How the CRA secures compromised accounts

You may be looking for:

• Protect your CRA accounts

The Canada Revenue Agency (CRA) takes security incidents seriously and will take precautionary steps to ensure your CRA online accounts remain safe and secure.

On this page

• If you suspect your account is compromised
• Actions the CRA takes to secure your account
• How the CRA informs you of a security incident

If you suspect your account is compromised

You should contact the CRA if:

• You suspect unauthorized access or notice changes to your CRA account that you did not make
• You received a notice claiming to be from the CRA, showing changes you were not aware of

If you believe your CRA My Account, My Business Account or Represent a Client account has been compromised, report suspected identity theft.

Actions the CRA takes to secure your account

If your account information has been compromised, the CRA will take the following actions.

For individuals, we may:

• Temporarily disable access to your account(s)
• Contact you by phone or letter with instructions on how to validate your identity to regain account access
• Assess whether you are entitled to be offered credit protection services free of charge
• Temporarily stop sending any benefit and credit payments to you until your identity has been validated
• Work with you to restore your personal information and ensure you are not held liable for fraudulent claims and payments made on your account

For businesses, we may:

• Temporarily stop payments
• Disable web access codes for electronic filing
• Work with businesses to reactivate accounts, resume payments, and issue new access codes if needed
• Notify you if the personal information of your employees may have been accessed without authorization

How the CRA informs you of a security incident

As soon as the CRA becomes aware of an alleged incident of identity theft or suspects your account was targeted, we take swift and immediate precautionary measures.

Incidents of suspected unauthorized access

The CRA may send letters by registered mail to individuals and businesses who have been affected by incidents of suspected unauthorized access.

The letter provides information on how to validate your identity to restore access to your account. You should follow the instructions in the letter. For individuals, the letter may also include information about access to free credit protection services.

Suspected identity theft

In cases of suspected identify theft, we may call or mail you a letter to notify of the incident. We may ask for details about your file or request documents to validate your identity and personal information.

You may be asked to provide:

• A copy of government identification (such as a driver’s license, passport, or birth certificate)
• Proof of address (such as a utility, phone, or internet bill, or tax-related document)
• Bank statements or a letter from your financial institution confirming your direct deposit information

If you’re suspicious about a call that you’ve received that is requesting information from you, here’s how to verify it's the CRA calling.