Scams · · 4 min read
A revised tax notice that is not in your CRA account is a scam
The CRA’s scam list, marked new, describes emails about errors on your return and a revised notice you must download. A real notice is already in My Account.
The Canada Revenue Agency’s scam list currently marks one email as new. It says your tax return has errors, and it tells you to download a revised notice of assessment to check amounts that look wrong, incomplete, or inconsistent with your records. It also says that notice is not in My Account or on the CRA website, and that you have only a short time to download and save it from a link in the email.
That last claim is the tell. A real notice of assessment, and a real notice of reassessment if the CRA actually changes your return, is in your CRA account. The email does not hand you the notice.
What the real email does
If you have chosen electronic mail, the CRA sends an email when there is something new to read in My Account. Its own description of those emails says the sender name is “Canada Revenue Agency / Agence du Revenu du Canada.” The message does not ask for personal or financial information, does not demand a prepaid card or a gift card, and does not threaten you with arrest.
Notices of assessment and notices of reassessment are among the letters you can open in that mail. The online notice and the paper notice are both official. The online one does not include a cheque or a payment stub. Nothing in that process is a file you have to save from the email before a timer runs out, and nothing in it is unavailable in My Account.
The assessment page says the CRA sends a notice of reassessment only when your assessed return is changed. If the CRA found errors, that notice comes after the reassessment is done. You then read it in My Account, or on paper if that is how you still get mail. You do not fetch it from a link because someone said the account does not have it.
What the scam is for
The CRA’s alert says the pressure is there to make you click a link or a button and hand over information the sender can misuse. It also says the download itself may be malicious software, which raises the chance of someone getting into the computer. The alert does not name a particular virus, and it does not give a count of reports. Treat both risks as the CRA states them: information, and a file you should not open.
A message that already knows your name is not evidence. A notice of assessment is a document people expect, which is why the disguise works. The part that does not fit is “this one is not in your account, so use our link, and hurry.”
What to do
- Do not click, do not open the attachment, and do not reply. That is the CRA’s list, in that order.
- Open the account yourself. Type
canada.cainto the address bar, or use a bookmark you made earlier. Sign in and look at Mail. If a real reassessment exists, it is there. If the mail is empty, the email was not the CRA. - Use the CRA’s phone numbers if you still want a person. For individuals the CRA publishes 1-800-959-8281 in the provinces and 1-866-426-1527 in the territories. Do not call a number that arrived in the email.
- If you already opened the file or typed a password into the link, stop using that computer for the account. Sign in from a phone or another machine, by typing the address, and check whether your email, address, or direct deposit was changed. If the attachment ran, treat it like any other unexpected download. Our note on session theft is the reason a new password alone is not the whole cleanup.
- Report it from the CRA’s scams page, which is also where this alert lives. Reporting is how the list stays current. It does not get the email out of other people’s inboxes by itself.
A real CRA letter can still say you owe money or that a return changed. You deal with that inside the account, on the CRA’s payment page, or by calling the number above. You do not deal with it by e-transfer, cryptocurrency, a prepaid card, or a gift card. The CRA’s scam page says it will not take payment that way.
Sources
- Canada Revenue Agency, Recognize a scam, “Notice of assessment phishing scam”
- Canada Revenue Agency, Email notifications from the CRA
- Canada Revenue Agency, Notices of assessment
- Canada Revenue Agency, Find out if it’s really the CRA contacting you
New posts, by email.
About once a month. Plain-language privacy notes, nothing else. I never share your address.