# CRA scams: how the CRA really contacts you, and how to spot a fake

> What the CRA will and won't do by phone, letter, email and text, how to check a contact is real, and what to do if you were targeted or shared information.

- Web page: https://taxnotes.ca/guides/cra-scams/
- For: Individuals & families · Topic: Filing your return
- Last reviewed: 2026-10-11

Scammers pretend to be the Canada Revenue Agency because a message from the tax authority makes people act fast. The CRA has published clear limits on how it deals with you. If a call, text or email crosses one of them, it isn't the CRA: hang up or delete it.

## What the CRA will never do

According to the CRA, it will not:

- demand or pressure you into paying right away by Interac e-Transfer, cryptocurrency, prepaid credit cards or gift cards
- pay you or accept payment in cryptocurrency
- send refunds or payments by e-Transfer or text message
- threaten to have you arrested, jailed or deported, or use aggressive or threatening language
- arrange to meet you in a public place to collect a payment
- charge a fee to speak to an agent
- ask for personal or financial information in a voicemail or an email

## How the CRA really contacts you

**By phone.** A CRA employee may call to confirm who you are (they can ask for your name, date of birth or social insurance number), ask for receipts or other documents, ask about returns you haven't filed, or ask you to pay a debt using the CRA's normal payment options. The CRA also calls to tell you a review or audit is starting. A real caller gives you their name and a number to call back. The CRA also makes automated courtesy calls about filing and instalment deadlines; those messages never ask for personal information.

**By letter.** Letters are used for the same reasons: asking for documents, telling you your return is being reviewed or an audit is starting, or telling you a notice of assessment or reassessment has been issued.

**By email.** The CRA emails you in only two situations: to tell you there's a new message in your CRA account (if you signed up for email notifications), or to send a link, form or publication you asked for while talking to an agent. Real CRA emails don't come from a named person, don't ask you to reply, and don't contain links asking you to enter personal or financial information.

**By text.** The CRA texts only to send sign-in codes, if you chose the phone option for multi-factor authentication. It doesn't use text messages or apps such as Facebook Messenger or WhatsApp for anything else.

## Scams to watch for

The CRA keeps a list of scams it's seeing. Recent ones include:

- **Fake refunds and credits.** A text or email says you're owed a refund or GST/HST credit and asks you to click a link and enter your social insurance number or banking details.
- **"Your notice of assessment has errors."** An email tells you to download a "revised" notice that supposedly isn't in your CRA account, before a short deadline.
- **Arrest-warrant calls.** A caller says there's a warrant for your arrest and you must pay in cryptocurrency, sometimes by depositing cash at a cryptocurrency machine. The scammer may then call back pretending to be the RCMP.
- **Spoofed numbers.** Caller ID shows a local number, a police number or even a real CRA number. Caller ID can be faked.
- **Benefit messages.** Texts or emails about benefits and tax credits, such as the disability tax credit or the Old Age Security pension, with a link and a code. The CRA doesn't send texts or emails about benefits or credits with links to click.
- **Recovery offers.** After you've lost money to a scam, someone promises to get it back if you pay a fee or share information first.

A message that already knows your name, date of birth or social insurance number can still be a scam.

## How to check a contact is real

1. **Don't share anything on the call.** Ask for the caller's name, office location and callback number, say you'll check it, and hang up.
2. **Check the number yourself.** Use the CRA's tool on its [Verify it's the CRA calling](https://www.canada.ca/en/revenue-agency/corporate/scams-fraud/verify-cra-contact.html) page, after the call, not during it. If you still aren't sure, call the CRA at 1-800-959-8281 (individuals and trusts) or 1-800-959-5525 (businesses); it may be able to check whether one of its employees tried to reach you.
3. **Sign in to your CRA account yourself.** Type canada.ca/myaccount into your browser instead of clicking a link. Your mail, notices and balances are there, so you can see whether the CRA really wants something.
4. **Check web addresses.** CRA pages start with canada.ca or end in cra-arc.gc.ca. Look-alikes add extra words, swap the dots for hyphens (such as "-gc-ca"), or end in .com or .info.

## Report it, even if you didn't fall for it

The CRA asks you to report scam attempts to the Canadian Anti-Fraud Centre even if you gave the scammer nothing. You can report online through the [Canadian Anti-Fraud Centre](https://antifraudcentre-centreantifraude.ca/report-signalez-eng.htm) or by phone at 1-888-495-8501. If you were the victim of a fraud, the Centre also asks you to contact your local police as soon as possible.

