This article is for informational purposes only and does not constitute tax or financial advice. Consult a qualified accounting professional before making any tax or financial decisions.
Quick Answer
The Canada Revenue Agency (CRA) now sends an email to the address on your personal (T1) CRA account whenever your Social Insurance Number (SIN) is added to, or updated on, a business account. It is a fraud-prevention alert that tells you something changed under your SIN. If you registered a business or linked a business number yourself, the email typically confirms that action. If you did not, you can contact the CRA Business Enquiries line and review your accounts after signing in to your CRA account directly. Do not click links in the email or reply with personal information.
The Short Version
Seeing a message from the Canada Revenue Agency saying your Social Insurance Number was added to a business account is unsettling, especially if you cannot remember doing anything to trigger it. The CRA now sends this email on purpose as a security alert, and in most cases there is a straightforward explanation.
This guide covers what the message means, how to tell a legitimate alert from a sign of trouble, and the exact steps to take if the change looks unfamiliar. Within a few minutes you will know whether to relax or to pick up the phone.
What the CRA Email Actually Means
Three terms matter. Your SIN is the nine-digit number Service Canada issued to you for work and tax purposes. A business number, or BN, is the nine-digit identifier the CRA assigns to a business, extended with program accounts for GST/HST, payroll and corporate income tax. My Business Account is the online portal where owners, partners and directors manage those program accounts.
When the CRA records a SIN against a business number, someone has claimed ownership or director authority over that business and attached your identity to it. Because an unauthorized link could affect your personal tax situation, the CRA routes the alert to your personal account email so the right person sees it. At ClearWealth Accounting Advisors, client questions about these messages have risen sharply since the alert rolled out.
Pick Your Path
Work through the short checklist below. The right next step depends on which situation describes you.
The alert almost certainly confirms your own action. Keep the email for your records.
Check with them before worrying. An authorized person may have linked your SIN with permission.
Director information updates can trigger the alert even when you did not personally sign in.
Treat the alert as a potential red flag and move to the roadmap below.
Expected Alert or Red Flag? How to Tell
| Signal | Legitimate CRA alert | Red flag or phishing |
|---|---|---|
| Sender name | Canada Revenue Agency / Agence du Revenu du Canada | Generic address, misspelled domain, or a personal Gmail or Outlook sender |
| What it asks for | Nothing. It tells you to sign in to your CRA account to view details. | Click a link, confirm your SIN, enter banking details, or verify your identity by email |
| Timing | Lines up with a registration or linking action you or someone authorized just completed | Arrives out of the blue with no recent CRA activity on your end |
| Tone | Short, factual, bilingual, no threats | Urgent language, threats of arrest, refund promises, or payment demands in gift cards or cryptocurrency |
| Attachments | None | PDF, ZIP, or HTML attachments pretending to be a CRA notice |
Step-by-Step Roadmap If You Don't Recognize the Change
- 1Pause and keep the emailDo not click links or open attachments. Save the message for the date and time stamp.
- 2Sign in to your CRA account directlyType canada.ca into your browser and navigate to My Account. Avoid search ads at the top of results, which can mimic the official page.
- 3Review your Welcome pageLook for business account panels you do not recognize, and check your personal profile for recent changes to address, direct deposit, phone or email.
- 4Call CRA Business Enquiries at 1-800-959-5525Tell the agent you received a SIN-update alert for a business you do not recognize and ask them to review what was added.
- 5Protect your SIN and monitor your accountsIf the CRA confirms unauthorized activity, call Service Canada at 1-866-274-6627, report the incident to the Canadian Anti-Fraud Centre, and pull credit reports from Equifax Canada and TransUnion Canada.
Keep notes of every call, including the agent's name, date, time, and any case or reference numbers. For help reviewing CRA activity and preparing follow-up correspondence, you can talk to an accountant at ClearWealth.
Who Can Legitimately Add a SIN to a Business Account
Business structure changes who is involved. A sole proprietor is the business, so their SIN and the business number sit side by side from day one. Partners in a partnership may each have a SIN on file. In a corporation, directors and officers are the people the CRA recognizes, and an authorized representative such as an accountant can act on their behalf once authorization is in place.
