CRA Scam Warning Signs: How to Spot a Scam Call, Text or Email (2026)

Your phone rings. The caller says they are with the Canada Revenue Agency, you owe back taxes and police will be at your door today unless you pay now. That is a CRA scam, and you can hang up. The real CRA does contact people by phone, mail and email, so the trick is knowing what it will and will not do. Here is the channel-by-channel guide.

Key takeaways

• The CRA will never demand or pressure you for immediate payment by gift cards, prepaid credit cards, cryptocurrency or Interac e-transfer, and it will never threaten to arrest or deport you.
• The CRA only sends text messages for multi-factor authentication codes when you sign in, and only if you enrolled with the telephone option. Any other CRA text is a scam.
• CRA emails arrive in only 2 situations: an email notification that you have new mail in your CRA account, or a link or form you asked an agent to send during a call or meeting.
• To check a caller, hang up and call the CRA yourself at 1-800-959-8281 (individuals) or 1-800-959-5525 (businesses). Never trust caller ID, because scammers spoof real CRA phone numbers.
• Report every attempt to the Canadian Anti-Fraud Centre at 1-888-495-8501 or reportcyberandfraud.canada.ca, even if you gave the scammer nothing.

Warning signs of a CRA scam

Most tax scams follow the same script: urgency, fear and an unusual way to pay. The CRA's own list of warning signs of a scam is short and worth memorizing. According to the Government of Canada website, the CRA will not:

• Send refunds or payments by e-transfer or text message
• Provide or accept payments by cryptocurrency
• Demand or pressure immediate payment by Interac e-transfer, cryptocurrency, prepaid credit cards or gift cards from any retailer
• Threaten to deport or arrest you, or put you in prison
• Use aggressive or threatening language
• Set up an in-person meeting in a public location to collect a payment
• Charge a fee to speak with a call centre agent
• Ask for personal or financial information in a voicemail or email

If a message hits even one of these, treat it as fraudulent CRA contact. Scammers use generative AI now, so the old tells (typos, blurry logos, bad grammar) are less reliable. The signs of a CRA scam above still work no matter how polished the message looks.

Does the CRA call you?

Yes. The CRA may call you, and a real call is not a sign of trouble on its own. A CRA agent may call about a tax return under review, missing receipts, a return you have not filed, a GST/HST registration review, the start of an audit or an amount you owe.

A real CRA agent may ask you to confirm your identity with your name, date of birth or social insurance number. That surprises people, and scammers know it. So the rule is simple: never share your information on a call you did not start. The CRA agent would give you their name and a number to call back. A fraudster pushes you to stay on the line.

Here is the CRA's own four-step process when a caller says they are from the CRA:

1. Do not share personal information with the caller.
2. Ask for the caller's name, their office name or location and a phone number to call back.
3. Tell the caller you will verify their information first.
4. End the call, then check the number with the CRA's verify tool or call the CRA directly.

If you owe a real debt, the CRA may ask you to pay using its official payment options and may tell you about possible legal action to recover it. That is very different from a demand to pay in the next hour at a Bitcoin machine. For how real collections work, see our guide to CRA collections.

What number does the CRA call from?

There is no single number, and caller ID proves nothing. The CRA warns that a scam caller can spoof a local number, a police number or even an official CRA number so the call looks real on your screen.

Instead of trusting the number on your phone, verify the callback number you were given. The CRA's Verify it's the CRA calling page has a tool that checks numbers listed on the CRA website plus common outbound program numbers. It does not include individual employees' direct work numbers, so a "not found" result is not proof of a scam. In that case, call the CRA's official number yourself:

• Individuals and trusts: 1-800-959-8281
• Businesses: 1-800-959-5525

An agent can check whether a CRA employee actually tried to contact you. Expect a wait during busy periods. That is still the safest way to call the CRA.

Voicemails and automated calls

The CRA does use an automated telephone system for courtesy reminders about filing your return, paying quarterly instalments and filing and payment deadlines for businesses with a new GST/HST account. The CRA says that automated message does not include or ask for personal taxpayer information.

A robocall that says your social insurance number is suspended, a warrant is out for your arrest or you must press 1 to avoid jail is a scam call. So is any voicemail that asks you to leave personal or financial details.

Does the CRA send text messages?

Almost never. The CRA only sends a text message for multi-factor authentication when you sign in to your CRA account, and only if you enrolled with the telephone option. That text is a one-time passcode you asked for by signing in.

The CRA will not use text messages or instant messaging such as Facebook Messenger or WhatsApp to contact you. So any CRA text about a refund, a benefit, an error on your assessment or money owing is a text message scam. Recent examples on the CRA's latest scams list include:

• A text message claiming you are owed a GST/HST refund or credit, with a link to "apply" before a deadline
• A text asking you to reply "Y" about a line on your recent tax assessment, followed by a fake link
• A text saying there is an error on your account and asking you to reply "HELP"
• A fake Interac e-transfer deposit image, followed by a link to a fake bank sign-in page

Some of these messages already contain your real name, date of birth or social insurance number, taken from past data breaches. That does not make them legitimate. Do not reply and avoid clicking any link.