## If you shared information or paid

Act quickly:

1. **Contact the CRA** if you think your CRA account has been compromised, you see changes you didn't make (such as a new address or direct deposit details), or a benefit was applied for without your consent. You can use the CRA's online form, or call 1-833-995-2336 for a personal account, and the agent can put protections on your account during the call. You can also ask the CRA to turn off online access to your account.
2. **Contact your bank**, the credit bureaus Equifax and TransUnion, and your local police.
3. **If your social insurance number is being misused**, report it to Service Canada at 1-866-274-6627.
4. **Then notify the Canadian Anti-Fraud Centre.** The information helps police with investigations.

## Keep your CRA account safe

- Sign up for CRA email notifications and keep your email, phone and address up to date, so the CRA can reach you about changes to your account.
- Check your account regularly for changes you didn't make: your mailing address, direct deposit details, authorized representatives, or benefit applications.
- Use a password for your CRA account that you don't use anywhere else, and don't share your user ID or password.
- Set up a CRA PIN, which adds security when you call the CRA.

## Quebec residents

Revenu Québec, which handles your Quebec return, publishes its own limits. It never emails or texts you to say you've received a payment, that you're owed a refund or that it didn't get your return. It never asks by email or text for your social insurance number, banking details, a password or a confidential code, and it never leaves confidential information in a phone message. Its email and text alerts, which warn you about changes or unusual activity in your file, never contain links.

If a message seems suspicious, don't click, reply or call a number you can't confirm. Ask for a number to call back so you have time to check, and compare it with the callback numbers on Revenu Québec's [How to Tell if a Message Is Really From Revenu Québec](https://www.revenuquebec.ca/en/about-us/access-to-information/protecting-your-personal-information/how-to-tell-if-a-message-is-really-from-revenu-quebec/) page. If you think you were a victim of phishing or identity theft, contact Revenu Québec right away (1 800 267-6299, toll-free in Quebec) so it can take extra steps to protect your information, and also tell the Canadian Anti-Fraud Centre.

## In short

- The CRA never demands payment by gift card, prepaid card or cryptocurrency, never threatens arrest, and never asks for personal information by email or text.
- Hang up, then check the number yourself or sign in to your CRA account directly.
- Report every scam attempt, and tell the CRA right away if your information may have been used.

## Sources

1. [Recognize a scam – Scams and fraud – CRA](https://www.canada.ca/en/revenue-agency/corporate/scams-fraud/recognize-scam.html) (canada.ca)
2. [Verify it's the CRA calling – Scams and fraud – CRA](https://www.canada.ca/en/revenue-agency/corporate/scams-fraud/verify-cra-contact.html) (canada.ca)
3. [Report a scam or identity theft – Scams and fraud – CRA](https://www.canada.ca/en/revenue-agency/corporate/scams-fraud/report-scam.html) (canada.ca)
4. [Keep your CRA account secure](https://www.canada.ca/en/revenue-agency/corporate/scams-fraud/protect-account.html) (canada.ca)
5. [How to Tell if a Message Is Really From Revenu Québec](https://www.revenuquebec.ca/en/about-us/access-to-information/protecting-your-personal-information/how-to-tell-if-a-message-is-really-from-revenu-quebec/) (revenuquebec.ca)
6. [How to Prevent Phishing and Identity Theft – Revenu Québec](https://www.revenuquebec.ca/en/about-us/access-to-information/protecting-your-personal-information/how-to-prevent-phishing-and-identity-theft/) (revenuquebec.ca)
7. [Alerts – Revenu Québec](https://www.revenuquebec.ca/en/about-us/access-to-information/protecting-your-personal-information/alerts/) (revenuquebec.ca)
8. [What To Do in Case of Phishing or Identity Theft – Revenu Québec](https://www.revenuquebec.ca/en/about-us/access-to-information/protecting-your-personal-information/what-to-do-in-case-of-phishing-or-identity-theft/) (revenuquebec.ca)
9. [Report Phishing or Theft of Personal Information – Revenu Québec](https://www.revenuquebec.ca/en/contact-us/general-information-individuals/report-phishing-or-theft-of-personal-information/) (revenuquebec.ca)

Tax figures in this guide come from the TaxNotes.ca rates tables (https://taxnotes.ca/rates/), which cite the Canada Revenue Agency and, for Quebec, Revenu Québec.

Last reviewed: October 11, 2026

How to cite: "CRA scams: how the CRA really contacts you, and how to spot a fake", TaxNotes.ca, last reviewed 2026-10-11, https://taxnotes.ca/guides/cra-scams/. For a figure or rule, also cite the official source listed above.

Licence: CC BY 4.0 (https://creativecommons.org/licenses/by/4.0/). Free to share and adapt with attribution: https://taxnotes.ca/reproducing-our-content/