Scammers love tax season because people expect to hear from the CRA. A real message and a fake one can look alike, so this page gives you a few simple checks that work every time. If you only remember one thing: do not use the link or phone number in a message, and sign in to your own CRA account instead.
What does the CRA say it will never do?
Based on the CRA’s own scam page, these are signs that a message is fake:
- Threats. The CRA does not threaten arrest, deportation or prison, and does not use aggressive language.
- Odd payment methods. It does not demand immediate payment by e-transfer, cryptocurrency, prepaid cards or gift cards.
- Refunds by e-transfer or text. It does not send refunds or payments that way.
- Links that ask for personal information. Its emails do not ask you to reply or click a link with your personal or financial details.
- Fees to talk to someone. It does not charge to speak with an agent.
- Social apps. It does not use WhatsApp or Facebook Messenger.
The CRA says it only sends text messages for multi-factor sign-in, and only if you chose the telephone option. Automated calls are courtesy reminders, such as filing deadlines or instalments, and they do not ask for personal information.
What do common scams look like?
| Scam | How it works | The giveaway |
|---|---|---|
| Arrest or warrant call | A caller claims to be the CRA or the RCMP and says a warrant is out for you | They want cryptocurrency or a bank transfer to “cancel” it |
| Refund or credit message | A text or email says you have a GST/HST refund or credit waiting | It pushes you to click fast, or to get the money by e-transfer |
| Fake notice of assessment | An email says your return needs a “document review” or a “revised notice” | An urgent download link |
| Account error text | A text says your account has a problem and asks you to reply | A follow-up asks for personal details |
| Fake benefit or charity | A message about CPP, OAS or a disaster fund | It asks for your SIN, bank details or a donation by an odd method |
How do you check a message?
- Do not click links and do not reply to messages you did not expect.
- Type the address yourself. Official CRA sites start with canada.ca or end in cra-arc.gc.ca.
- Sign in to your CRA account directly and see whether the same message is waiting there.
- Hang up on a suspicious call, then find the official number on canada.ca and call it yourself. Numbers and websites can be faked.
- Not sure whether a letter is real? See our CRA letters decoder and the guide to dealing with the CRA.
What if you already clicked, paid or shared something?
- Stop contact, and do not send more money.
- Tell your bank or card company right away.
- Change passwords that you use for your CRA account, email and bank.
- Report it to your local police, to the CRA and to the Canadian Anti-Fraud Centre. The links are in the sources below.
- Keep screenshots, phone numbers and any receipts.
Where does this information come from?
The list of what the CRA will never do comes from the CRA’s page Recognize a scam. To report one, see the CRA page Report a scam or identity theft, the Canadian Anti-Fraud Centre and the national cybercrime and fraud reporting system. Checked in October 2026. Scammers change tactics, so read the CRA’s current scam alerts too. This is an independent information site: we provide no services, we do not represent the CRA or any organization, and we do not guarantee that anything here is accurate or current. We accept no liability for decisions based on it. See the full disclaimer.