CRA scam emails and phishing

The CRA only sends email in 2 situations. You registered for email notifications and have a new message waiting in your CRA account, or you asked an agent to send you a link, form or publication during a call or meeting.

A real CRA email will not come from a specific person, will not ask you to reply and will not include a link asking you to enter personal or financial information. Any email claiming you have a tax refund waiting behind a button, or a "tax return document to review," is a CRA phishing scam built to steal your CRA login credentials or banking details.

If you receive an email that looks official, do not click a link inside it. Type canada.ca into your browser and log in to your CRA account yourself. If there is real mail, it will be there. Real CRA web addresses start with canada.ca or end in cra-arc.gc.ca. Look-alike addresses such as cra-login-canada.com, or ones with odd endings like .info, belong to a fake CRA site.

One newer trick is email bombing: after a scammer gets into your account, they flood your inbox with junk so you miss the real CRA email notifications about changes to your account.

How to spot a fake CRA letter

The CRA sends a lot of real mail: notices of assessment, requests for receipts, audit letters and statements of account. A letter can legitimately ask you to confirm your identity or send supporting documents.

A fake CRA letter gives itself away the same way a scam call does. Watch for a threat of arrest, a request to meet in a public place to make a payment and any demand to pay by e-transfer, cryptocurrency, prepaid credit card or gift card. To check any letter, sign in to your CRA account (My Account for individuals, My Business Account for businesses) and see whether the same notice is on file, or call the CRA's official number.

In-person visits: when the CRA actually shows up

It is rare, but the CRA does meet people in person. An on-site audit normally takes place at your home, your place of business or your accountant's office, and the auditor presents a valid identification card on arrival. If the CRA cannot reach you by phone or mail about unfiled returns, a collections officer may visit your home, workplace or business. For payroll and GST/HST trust account examinations, the officer arranges the date, time and address in advance.

Ask to see the officer's CRA authorization card (form RC121A), which shows their name, photo and badge number. If anything feels off, get their name and office, close the door and call the CRA yourself. No real CRA officer will ask to meet you in a parking lot or coffee shop to collect a payment.

Fake refunds, benefits and social media scams

Some of the latest scams skip the threats and dangle money instead. The CRA has flagged messages and websites promising:

• A "Grocery Rebate" you can apply for today. The real Grocery Rebate was a one-time payment in July 2023.
• A new $2,000 relief payment by direct deposit, a $680 rent payment or a $533 inflation payment. None of these exist.
• Extra payments for low-income seniors, with links to join a Telegram or WhatsApp group.
• Help recovering money you already lost to a scam, for an upfront fee.

A real tax refund goes to the direct deposit account or mailing address already on your CRA account. The CRA does not send refunds by e-transfer or text, and you never have to click a link to get one.

CRA scams that target business owners

Business owners get their own version of these tax scams, and the dollar amounts are bigger. Common patterns include:

• Calls or emails claiming unpaid HST or payroll source deductions, with a same-day deadline and a demand to pay by e-transfer or cryptocurrency
• Fake audit notices with a link to "upload your records"
• Phishing emails aimed at tax preparers that copy the CRA's EFILE sign-in page
• A hijacked My Business Account where the fraudster changes the mailing address, direct deposit details or authorized representatives so refunds and notices go to them

Real payroll and HST collections exist, and a real balance or notice will also show up in My Business Account. If the CRA is chasing a real balance, our guides on CRA collections and what happens when the CRA freezes a bank account explain the actual process. Clean, current books also make fake arrears demands easy to dismiss, which is part of what our bookkeeping and payroll work covers. Keep your corporate registry information current too: the CRA says an up-to-date list of directors helps protect the account.

Real CRA vs scam: a side-by-side comparison

Use this table to check any contact from someone impersonating the Canada Revenue Agency against what a legitimate CRA communication looks like. It is built from the CRA's own scams and fraud guidance on canada.ca.

How to verify a contact is really from the CRA

Before you pay anything or share anything, run through these steps:

1. Stop. Do not share information or pay on the call, email or text that reached you.
2. Sign in to your CRA account at canada.ca (CRA My Account, My Business Account or My Trust Account) and look for the same notice, balance or letter.
3. Call the CRA yourself at 1-800-959-8281 (individuals) or 1-800-959-5525 (businesses), using a number you looked up, not one you were given.
4. Check any callback number with the CRA's verify tool.
5. Review who is authorized on your CRA account (more on that below).

