CRA multi-factor authentication: the backup option rule explained

What changed in CRA multi-factor authentication in 2026?

Multi-factor authentication, or MFA, means the CRA checks two things when you sign in: something you know, such as your password, and something you have, such as a phone that receives a passcode. The CRA has used MFA on its sign-in services for years.

The CRA's filing-season tips of January 27, 2026 announced that, starting in February 2026, CRA account users would be required to have a backup MFA option on file, such as a passcode grid or a third-party authenticator app. The stated goal was to strengthen account security and stop people getting locked out at the passcode step.

What applies now is softer. The CRA's multi-factor authentication help page, last updated in September 2026, says only one MFA option is mandatory right now. New registrations are prompted to enrol in two options, and if you have only one, the CRA prompts you to add a backup and lets you skip that step.

Is the backup MFA mandatory?

Not at the moment. MFA itself is mandatory for every CRA account user, but only one option is currently required. Skipping the backup is still risky: if your only method is a phone number and you lose the phone, you cannot finish signing in. None of this affects filing itself: you can still file through NETFILE software without signing in to the CRA.

CRA backup MFA options compared

The CRA offers four options. The best pairing is one method tied to your phone plus one that is not, so a single lost device cannot take out both.

Phone numbers must come from a country in the North American Numbering Plan, which covers Canada, the United States and several Caribbean countries. If you often travel or live elsewhere, an authenticator app or grid is the practical choice. Internet (VoIP) numbers can work, but the CRA warns that some VoIP services are not compatible with MFA; if texts do not arrive, choose the phone call option instead.

How do you add a backup MFA option?

Adding a second method takes a few minutes once you are signed in.

1. Sign in to your CRA account through canada.ca.
2. On the Welcome page, open Security settings, then Multi-factor authentication.
3. Choose the method to add. For an authenticator app, scan the QR code shown or type the setup key into the app.
4. Enter the passcode the new method produces to confirm it works.
5. For a passcode grid, print it or save it offline, and note the date so you renew it before 18 months pass.

If you lose access to your main MFA option

What to do depends on what you still have.

• Lost or replaced phone, same number: a new SIM with your old number still receives texts and calls. Authenticator apps need to be set up again, so sign in with your text or grid and re-enrol the app.
• New phone number: sign in with your other enrolled option, then update the number under Security settings.
• Lost or expired passcode grid: sign in by phone or app and generate a new grid.
• No working option at all: you cannot finish sign-in. See our CRA account locked page for when to contact the CRA.

Too many wrong passcodes lock you out for 30 minutes. After 3 of those locks the account stays locked until the CRA releases it, so switch to your backup rather than guessing.

Staying safe from fake MFA requests

A CRA security passcode is only useful to the person signing in. The CRA's only text messages are the passcodes you trigger yourself, so a passcode that arrives when you are not signing in means someone else has your password. Do not share it, and change your password.

Scammers sometimes phone pretending to be the CRA and ask you to read back a code "to verify your identity". That code lets them into your account, where they can change your banking details. Our guide on spotting a CRA letter scam lists other tricks, and it is worth checking your CRA direct deposit details if you think a code was shared.

For the rest of what the account offers, see the CRA My Account guide.