# CRA multi-factor authentication: the backup option rule explained

Source: https://canadataxdesk.com/cra-account/cra-backup-mfa
Publisher: Canada Tax Desk (canadataxdesk.com), independent editorial site
Topic: CRA Account
Last updated: 2026-09-18

> CRA multi-factor authentication asks for a one-time passcode each time you sign in. Since February 2026 the CRA requires a backup MFA option on file as well as your main one, such as a passcode grid or a third-party authenticator app. The backup keeps you from being locked out if you lose your phone or change your number.

## Key facts

- Backup rule starts: February 2026
- MFA options: Text, phone call, passcode grid, authenticator app
- Authenticator code: 6 digits, new code every 30 seconds
- Passcode grid lifespan: 18 months
- Wrong passcode lock: 30 minutes; permanent after 3 locks

## What changed in CRA multi-factor authentication in 2026

Multi-factor authentication, or MFA, means the CRA checks two things when you sign in: something you know, such as your password, and something you have, such as a phone that receives a passcode. The CRA has used MFA on its sign-in services for years.

The change came in February 2026. The CRA now requires every CRA account user to keep a backup MFA option on file, and it named the passcode grid and third-party authenticator apps as examples. The stated goal is to stop people getting stuck at the passcode step when their main option fails.

New registrations already enrol in two options during setup. If you registered before the change with a single phone number, the rule means you need to add a second method yourself under Security settings.

### Is the backup MFA mandatory?

Yes, for anyone using a CRA account. You cannot opt out and keep only one method. The requirement does not apply to filing itself: you can still file through NETFILE software without signing in to the CRA.

## CRA backup MFA options compared

The CRA offers four options. The best pairing is one method tied to your phone plus one that is not, so a single lost device cannot take out both.

| Option | How it works | Weak point | Good as backup? |
| --- | --- | --- | --- |
| Text message | Passcode sent to a cell number | Lost phone or new number | Better as main option |
| Phone call | Automated call reads the passcode | Same number as text | Only if it is a different line |
| Authenticator app | App makes a 6-digit code every 30 seconds | Deleted app or new phone | Yes |
| Passcode grid | Printed table; you enter 3 cell values | Lost paper; expires after 18 months | Yes, stored at home |

The four CRA MFA options

Phone numbers must come from a country in the North American Numbering Plan, which covers Canada, the United States and several Caribbean countries. If you often travel or live elsewhere, an authenticator app or grid is the practical choice. The CRA also accepts internet phone numbers, with some limits.

## Setting up a backup MFA option

Adding a second method takes a few minutes once you are signed in.

1. Sign in to your CRA account through canada.ca.
2. On the Welcome page, open Security settings, then Multi-factor authentication.
3. Choose the method to add. For an authenticator app, scan the QR code shown or type the setup key into the app.
4. Enter the passcode the new method produces to confirm it works.
5. For a passcode grid, print it or save it offline, and note the date so you renew it before 18 months pass.

> **Test before you need it:** After adding a backup, sign out and sign back in using the new method. Finding out the grid printout was blurry during a lockout is the worst time to learn it.

## If you lose access to your main MFA option

What to do depends on what you still have.

- **Lost or replaced phone, same number:** a new SIM with your old number still receives texts and calls. Authenticator apps need to be set up again, so sign in with your text or grid and re-enrol the app.
- **New phone number:** sign in with your other enrolled option, then update the number under Security settings.
- **Lost or expired passcode grid:** sign in by phone or app and generate a new grid.
- **No working option at all:** you cannot finish sign-in. See our [CRA account locked](https://canadataxdesk.com/cra-account/cra-account-locked) page for when to contact the CRA.

Too many wrong passcodes lock you out for 30 minutes. After 3 of those locks the account stays locked until the CRA releases it, so switch to your backup rather than guessing.

## Staying safe from fake MFA requests

A CRA security passcode is only useful to the person signing in. The CRA's only text messages are the passcodes you trigger yourself, so a passcode that arrives when you are not signing in means someone else has your password. Do not share it, and change your password.

Scammers sometimes phone pretending to be the CRA and ask you to read back a code "to verify your identity". That code lets them into your account, where they can change your banking details. Our guide on [spotting a CRA letter scam](https://canadataxdesk.com/cra-account/cra-letter-scam) lists other tricks, and it is worth checking your [CRA direct deposit](https://canadataxdesk.com/cra-account/cra-direct-deposit) details if you think a code was shared.

For the rest of what the account offers, see the [CRA My Account guide](https://canadataxdesk.com/cra-account).

## Common questions

### Why is the CRA asking me for a backup MFA option?

Since February 2026 the CRA requires every CRA account user to keep a second multi-factor method on file. People who registered with only one method need to add another, so a lost phone does not lock them out.

### What is the best backup MFA for the CRA?

Choose something that does not depend on your main phone number. A printed passcode grid kept at home or an authenticator app are both good backups for people who use text messages as their main option.

### What happens if I lose my phone and cannot get my CRA code?

Sign in with your backup option, such as the passcode grid, then update your phone details in Security settings. If you have no working option, you will need to contact the CRA.

### Does the CRA passcode grid expire?

Yes. A CRA passcode grid expires after 18 months. Sign in and generate a new one before then, and destroy the old printout.

### Is the CRA security code the same as the MFA passcode?

No. The CRA security code is a one-time code mailed during registration to confirm your address. MFA passcodes are short-lived codes you receive every time you sign in.

## Sources

- [What you need for the 2026 tax-filing season](https://www.canada.ca/en/revenue-agency/news/newsroom/tax-tips/tax-tips-2026/what-you-need-for-2026-tax-filing-season.html)
- [Multi-factor authentication: CRA account help](https://www.canada.ca/en/revenue-agency/services/e-services/cra-login-services/help-cra-sign-in-services/multi-factor-authentication.html)
- [My Account for individuals: CRA sign-in](https://www.canada.ca/en/revenue-agency/services/e-services/digital-services-individuals/account-individuals.html)
- [Recognize a scam](https://www.canada.ca/en/revenue-agency/corporate/scams-fraud/recognize-scam.html)