Most Canadians interact with the Canada Revenue Agency (CRA) just twice a year – once when they file the required annual tax return and the second time when they receive a Notice of Assessment with respect to the return filed a few weeks earlier.
By the end of summer, virtually all Canadian taxpayers have filed their returns and received that Notice of Assessment. Hearing from the CRA, then, is a surprise, and generally not a welcome one. However, it’s not that unusual for the CRA to contact a taxpayer even after it has issued a Notice of Assessment for the return filed for the previous calendar year. In some cases, the CRA will have questions about information reported on the taxpayer’s return – perhaps an income amount reported does not match up with the amount reported to the CRA by the payor of that income. In other cases, the taxpayer may have claimed a deduction or credit, and the CRA wants the taxpayer to provide them with the receipt or other documentation to support that deduction or credit claim. In both cases, the CRA may contact the taxpayer to resolve the discrepancy or to obtain the needed information.
While no one particularly likes hearing from the tax authorities, it is critical that the taxpayer respond to any legitimate enquiry from the CRA. Failing to do so will mean that the claim made on the return for which documentation is being requested will be denied, because the taxpayer has not responded to requests to provide the CRA with that supporting documentation.
The problem which arises for the taxpayer is determining whether a communication received is in fact a legitimate request from the CRA or is part of a scam, phishing, or fraud attempt. Scams in which fraud artists claim to be from the CRA have become so commonplace over the past decade or so that by now almost everyone has received a fraudulent communication which purports to be from the tax authorities and which requests that the taxpayer provide financial or other information – or threatens dire consequences if the taxpayer fails to make an immediate payment. And, in the past several years, those fraudulent communications have become more and more sophisticated and hard to detect
Receipt of any communication which purports to be from the tax authorities therefore puts the taxpayer in a quandary. A legitimate query from the CRA cannot be ignored, but responding to a fraudulent communication (which can be as simple as clicking on a link in a fraudulent text message or email) can result in significant financial losses, or even identity theft. The resulting (and understandable) level of concern and suspicion on the part of taxpayers has even led to instances in which taxpayers refuse to speak to genuine CRA employees who are contacting the taxpayer in connection with legitimate CRA enquiries.
Some of the difficulty, ironically, likely arises from the fact that the CRA now utilizes most of the currently available communications technology to contact taxpayers. It’s certainly more efficient, but that expanded use of communications technology has had the inadvertent effect of making it easier for scammers to fraudulently represent themselves as being from the Agency. The CRA now contacts taxpayers by phone, by regular mail, by automated voicemail, by email, and by text. About the only method the CRA doesn’t use in communicating with taxpayers is social media. Consequently, a taxpayer who receives a communication by phone, email, or text (the favourites of scammers) can’t automatically assume that such communication is not legitimate – but it can be hard to tell when it is! To protect themselves, what taxpayers need to know is the purposes for which, and the circumstances in which, the CRA will use different communications methods.
To that end, the CRA has made ongoing efforts, primarily through its website, to provide information on how it uses different communication methods to contact taxpayers. The Agency’s goal is two-fold: the first, of course, is to help taxpayers avoid becoming yet another victim of scams and frauds, and the second is to prevent situations in which taxpayers ignore legitimate communications from the Agency, having dismissed them as just another fraud or phishing attempt.
The following summary outlines just when the CRA will (and perhaps more importantly, when it will not) use a particular communication method to contact a taxpayer, and how to know whether a particular communication is in fact a legitimate one.
If you receive a phone call or an automated message
In a phone call, the CRA may ask for any of the following:
- personal information to verify the taxpayer’s identity, including their name, date of birth, or Social Insurance Number (SIN);
- details or additional information needed for the taxpayer’s tax account, such as receipts or supporting documents;
- tax returns which the taxpayer has not filed; or
- financial information, such as the taxpayer’s bank's name and location
If the taxpayer has an outstanding debt owed to the CRA, the Agency may:
- ask for payment of any amount owing, using the CRA's payment options, or
- notify the taxpayer about possible legal actions to recover unpaid debts.
