CRA letter scam or real? How to check any CRA contact
Short answer
To spot a CRA letter scam, compare the message with how the CRA really works. The CRA does call and mail letters, but it never threatens arrest, never demands payment by gift card, crypto, prepaid card or e-transfer, and only texts you passcodes you asked for when signing in. Check any letter by signing in to My Account yourself and looking for the same item under Mail.
- 01CRA text messages
- Only multi-factor passcodes at sign-in
- 02CRA emails
- Only alerts you signed up for, or items you requested
- 03Never used for payment
- Gift cards, crypto, prepaid credit cards, Interac e-transfer
- 04Report to CRA
- Online form or Form RC213
- 05CRA follow-up after a report
- Designated officer within 14 business days
How the CRA really contacts you
Scams work because the CRA really does reach out by phone and by mail. The difference lies in what a real contact asks for and how it asks. The table below summarizes the CRA's own rules for each channel.
| Channel | What the CRA may do | What the CRA will not do |
|---|---|---|
| Phone | Verify your name, date of birth and SIN; ask about your return; request payment through its own payment options | Threaten arrest, deportation or prison; charge a fee; leave personal or financial details in a voicemail |
| Send notices, review letters and demands for payment | Demand gift cards, crypto, prepaid cards or e-transfers | |
| Tell you there is new mail in My Account, if you signed up; send forms you asked for | Ask you to reply, or link to a page asking for personal or financial details | |
| Text | Send multi-factor passcodes when you sign in | Start a conversation about taxes, benefits or refunds |
Does the CRA send text messages?
Only one kind. The CRA sends one-time passcodes by text for multi-factor authentication when you are signing in. It does not use texts, WhatsApp or Facebook Messenger to contact you about taxes, and it never texts or emails a link to a refund.
Does the CRA call you?
Yes. The CRA calls about reviews, balances owing and missing returns, and it sends automated reminders. A real agent may ask for your SIN to confirm identity, which is exactly why scammers ask too. If a call feels wrong, hang up and phone the CRA back using the number on its official contact page, not a number the caller gives you.
Signs of a CRA scam
No single sign proves a scam, but any one of these should make you stop and check before acting.
The most common CRA text scam promises a refund or credit and asks you to click a link and fill in a form before a tight deadline. The most common phone scam claims you owe tax and will be arrested today unless you pay with gift cards. Both break the CRA's own rules outright.
Checking a CRA letter through My Account
Paper letters are harder to judge because they can look official. The reliable test is to check your CRA account, which the scammer cannot fake if you reach it yourself.
- Do not use any web address, QR code or phone number printed in the letter.
- Type canada.ca into your browser and sign in to My Account.
- Open Mail and look for the same letter, with the same date and reference.
- Check the amount owing or the request against Account balance or your notices.
- If the letter is not there, call the CRA using the official contact page and ask whether it is genuine.
Real review letters ask you to send documents, often through Submit documents in My Account. If you receive one, our page on a CRA review letter explains what the CRA wants and the deadline for replying. Not registered for online access yet? The CRA My Account guide covers sign-up.
If you already responded to a CRA scam
Act quickly. What to do depends on what you handed over, but most people need several of these steps.
- Gave a passcode or password: sign in through canada.ca, change your password and review your multi-factor options. Our CRA multi-factor authentication page explains the settings.
- Account may be compromised: check your address and banking details at once. If the banking was changed, see how to change CRA direct deposit and report it.
- Gave your SIN or banking numbers: tell your bank, and consider asking Equifax and TransUnion to flag your credit file.
- Paid money: contact your bank or card issuer and file a police report.
In every case, report the suspicious activity to the CRA. It can place protections on your account while it looks into what happened.
Reporting a CRA scam
There are three places to report, and each does a different job.
| Report to | When | How |
|---|---|---|
| The CRA | Your CRA account, SIN or banking may be compromised | Online suspicious activity form, or Form RC213 by fax |
| Canadian Anti-Fraud Centre | Any scam attempt, even if you did not respond | Online at antifraudcentre-centreantifraude.ca |
| Local police | You lost money or your identity was used | Your local police service |
After you report to the CRA, an agent reviews the case and places protections on the account, and a designated CRA officer contacts you within 14 business days. Keep a copy of the scam message, the date and anything you sent, in case the officer asks for them.
Common questions
Does the CRA send emails?
Only in limited cases: a notice that new mail is waiting in My Account if you signed up for email alerts, or forms and links you asked for during a call. A CRA email will not ask you to reply or enter personal or financial details through a link.
How can I tell if a CRA letter is real?
Sign in to My Account through canada.ca yourself and look for the same letter under Mail. If it is not there, phone the CRA using the number on its official contact page, not one printed in the letter.
Would the CRA ever threaten to arrest me?
No. The CRA says it will never threaten arrest, deportation or prison, and it does not use aggressive language. A caller who does is a scammer.
Can the CRA ask me to pay with gift cards or Bitcoin?
No. The CRA never demands payment by gift card, cryptocurrency, prepaid credit card or Interac e-transfer. Real balances are paid through the CRA's own payment options.
What should I do if I gave my SIN to a CRA scammer?
Report the suspicious activity to the CRA so it can protect your account, check your banking and address details in My Account, and tell your bank. Reporting to the Canadian Anti-Fraud Centre and police is also recommended.
Sources
- Recognize a scam canada.ca
- Report a scam or identity theft canada.ca
- Scam prevention and the CRA canada.ca
- Contact the Canada Revenue Agency canada.ca
We check figures against these official pages. Rules change; confirm anything that affects a deadline or payment with the agency before you act.
Tell us what happened
Describe your situation and our editors will use it to improve this guide. If you leave your email, we may reply with a pointer to the right page or official contact. We never share your details.