
• →Skipping the email notifications toggle, which is the single fastest way to catch an unauthorized change to your account.
• →Clicking links in texts or emails that appear to be from the CRA rather than typing canada.ca into a browser directly.
• →Storing Social Insurance Numbers, business numbers, and past tax slips in shared cloud folders, group chats, or unencrypted email threads.

» Frequently Asked Questions

For related plain-English guides, browse more ClearWealth Insights.

This article is for informational purposes only and does not constitute tax or financial advice. Consult a qualified accounting professional before making any tax or financial decisions.

Sources & References

1. Canada Revenue Agency — Security of your CRA account. https://www.canada.ca/en/revenue-agency/services/e-services/cra-login-services/security-features.html
2. Canada Revenue Agency — Identity theft and fraud. https://www.canada.ca/en/revenue-agency/corporate/security/identity-theft-fraud-canada-revenue-agency.html
3. Canada Revenue Agency — Sign in to a CRA account. https://www.canada.ca/en/revenue-agency/services/e-services/cra-login-services.html
4. Canada Revenue Agency — Multi-factor authentication. https://www.canada.ca/en/revenue-agency/services/e-services/cra-login-services/multi-factor-authentication.html
5. Canadian Anti-Fraud Centre — Report fraud. https://antifraudcentre-centreantifraude.ca/report-signalez-eng.htm
6. Get Cyber Safe (Government of Canada). https://www.getcybersafe.gc.ca/en
7. Equifax Canada — Identity theft resources. https://www.consumer.equifax.ca/personal/education/identity-theft/
8. TransUnion Canada — Fraud victim resources. https://www.transunion.ca/fraud-victim-resource