Finally, the CRA may notify a taxpayer by telephone or automated message about any of the following events:
- a tax return is being reviewed;
- a recent GST/HST registration is being reviewed;
- a GST/HST registration requirement is being reviewed;
- a CRA user ID and password have been revoked;
- a Notice of Assessment or Reassessment is being sent; or
- an audit process is being initiated.
Finally, the CRA may contact a taxpayer by phone or automated message to offer a service, including a reminder of an upcoming income tax filing deadline or a tax instalment payment due date, or support to help the taxpayer access benefits and credits. It’s important to note that the Agency’s automated system only leaves a message and never includes or asks for taxpayer personal information.
If you receive an email
The CRA will send an email to a taxpayer in only two situations:
- the taxpayer has registered for email notifications and is being notified that there is a new message to view in their CRA online accounts; or
- the taxpayer has requested, in a phone call or a meeting with a CRA client services agent, that a CRA link, form, or publication be sent.
When an email purporting to be from the CRA is received, it’s important to remember that legitimate emails from the Agency will not be from a specific user, will not ask the taxpayer to reply to the email, and will not include a link asking the taxpayer to enter personal or financial information. Any emails which include any of these features should be deleted.
If you receive a text or instant message
The CRA does utilize text messaging, but only for very limited and specific purposes. The Agency only sends text messages as part of the multi-factor authentication process for all of its online sign-in services, and only if the taxpayer enrolled in that service (like My Account) and selected the telephone option.
As well, the CRA will not use instant messaging such as Facebook Messenger or WhatsApp.
If you receive a phone call
Phone calls from someone claiming to represent the CRA are among the most difficult communications for taxpayers to assess with respect to authenticity, as the recipient of the call has to make an on-the-spot determination about whether the unfamiliar voice on the telephone is in fact a CRA employee. There are, however, procedures and processes in place to help.
Legitimate CRA employees will identify themselves when they contact a taxpayer and will provide that taxpayer with their name and phone number to call them back, if asked. (Taxpayers should be aware that relying on call display to verify the source of the call is not a good idea, as scammers have been able to manipulate technology to “spoof” a legitimate CRA phone number.)
The Agency suggests that where there is any doubt about the identity of a caller claiming to be from the CRA, taxpayers consider taking the following steps to ensure that they are in fact speaking to a CRA employee:
- Tell the caller you would like to first verify their identity.
- Request and make a note of their:
- Name,
- phone number to call back, and
- office name or location.
- End the call. Then check that the information provided during the call was legitimate by contacting the CRA. The CRA now provides an online service (available at Verify it's the CRA calling - Scams and fraud - CRA - Canada.ca) which allows the taxpayer to enter the number 1 followed by the 10-digit phone number which was provided by the caller, to find out whether it is in fact a legitimate CRA phone number.
Each of these verification steps should be taken before providing any information to the caller.
Especially during tax filing season, taxpayers often contact the CRA through one of its individual or business tax help lines, which are answered by call centre agents. Each of those telephone services offers an automated callback service, used when wait times reach a certain threshold (as they often do during the busiest times). That service gives the taxpayer the option of receiving a callback rather than continuing to wait on hold. Where the taxpayer chooses the callback option, they are provided with a randomized four-digit confirmation number. The CRA call center agent who returns the taxpayer’s call will repeat that number, so that the taxpayer can be certain that it is a CRA employee who is calling.
While scams and frauds and their perpetrators have been around for literally centuries, changes in technology mean that most taxpayers are now accustomed to and at ease with conducting much of their personal and financial lives online or on their cell phones, making it much easier to carry out such deceptions. And even newer technology, like AI, poses additional threats for the future. In such an environment, the taxpayer’s best protection is to double-check in order to verify the legitimacy of any unsolicited contact received with respect to matters of tax or personal finances. Protecting one’s financial and personal information in this way is no longer just prudent, it’s a necessity.