Common legitimate triggers include registering a new business number online, adding an existing business number to your CRA account, a corporation filing updated director information, or an accountant linking a client file during a tax engagement.
Common Mistakes to Avoid
- →Clicking the link in the email instead of typing canada.ca into the browser. Even when the message is real, the direct route removes the risk of a lookalike page.
- →Replying to the email with your SIN, date of birth or banking information. The CRA does not collect personal data through email replies.
- →Assuming the message is a scam and deleting it without checking. If the change is unauthorized, waiting makes it harder to unwind.
- →Calling a phone number from the email itself. Use the number listed on canada.ca or on an official CRA notice you already have.
- →Ignoring the email because the business belongs to a spouse or partner. The CRA is telling you that your SIN was used, not theirs.
- →Using an email address on your T1 profile that you rarely check, which can cause you to miss future alerts entirely.
Keep Your CRA Accounts Secure Going Forward
A few small habits make the next alert easier to interpret. Keep the email on your personal CRA account current, review notification preferences in both My Account and My Business Account yearly, and turn on multi-factor sign-in. Review account activity on a monthly schedule so unauthorized changes do not sit undiscovered.
Frequently Asked Questions
Why did I get a CRA email saying my SIN was added to a business account?
The CRA now sends an email alert to your personal tax account whenever your SIN is linked to a business number. It typically means someone, often you or an authorized person, registered a business or updated director records. The alert itself is a security measure, not a penalty.
Is the CRA email about my SIN and a business account real or a scam?
It can be either. A legitimate CRA notification uses the sender name "Canada Revenue Agency / Agence du Revenu du Canada" and never asks you to click a link to enter personal details. Verify by signing in to your CRA account directly rather than through any link in the message.
What do I do if I don't own a business and got this email?
Sign in to your CRA account directly through canada.ca and review any business accounts linked to your profile. If you see one you do not recognize, call CRA Business Enquiries at 1-800-959-5525 and report a possibly compromised SIN to Service Canada.
Why did the CRA send the email to my personal tax account email?
Your SIN belongs to you as an individual, so the CRA notifies the email on your personal T1 profile rather than a business inbox. This way the right person sees the alert, even if the business has separate contact details on file.
Does this email mean someone stole my identity?
Not necessarily. The alert fires whenever a SIN is linked or updated on a business account, which happens often during legitimate registrations. It only suggests misuse when the change does not match any action you authorized.
Who do I call if I don't recognize the change?
Call the CRA Business Enquiries line at 1-800-959-5525 and ask them to review the SIN-update activity on your account. If the agent confirms the change was unauthorized, call Service Canada at 1-866-274-6627 and report the incident to the Canadian Anti-Fraud Centre.
I just registered my business. Is this email normal?
Yes. Linking your SIN to a new business number is exactly the event the alert is designed to confirm. Save the message with your business records; no further action is typically needed unless the details do not match your registration.
How do I check which business accounts are linked to my SIN?
Sign in to your CRA account and open the Welcome page. Each business account connected to your SIN appears as a panel. If you are not sure what you are seeing, call CRA Business Enquiries at 1-800-959-5525 for a review.
Need a second set of eyes on your CRA account?
The ClearWealth team can review your CRA activity, help you respond to unexpected alerts, and support your ongoing tax and compliance needs.
Book a ConsultationThis article is for informational purposes only and does not constitute tax, legal or financial advice. Speak with a licensed accountant or tax professional before making decisions about your CRA accounts.
Sources & References
- →Canada Revenue Agency, Email notifications from the CRA – Businesses: canada.ca — Email notifications
- →Canada Revenue Agency, Maintain your business: canada.ca — Maintain your business
- →Canada Revenue Agency, About My Business Account: canada.ca — About My Business Account
- →Canada Revenue Agency, Scam prevention and the CRA: canada.ca — Scam prevention
- →Canada Revenue Agency, MP Kit for CRA-related scams and fraud: canada.ca — MP Kit
- →Canadian Anti-Fraud Centre: antifraudcentre-centreantifraude.ca
