Is That CRA Email Real? How to Tell a Canada Revenue Agency Scam Email in Seconds
A Canada Revenue Agency scam email is an unsolicited message impersonating the CRA that pressures you with a refund, a debt or a threat, and asks you to click a link, share personal details or pay by untraceable methods. The real CRA doesn't do this by email.
That matters right now because phishing campaigns that impersonate the CRA keep evolving, including messages designed to get malware onto your phone or computer. According to the CRA's official fraud and scam guidance, the agency doesn't send emails or texts with links asking you to verify your identity, and it doesn't ask for personal or financial information that way. It also doesn't demand payment by gift cards, cryptocurrency or prepaid cards, and it doesn't threaten arrest or jail over the phone or by email.
Scammers press hardest on people who already have real tax debt, because the fear is already there. If that's you, take a breath. We'll show you how to verify a balance safely.
Here's the quick rule: don't click, don't reply, and check My Account by typing canada.ca into your browser yourself.
What the CRA Will and Won't Do, and the Red Flags in Scam Emails
What the CRA will do
The CRA may email you to say a mail item is waiting in My Account, or to confirm it received a document you submitted. Those emails never include links to log in and never ask for personal information. It may also phone you to verify your identity or discuss an account, though it asks for details like your SIN only in limited cases. Real debt is communicated through My Account and by mail.
What the CRA won't do
The CRA will never ask for payment by gift card, cryptocurrency or prepaid card, and will never threaten arrest. It also won't send Interac e-Transfer refund links, use aggressive or abusive language, or send a payment link by text or email. Refunds arrive by direct deposit or cheque.
Current tactics
The CRA and the Canadian Anti-Fraud Centre (CAFC) describe a familiar playbook:
- Fake refund and Interac e-Transfer emails
- Phishing links to spoofed My Account login pages
- Texts with shortened URLs
- Spoofed phone numbers that look like the CRA's
- Threats of arrest or deportation
- Demands for gift cards or Bitcoin
- "Final notice" messages that pose as CRA collections or legal action
The newest wave goes a step further, using attachments or links to install malware that can capture your passwords and banking logins. That's why one careless click can cost more than one fake payment.
Red-flag checklist
Check for these before you do anything else:
- A generic greeting such as "Dear taxpayer"
- A sender domain that doesn't end in canada.ca or gc.ca
- Urgent deadlines or countdown language
- Spelling and grammar errors
- Unexpected attachments
- Requests for banking details or passwords
- Links where the hover address doesn't match canada.ca (hover, don't click)
How big is the problem?
The CAFC tracks CRA impersonation as one of the most common government-impersonation scams, with millions of dollars in reported losses to Canadians. The CAFC also estimates only about 5 to 10 per cent of fraud is ever reported, so the real numbers are far higher. You can check its latest-year figures on the CAFC website.
Scammers and real tax debt
If you owe the CRA, a fake payment demand is more believable. Verify any balance only in My Account or by calling the CRA's published number. A real demand letter arrives by mail and includes your account details and lawful options. Here's how genuine CRA demand letters work, so you can compare one against a suspicious message. For calmer, panic-free steps, see these practical tips for dealing with real CRA tax debt.
Fake legal threats
Genuine CRA collection follows a process: notices, demand letters, and only then possible legal actions such as garnishment. It never involves an arrest warrant delivered by email. Understanding your real rights when facing legal threats makes scare tactics much easier to spot.
Fake relief offers
Some scammers pose as the CRA, or as a "government debt forgiveness program," to collect fees up front. Real options look different: payment arrangements, taxpayer relief provisions for interest and penalties, and consumer proposals filed through a Licensed Insolvency Trustee. If you're not sure how that last one works, read what a consumer proposal actually is so you can recognize when a scam is imitating it.
Business owners
CRA impersonation also targets business owners with fake GST/HST, payroll or source-deduction notices. Real business tax debt has defined processes, and these legitimate processes for business owners with tax debt are worth knowing before a fake notice lands in your inbox.
