Is that CRA letter or call real? How to check before you act

Why it's worth checking

Real CRA letters can ask for things that sound alarming: a balance owing, documents for a review, or personal information to verify your identity. Scammers copy exactly that tone. The CRA notes that a genuine letter may ask for personal information to verify your identity, so the request alone doesn't tell you much. What you check is where the request came from and what it asks you to do.

The fastest check: your CRA account

The CRA's notices, letters and statements are available in your CRA online account. Sign in by typing canada.ca into your browser yourself, then find the CRA sign-in page. Don't use a link or QR code from the message you're checking.

• If the same letter is in your account mail, you can trust its content.

• If your account shows no balance but the letter says you owe money, treat the letter with suspicion.

• If you aren't registered, you can call the CRA instead.

What the CRA says it will not do

From the CRA's scam guidance:

By phone, the CRA will not:

• Threaten to deport or arrest you, or put you in prison

• Charge a fee to speak with a call centre agent

• Demand or pressure you into immediate payment by Interac e-transfer, cryptocurrency, prepaid credit cards or gift cards

The CRA adds that its automated calls only give a message and don't include or ask for personal taxpayer information.

By email, the CRA:

• Sends email only in limited situations, such as when you've registered for email notifications and have a new message in your CRA account

• Won't ask you to reply to the email

• Won't include a link asking you to enter personal or financial information

By text or chat, the CRA:

• Won't send refunds or payments by e-transfer or text message

• Won't use text messages or instant messaging such as Facebook Messenger or WhatsApp

• Uses texts only for multi-factor authentication codes, if you enrolled with the phone option

The CRA also says it will never email or text you a link to your refund.

Red flags in a letter

• Payment instructions that point to gift cards, crypto, e-transfer or a private account

• Pressure to act today or face arrest or police

• A web address that isn't canada.ca, or a lookalike with extra words or hyphens

• A phone number that doesn't match the numbers listed on canada.ca

• Spelling mistakes, an odd logo or the wrong tax year

• A request for information that has nothing to do with your taxes, such as a credit card number

Sample (synthetic, fake): FINAL NOTICE. Your tax file is under investigation. Pay $1,480 within 24 hours using the voucher codes below to avoid arrest.

A genuine CRA letter reads very differently: it names a tax year, explains a calculation or request, gives you time to respond, and offers ways to contact the CRA.

If someone calls

Hang up if anything feels off. Then find an official phone number yourself and call it. For individuals, the CRA lists 1-800-959-8281 in the provinces and 1-866-426-1527 in the territories. Scammers can make a caller ID show a real-looking number, so the number on your screen doesn't prove anything.

How to report a scam

The CRA says to report fraud to your local police and to the Canadian Anti-Fraud Centre. The Government of Canada also takes reports through its online cyber crime and fraud reporting system.

If you've already been caught:

• Contact your bank or financial institution

• Contact the credit reporting agencies

• Contact the CRA if you think your CRA user ID or password was compromised

• Check your CRA account for changes to your banking details, address or personal information that you didn't make

Three common scam scripts

These patterns come up again and again. Each one breaks a rule the CRA has published.

• The refund link. A text or email says you're owed a refund and gives a link to "claim" it. The CRA says it will never email or text you a link to your refund.

• The urgent balance. A caller or letter says you owe tax and must pay today, often by voucher codes or crypto, or police will come. The CRA says it won't threaten arrest and won't demand those payment methods.

• The account update. A message says your CRA account is locked and asks you to sign in through a link. CRA emails won't include a link asking for personal or financial information.

If a message fits one of these, don't reply. Check your CRA account directly instead.

If the letter is genuine

Read it for three things: what it's about, what it asks you to do, and by when. A notice of assessment may just need filing away. A review letter needs documents by the time frame it gives. A balance owing needs payment or a plan. Each letter has its own reference number, usually in the upper right corner. Use it in any reply.

A 60-second checklist

• Did I find this letter in my CRA account?

• Does it ask for an unusual payment method?

• Does it threaten arrest, deportation or police?

• Is every web address on canada.ca?

• If I call, am I using a number I found myself?

Have it read before you reply

When a letter is genuine but confusing, EasyToDecode, launching soon, will read your own letter, quote the amount, the request and the deadline, and flag anything that doesn't fit how CRA letters usually look. See how it works or join the waitlist to hear when it opens.