SECURITY ALERT - Phone Phishing attempt
Cyber criminals are trying to trick us with their tax-related phishing scams
February 22nd, 2018 - 2:04pm
Security Alert — Phone Phishing
Tax season is once again upon us, and cyber criminals are trying to trick us with their tax-related phishing scams. This alert is to inform you about a phone phishing attempt by scammers claiming to be Canada Revenue Agency (CRA) representatives.
Using automated call technology, the scammers threaten call recipients with arrest if they fail to call the number provided. The scammers then trick those who call the number into sharing their personal information.
Should you receive such an automated phone call, please be aware that it is a scam. Do not call the number provided. Remember: Urgent messages, whether in an email or a phone call, aim to induce fear and lead you to act impulsively.
However, if you have called the number inadvertently and provided personal information to the scammer, or suspect that your financial information may be at risk, please contact your local police.
For more information about this type of scam or others, please visit the Canadian Revenue Agency web site.
To identify communications not from the CRA, be aware of these guidelines.
If you receive a call saying you owe money to the CRA, you can call us or check My Account to be sure.
If you have signed up for online mail (available through My Account, My Business Account, and Represent a Client), the CRA will do the following:
- send a registration confirmation email to the address you provided for online mail service for an individual or a business; and
- send an email to the address you provided to notify you when new online mail is available to view in the CRA's secure online services portal.
The CRA will not do the following:
- send email with a link and ask you to divulge personal or financial information EXCEPT if you call the CRA to request a form or a link for specific information, a CRA agent will forward the information you are requesting to your email during the telephone call. This is the only circumstance in which the CRA will send an email containing links.
- ask for personal information of any kind by email or text message.
- request payments by prepaid credit cards.
- give taxpayer information to another person, unless formal authorization is provided by the taxpayer.
- leave personal information on an answering machine.
When in doubt, ask yourself the following:
- Did I sign up to receive online mail through My Account, My Business Account, or Represent a Client?
- Did I provide my email address on my income tax and benefit return to receive mail online?
- Am I expecting more money from the CRA?
- Does this sound too good to be true?
- Is the requester asking for information I would not provide in my tax return?
- Is the requester asking for information I know the CRA already has on file for me?
If you do have a debt with the CRA and can't pay in full, take action right away. For more information, go to When you owe money – collections at the CRA.
How to protect yourself from identity theft
- Never provide personal information through the Internet or by email. The CRA does not ask you to provide personal information by email.
- Be suspicious if you are ever asked to pay taxes or fees to the CRA on lottery or sweepstakes winnings. You do not have to pay taxes or fees on these types of winnings. These requests are scams.
- Keep your access codes, user ID, passwords, and PINs secret.
- Keep your address current with all government departments and agencies.
- Choose your tax preparer carefully! Make sure you choose someone you trust and check their references. Always review your return, agree with the content before filing, and follow up to make sure you receive your notice of assessment, since it contains important financial and personal information that belongs to you.
- Before supporting any charity, use the CRA website at www.cra.gc.ca/charities to find out if the charity is registered and get more information on the way it does business.
- Be careful before you click on links in any email you receive. Some criminals may be using a technique known as phishing to steal your personal information when you click on the link.
- Caller ID is a useful function. However, the information displayed can be altered by criminals. Never use only the displayed information to confirm the identity of the caller whether it be an individual, a company or a government entity.
- Protect your social insurance number. Don't use it as a piece of ID and never reveal it to anyone unless you are certain the person asking for it is legally entitled to that information. If an organization asks for your social insurance number, ask if it is legally required to collect it, and if not, offer other forms of ID.
- Pay attention to your billing cycle and ask about any missing account statements or suspicious transactions.
- Shred unwanted documents or store them in a secure place. Make sure that documents with your name and SIN are secure.
- Immediately report lost or stolen credit or debit cards.
- Carry only the ID you need.
- Do not write down any passwords or carry them with you.
- Ask a trusted neighbour to pick up your mail when you are away or ask that a hold be placed on delivery.
Have you been a victim?
You should report deceptive telemarketing to the Canadian Anti-Fraud Centre online or by calling 1-888-495-8501.
If you suspect you may be the victim of fraud or have been tricked into giving personal or financial information, contact your local police service.
If the CRA has confirmed that a taxpayer's information has been compromised, the Agency will act to prevent the fraudulent use of the information involving systems and processes for which the CRA is responsible.
If your social insurance number (SIN) has been stolen, you should contact Service Canada at 1-800-206-7218. For more information, see Social Insurance Number (Service Canada website).
You can ask the CRA to disable online access to your information on the CRA login services by contacting us. After access to your information is disabled, you may change your mind and want access again. If so, you can contact us and ask that your access be re-activated.
If you think your CRA user ID or the password you use in personal dealings with the CRA has been compromised, contact us.