Tax scams are getting harder to spot. On October 1, 2026, the Canada Revenue Agency (CRA) published a tax tip on how it prevents, detects and addresses fraud. It also covers what CRA account users can do to protect their own information. If you own a small business in Canada, are self-employed or manage someone’s books, this is a good reminder that the CRA and taxpayers share the job of protecting tax information.
Why Tax Scams Are Harder to Detect
The CRA released this update during Cyber Month. It says the Canadian Centre for Cyber Security is pointing to two trends: threat actors are getting more sophisticated, and more of them are using artificial intelligence (AI). Both make tax scams harder to detect.
The CRA also says that identity theft can still happen, even with its strong safeguards. Threat actors get personal information through malware, phishing scams, and data leaks or breaches that happen outside the CRA. They may then try to use that information to get into a CRA account without permission.
How the CRA Prevents and Detects Fraud
Using AI to detect suspicious activity
The CRA says it invests in security measures, technologies, processes and controls to better detect, report and address fraud. This includes AI systems that help it detect and respond to cyber security threats faster. According to the CRA, automated monitoring, threat intelligence and internal analysis have helped it protect taxpayer information and reduce the possible impact of fraud.
The CRA also says it keeps adding new lines of defence. For example, it prompts CRA account users to add a backup multi-factor authentication (MFA) option, and it takes down hundreds of phishing websites every year.
Reducing the misuse of CRA user IDs and passwords
To lower the risk that stolen information is used to get into online accounts, the CRA says it:
- Revokes dormant CRA and Sign-In Partner credentials after a prolonged period of inactivity;
- Revokes CRA user IDs and passwords that unauthorized third parties may have obtained from outside sources;
- Limits new CRA account users to only one credential with the CRA (either a CRA user ID and password or a Sign-In Partner); and
- Sends an email notification when changes are made to a user’s CRA account.
In practice, if you have not signed in for a long time, your credentials may no longer be active. Take any unexpected account-change email from the CRA seriously, because it could mean someone else is trying to get into your account.
Working with partners to investigate fraud
The CRA’s Criminal Investigations Program investigates suspected tax evasion, tax fraud and other tax crimes. Where appropriate, it refers cases to the Public Prosecution Service of Canada for possible criminal prosecution. The CRA says the program focuses on the most severe tax crimes, meaning those with the biggest impact on compliance. These include investigations related to benefits such as the Canada Emergency Wage Subsidy.
Depending on how complex a case is, the CRA may investigate on its own or through Joint Force Operations with partner law enforcement agencies. The CRA also shares intelligence and security best practices with governments, financial institutions, tax practitioners and the Office of the Privacy Commissioner.
What the CRA Encourages Account Users to Do
The CRA says its own vigilance, combined with good “cyber hygiene” by CRA account users, creates a strong barrier against fraud. It encourages users to:
- Use a strong and unique password for their CRA account;
- Stay alert for email notifications;
- Regularly monitor their CRA account;
- Keep up to date on the latest scams; and
- Add a backup MFA option.
Putting the Guidance to Work in Your Small Business
For business owners, a few simple habits can turn this advice into a routine:
1. Make account security part of your regular admin
Set a recurring reminder, such as monthly or quarterly, to sign in to your CRA account. Review recent activity and check that your contact details are correct.
2. Set up a backup MFA option now
The CRA is already prompting users to add a backup MFA option. If you set one up before you need it, you are less likely to be locked out when you change phones or lose access to your main method.
3. Never reuse passwords
Threat actors often get information from breaches outside the CRA. That means a password you also use on another website can put your CRA account at risk. Use a strong password for your CRA account that you do not use anywhere else.
4. Act quickly on unexpected notifications
If you get a CRA email about a change you did not make, do not ignore it. Sign in through the official Canada.ca website, not through links in unsolicited messages. If something looks wrong, contact the CRA or your accountant.
5. Keep your team informed
If staff, partners or family members help with your finances, tell them what you learn about current scams. As scams become more convincing, it matters that everyone on your team knows what to look for.
Read the Official CRA Guidance
For full details, read the CRA’s tax tip, Protecting taxpayer information: How the CRA prevents, detects, and addresses fraud, on Canada.ca.
How UMA Accounting Can Help
Protecting your tax information is part of running your business well. At UMA Accounting, we help business owners in Calgary and across Canada stay organized and on top of their personal and corporate tax, bookkeeping, payroll and GST obligations. If you have questions about your CRA account, a suspicious notification or your filings, contact UMA Accounting at info@uma-accounting.ca or +1 (403) 438-9111. We are here to help.
Disclaimer: This article is provided for general informational purposes only and does not constitute personalized accounting, tax, financial or legal advice. Tax laws and government guidance may change, and their application depends on individual circumstances. Review current guidance from the relevant Canadian government authority or consult a qualified professional before making tax or financial decisions.
