A text message using the Canada Revenue Agency (CRA) name is not proof that the CRA sent it. Scammers can pose as the agency to get you to click a link, share personal or banking details, or send money. Don’t respond or use a link in an unexpected message. Check your CRA account by going to the official Government of Canada website yourself, and report suspicious messages if needed.
How CRA text message scams work
In this type of fraud, a sender claims to represent the CRA and tries to prompt a quick reaction. The message may say you are owed money, that a benefit or refund is waiting, or that there is a problem with your account. It may direct you to a website that looks official, ask you to reply, or tell you to call a number included in the text.
The goal is often to collect information that can be used to access accounts or commit identity fraud. A fake page might ask for a Social Insurance Number, date of birth, address, account password, card details or banking information. In other cases, the sender may ask for a payment to settle an alleged tax debt. Information shared in a reply can also confirm that your number is active and invite more messages.
Scammers may make a message feel urgent by warning of penalties, account suspension or legal trouble. They may also use personal details or the CRA name and logo to make a message seem convincing. Those details do not establish that the message is genuine. Sender names and numbers can be misleading, and a link can lead to a page designed to look like a real service.
The CRA is a real government agency, not the source of messages sent by someone impersonating it. If you are unsure about a notice, don’t follow instructions in the text. Sign in to your CRA account using a route you know is official, or contact the CRA using contact information you find independently.
Variations to watch for in Canada
Messages can change their wording and offers, but the basic approach is often similar: the sender claims there is money or an urgent issue and asks you to act through the text. A message may refer to a tax refund, a benefit payment, a missed filing or an amount owing. Treat these as claims to verify, not proof that your account has a problem.
Some texts try to take you to a website to “confirm” information or claim a payment. Others ask you to reply with personal details, or to call a number provided in the message. A further variation is a threat: the sender says you must pay right away to avoid consequences. The next step might involve a payment method that is difficult to reverse.
These texts can arrive even when you are not expecting to hear from the CRA. They may be sent to many people, or be tailored with details that make the message feel personal. Do not assume a message is legitimate because it arrives during tax season, mentions a benefit you receive, or appears in the same conversation as an earlier text.
Red flags in a CRA text message
Look for the request the message is making, rather than relying on its appearance. These warning signs deserve caution:
- An unexpected link: The text asks you to click to claim money, verify your account or resolve an issue.
- A demand for sensitive details: It asks for your password, Social Insurance Number, banking information or card details by text or through a linked page.
- Pressure to act immediately: The sender threatens a penalty or other consequence unless you respond or pay at once.
- An unusual payment request: You are told to pay with gift cards, cryptocurrency, or another hard-to-reverse method.
- A request to keep it secret: The sender discourages you from checking with the CRA, your bank or someone you trust.
- A sender name that looks official: A familiar name or logo is not enough to verify who sent the message.
- Unexpected attachments or requests to install something: Don’t open files or install apps from an unsolicited text.
A message may have spelling or grammar mistakes, but polished writing is not proof of legitimacy either. The safest approach is to verify the matter separately.
How to protect yourself
Pause before acting. Don’t tap a link, call a number, open an attachment or reply to a text you were not expecting. If the message claims you need to deal with a CRA matter, open a browser and type the Government of Canada website address yourself, then navigate to CRA services. You can also use contact information found on an official government page or on correspondence you already trust.
Check your account for information about the issue rather than relying on the text. If you cannot confirm it there, contact the CRA independently and ask whether the message is genuine. Do not use the contact details supplied in the message as your only way to check.
Never share your account password or one-time security code with someone who contacts you unexpectedly. Be cautious about entering personal or banking information after following a text link. If you need help deciding whether a message is real, ask a trusted person to review it with you, but don’t forward it with sensitive information visible.
Keep your phone and apps updated, use strong, unique passwords for important accounts, and turn on available multi-factor security. These steps can reduce the harm if a password is exposed. Be wary of follow-up calls or messages from someone claiming they can recover money or fix a problem for a fee; verify any offer independently.
What to do if you’ve been targeted
- Stop communicating. Don’t reply, click more links, send money or provide additional information. Take a screenshot of the message and note any relevant details before deleting or blocking it.
- If you entered a password, change it. Use the official site or app, not the text link. Change the same password anywhere else you used it, and enable extra account security where available.
- If you shared banking information or sent money, contact your bank or payment provider right away. Explain what happened and ask what steps can be taken to protect your account or try to stop a payment. If card details were shared, ask whether the card should be cancelled or replaced.
- If you shared personal information, take steps to protect your identity. Watch for unfamiliar account activity, bills or credit applications. Contact the organizations whose information may be affected using independently verified contact details.
- Secure affected accounts. Check for changes you did not make, such as new contact details or password resets. Sign out of other sessions if the service offers that option.
- Keep records and get support. Save screenshots, dates, messages and payment records. If you feel overwhelmed, ask a trusted person to help you contact your bank and report what happened.
You can take these steps even if you only clicked a link and did not enter information. If you downloaded a file or app, avoid entering passwords on that device until you have addressed the security issue. Consider getting help from a reputable device-support provider.
How to report CRA text message scams
Report suspicious texts to the Canadian Anti-Fraud Centre at 1-888-495-8501 or through antifraudcentre-centreantifraude.ca. You can report an attempt even if you did not lose money. Include what the sender claimed, how they contacted you and whether you clicked, replied, shared information or paid.
Contact your local police if you lost money, your identity was misused, or you believe a crime has occurred. If money or banking details were involved, contact your bank as soon as possible as well. You can also notify the CRA through contact information on the official Government of Canada website. Reporting helps the relevant organizations understand what happened and advise you about next steps.
Frequently asked questions
Does every text that mentions the CRA come from a scammer?
Not necessarily, but a name or logo in a text does not verify who sent it. Be particularly cautious about unexpected links, requests for sensitive information, and demands for immediate payment. Check the matter through an official CRA route rather than the message.
Should I click a link to see whether the message is real?
No. A link can lead to a convincing imitation of a government website. Instead, go to the official Government of Canada website yourself and navigate to CRA services, or use contact details you have independently verified.
What if I only replied to the text?
Stop replying and don’t share further information. Save a record of the message, block the sender if appropriate, and be alert for more calls or texts. If you disclosed personal or financial details, follow the steps above and report the incident.
Can I report a message if I did not lose money?
Yes. You can report attempted fraud to the Canadian Anti-Fraud Centre even when you did not click, share information or make a payment. If you did share banking details or send money, contact your bank promptly too.