What to Do If You Got, Clicked or Paid: Reporting and Recovery Steps
If you paid or shared details with a CRA scammer, contact your bank first, then report to the CAFC and local police and place fraud alerts with both credit bureaus. Here's how to respond at each stage.
If you only received it. Don't click or reply. Forward it to spam@cra-arc.gc.ca if you'd like to report it, then delete it. You can also report it to the Canadian Anti-Fraud Centre at 1-888-495-8501 or online.
If you clicked a link. Disconnect from the internet, run a security scan, and change passwords on any account you used, especially email and banking. Email matters most, since it can reset everything else.
If you entered credentials or banking details. Call your bank immediately to freeze accounts, cards and e-Transfer. Then change your My Account credentials and review your security settings, including multi-factor authentication.
If you shared your SIN or ID. Place fraud alerts with Equifax Canada and TransUnion Canada, monitor your credit reports, and contact the CRA about protecting your account. The CRA's fraud page explains what to do if you think your information was compromised.
If you sent money. Contact your payment provider right away, file a police report with your local police, and report it to the CAFC. Recovery isn't guaranteed, so speed matters.
Finally, watch for "recovery" scams. After a loss, fraudsters sometimes contact victims offering to retrieve the money for a fee. Don't pay it.
Real Tax Debt? How to Verify It and Find Trustworthy Help
Check any balance through CRA My Account or the CRA's official phone line, never through an emailed link. Genuine options for real debt include payment arrangements, taxpayer relief for penalties and interest, and consumer proposals, which can resolve tax debt alongside other debts.
To verify a debt relief firm, confirm that insolvency filings are handled by a Licensed Insolvency Trustee listed with the Office of the Superintendent of Bankruptcy, and be wary of upfront fees or guaranteed results. This guide to how to tell trustworthy debt relief companies apart is a good place to start, and this article shows how to evaluate whether an organization is legitimate.
4 Pillars offers a free initial consultation and works as an independent debtor advocate. We'll never ask for payment through gift cards or send login links by email.
Stay Calm, Verify Independently, and Get Real Help
The core rule is simple: when in doubt, don't click. Log in to My Account directly or call the CRA. If real CRA debt is causing you stress, speaking with a licensed professional can replace panic with a plan. We offer a free consultation across our 51 offices if you'd like to explore your options, and these legitimate Canadian debt support resources can help whether or not you've already responded to a scam.
Frequently Asked Questions About CRA Scam Emails
How can I tell if an email from the CRA is real?
Real CRA emails don't contain links asking you to sign in or provide personal or banking details. Check the sender domain, avoid clicking links, and log in to My Account by typing the address yourself to see if there's a message.
Does the CRA send refunds by Interac e-Transfer email?
No. The CRA issues refunds by direct deposit or cheque. An email offering a refund through a link or e-Transfer is a scam.
Where do I report a CRA scam email?
Report to the Canadian Anti-Fraud Centre at 1-888-495-8501 or online, and forward the email to spam@cra-arc.gc.ca. If you lost money, also contact local police.
What should I do if I clicked a link in a CRA scam email?
Disconnect, scan your device, change passwords, and watch your accounts. If you entered banking information, call your bank immediately and consider fraud alerts with Equifax and TransUnion.
Will the CRA threaten to arrest me?
No. The CRA does not threaten arrest or jail by email, text or phone. Real collection follows documented notices and legal processes, as outlined on the CRA's fraud and scams page.
How do I check if I really owe the CRA money?
Log in to CRA My Account directly through canada.ca or call the CRA's official number. Don't use contact details from a suspicious message.
What options exist if I have real CRA tax debt?
Options may include a payment arrangement, taxpayer relief for penalties and interest, or a consumer proposal through a Licensed Insolvency Trustee. A free consultation can help you compare them.