What to do if you already paid or shared information

It happens to careful people, and speed matters more than embarrassment. If you gave a scammer money, your social insurance number, banking details or your CRA login credentials, do this today:

1. Contact the CRA. Call 1-833-995-2336 for a personal account (Monday to Friday, 6:30 am to 7 pm ET) or 1-800-959-5525 for a business account, or use the CRA's online form. Protections can be placed on your account during the call.
2. Call your bank or other financial institutions you use to stop or dispute the payment and flag your accounts.
3. Contact the credit bureaus, Equifax and TransUnion, about a fraud alert.
4. Report it to your local police service. In Durham Region that is the Durham Regional Police Service.
5. Report it to the Canadian Anti-Fraud Centre online at reportcyberandfraud.canada.ca or by phone at 1-888-495-8501 (Monday to Friday, 10 am to 4:45 pm ET).
6. If you think someone is using your social insurance number, call Service Canada at 1-866-274-6627.
7. Sign in to your CRA account and check for unauthorized changes to your mailing address, direct deposit details or authorized representatives, and for benefit applications you did not make. Identity theft often shows up as a delayed refund or trouble filing your tax return online.

The CRA's report a scam or identity theft page lists every reporting option, including the RC213 declaration form.

A worked example: a Whitby business owner gets a "final notice" call

Here is a typical scam involving a small business. A landscaping company owner in Whitby gets a call at 3 pm on a Friday. The caller ID shows a Toronto area code. The caller says she is a CRA agent and the company owes $4,860 in unpaid HST from last year. If it is not paid by 5 pm, a warrant goes to police and the business account gets frozen. She offers a "same-day settlement" of $3,900 if he pays through a Bitcoin machine at a nearby plaza and reads her the transaction code.

Run it against the warning signs:

• Pressure for immediate payment: yes, a two-hour deadline.
• An unusual payment method: yes, a cryptocurrency terminal. The CRA does not accept cryptocurrency.
• A threat of arrest: yes.
• A "discount" for paying now: real CRA debts do not come with a same-day settlement deal.

He hangs up and signs in to My Business Account. His HST balance is $0, and there are no new letters. He calls 1-800-959-5525 to confirm, then reports the call to the Canadian Anti-Fraud Centre. Total cost: 20 minutes. Had he paid, the $3,900 would almost certainly be gone, because cryptocurrency transfers are very hard to reverse.

The same script lands on households in Oshawa, Ajax and Pickering every week, just with a tax refund or a benefit as the bait instead of a debt.

Check who is authorized on your CRA account

When you authorize an accountant or other representative through the CRA's Represent a Client service, they get secure online access to your CRA information. For individuals, both Level 1 and Level 2 representatives can view your account balance and your notices of assessment and reassessment. For businesses, representatives can view the account balance and, depending on the level, CRA correspondence.

That access is exactly what a fraudster wants. The CRA recommends checking your authorized representatives regularly, because an unexpected new name on that list is a red flag for identity theft. Sign in to My Account or My Business Account, review the list and remove anyone you do not recognize.

Frequently asked questions

Does the CRA contact you by phone?

Yes. The CRA may call you about a tax return under review, missing documents, an unfiled return, an audit or a balance owing, and a real agent may ask you to confirm your identity. But the CRA will never threaten arrest or demand immediate payment by gift cards, cryptocurrency, prepaid credit cards or e-transfer. If in doubt, hang up and call 1-800-959-8281 (individuals) or 1-800-959-5525 (businesses).

Is there a scam going around about taxes?

Several, all the time. Current examples on the CRA's list include texts offering a GST/HST refund, fake "Grocery Rebate" applications, emails with a "tax return document to review," fake extra payments for seniors and calls demanding cryptocurrency to cancel an RCMP warrant. The CRA publishes the latest scams on its Recognize a scam page on canada.ca.

Does the CRA send out text messages?

Only for multi-factor authentication codes when you sign in to your CRA account, and only if you enrolled with the telephone option. The CRA does not text you about refunds, benefits or money owing, and it does not use WhatsApp, Messenger or other instant messaging. Any other CRA text is a scam.

How to spot a fake CRA letter?

A fake CRA letter demands payment by e-transfer, cryptocurrency, prepaid credit card or gift card, threatens arrest or asks you to meet in a public place to pay. To confirm any letter, sign in to My Account or My Business Account and look for the same notice, or call the CRA's official number yourself.

Is 1-833-995-2336 a real CRA number?

Yes. It is the CRA line for reporting suspected fraud, identity theft or suspicious activity on a personal CRA account, for example if you think your account was compromised, you see changes you did not make or a benefit application you did not file. But scammers can spoof real CRA numbers, so a call or text that shows this number, or tells you to call it, proves nothing. Look the number up yourself on the Contact the CRA page at canada.ca and dial it yourself. Never call back a number given to you in a text, an email or an unexpected call.

Before you respond to any CRA contact

Hang up, do not click and do not pay. Sign in to your CRA account or call the CRA yourself at 1-800-959-8281 (individuals) or 1-800-959-5525 (businesses), and report every attempt to the Canadian Anti-Fraud Centre, even if you gave the scammer nothing. If the CRA is chasing a real balance, our guide to CRA collections explains what actually happens next.

This article is for general information only and does not replace professional tax advice. Tax rules change, and your specific situation matters. Always confirm with a qualified CPA before making tax decisions.