Advisor to Client: How to ID real versus fake CRA communications

With tax-filing season in full swing, and amid heightened awareness about protecting personal information, the Canada Revenue Agency (CRA) is warning taxpayers about increasingly sophisticated tax scams that use generative AI.

GenAI “creates new content in response to user prompts and has become the most prevalent type of AI used in relation to tax scams and fraud,” the CRA said in a recent release. Scammers use GenAI to “generate human-like content including text, images, audio, software code, simulations, videos and synthetic data.”

The release warned specifically of fraudulent but official-looking CRA communications, and suggested that taxpayers verify the information in the communications they receive — before clinking links or providing their personal or financial information.

Darace Rose, co-founder and CEO of cybersecurity firm Oppos Inc. in Mississauga, Ont., told this publication last fall, following the Canadian Investment Regulatory Organization’s data breach, that a CRA account is among the accounts that should be monitored for suspicious changes after an individual has their personal information stolen. Understanding how to navigate CRA communications is part of the ongoing protection of personal and financial information.

Potential bona fide CRA communications could arrive via phone call or automated phone message, email or letter, the CRA explains online. Each type of communication is used only in certain instances (see table below for summary).

The CRA makes clear that it doesn’t demand immediate tax payment; doesn’t set up in-person meetings to collect payments; doesn’t ask for personal or financial information in voicemails or emails; and doesn’t send refunds or payments by e-transfer or text message.

The CRA also provides a list of the latest tax-related scams. If taxpayers suspect they’ve been victims of scams or notice suspicious activity in their CRA accounts, they should report the incident to the CRA.

As of February, CRA account holders were required to have a backup multi-factor authentication (MFA) option on file, as an extra layer of security and to prevent taxpayers from getting locked out this tax-filing season during the multifactor authentication process.

CRA communications and taxpayer personal information

Type of communication used by CRA	When CRA uses the communication	May CRA ask for personal or financial info in this type of communication?
Phone call	—Audit process is being initiated —CRA user ID and password have been revoked (which can happen if they’ve been unused for a long time) —More examples	Yes
Automated phone message	Courtesy reminders about: —tax return filing —tax payment by required quarterly instalments —filing and payment deadlines (for a business with a new GST/HST account)	No
Email	Only in two situations: 1. Taxpayer registered for email notifications and has a new message to view in their CRA account 2. During a meeting or call with a CRA agent, taxpayer asked that the CRA send a link, form or publication	No. Emails from CRA won’t ask for a reply nor include links that ask for personal or financial info
Letter	—Audit process is being initiated —CRA user ID and password have been revoked (which can happen if they’ve been unused for a long time) —More examples	Yes
Text message	Only for multi-factor authentication for CRA sign-in services (if taxpayer enrolled with telephone option)	No. CRA doesn’t use text messages outside multi-factor communication, nor does the agency use instant messaging such as Facebook Messenger or WhatsApp

Source: Canada Revenue Agency