Think Before You Click: Spotting Fake CRA Messages
- Darion Ducharme
- 4 days ago
- 3 min read
Tax season is stressful enough; don’t let scammers make it worse.
Every year, fake messages claiming to be from the Canada Revenue Agency (CRA) trick thousands of people into clicking dangerous links or giving away personal information.
These scams can lead to identity theft, financial loss, and emotional stress.
You deserve to feel safe and informed, especially when it comes to your money and government services.
Let’s walk through how the CRA really communicates, how to spot scams, and what to do if you’re unsure.
Does CRA Send Emails? Yes—but There’s a Catch
The CRA does send emails, but they’ll never ask you for personal or financial information by email or text.
Here’s what a legitimate CRA email might look like:
It tells you there’s a new message in your secure CRA account
It doesn’t ask you to click on a link or download an attachment
It doesn’t ask for your SIN, banking info, or passwords
It comes from a government email domain like @cra-arc.gc.ca
The CRA will ask you to log into your My Account through a secure website, not through a link in the email itself.
Note: If the email includes a direct link to a payment page or asks for private information, it’s likely a scam.
Signs an Email is Fake or a Phishing Scam
Phishing scams are designed to make you panic or act fast without thinking. Here’s what to watch for:
Spelling mistakes or strange grammar
Weird-looking email addresses (like cra-alerts2024@gmail.com)
Urgent or threatening language (“Pay now or face legal action!”)
Attachments or links asking you to update info or make a payment
Requests for your SIN, banking details, or login info
Scammers may even use your full name, phone number, or partial account details to make it feel real. Don’t let that fool you.
FAKE CRA MESSAGEs VS How the CRA Really Contacts You
The CRA may contact you by:
Mail: For formal notices, account statements, or audit letters
Phone: Only if you’ve asked them to call, or they’re following up on a case
Email or text notifications: To tell you there’s a new message in your CRA account (but not to give personal info!)
Pro tip: CRA agents won’t threaten you with jail time or demand payment in gift cards, crypto, or wire transfers.
What to Do If You’re Not Sure
Here are simple steps to take when an email looks suspicious:
Don’t click anything. Don’t open links or attachments until you’re 100% sure.
Go directly to the CRA website: www.canada.ca/cra
Check your secure account: Log in through My CRA Account to see if you have real messages.
Call the CRA directly at 1-800-959-8281 to verify.
Report phishing attempts: Forward suspicious emails to: phishing@cra-arc.gc.ca
Tips to Protect Your Info Year-Round
Use strong passwords for government and financial accounts
Turn on two-factor authentication (2FA) if available
Never share personal info by email or text
Talk to a trusted friend or advisor if something feels off
Stay updated on current scams through Canada's Anti-Fraud Centre
Teqare Helps You Stay Scam-Smart
At Teqare, we make it easy to protect yourself online with:
Workshops about online fraud and phishing
Support for Elders, families, and individuals
Easy-to-follow resources made for all levels of tech experience
Digital safety isn’t just for “tech people”—it’s for everyone. And we’re here to help.
Contact us today and learn more about our scam prevention and cybersecurity workshops.
Disclaimer: At Teqare, we share knowledge to help protect and empower our communities online. The information in this blog is for educational purposes only and should not be taken as legal or financial advice. Always seek guidance from a trusted professional for your specific situation. We do our best to keep information current and relevant, but digital threats can evolve quickly. Stay alert, stay curious, and reach out if you need support—we’re here to help.
Photo by Nataliya Vaitkevich