Fake CRA Refund Messages 2026: How to Spot a Tax Scam

With the April 30 T1 deadline just passed, fraudsters know exactly when to strike. The weeks immediately after filing season are peak season for CRA impersonation scams — texts claiming you have a refund waiting, emails demanding account “verification” before release, and spoofed phone calls threatening arrest. Below are the clearest signals that a message is fake, what the real CRA will and won’t do, and how to verify your actual refund.

Don’t trust an SMS or email saying you’re owed a refund. Calculate your real refund with our refund estimator →

How to tell a genuine CRA message from a scam

• The CRA will not ask for personal or financial information in a text, voicemail or email, and it only sends text messages for multi-factor authentication if you enrolled with the telephone option. Any message asking you to “confirm” your Social Insurance Number is a scam.
• The CRA never demands payment by gift cards, cryptocurrency, prepaid debit cards, or Interac e-Transfer. The e-Transfer variant is a top 2026 CRA impersonation pattern — scammers send a fake “refund deposit” link that harvests your banking credentials. Real CRA refunds arrive via direct deposit or cheque, never an e-Transfer you have to “accept.”
• Genuine CRA domains are canada.ca and cra-arc.gc.ca. Any link to cra-refund.ca, my-cra.com, canada-revenue.net, or anything else is fraudulent.
• The CRA never threatens immediate arrest, deportation, or police action for unpaid taxes. That threat is a near-universal marker of phone and SMS scams.
• Legitimate CRA communications arrive by phone, automated message, letter or email, and the CRA sends an email when something is available in your CRA My Account. Those emails do not contain a link asking you to fill in an online form with personal or financial details. If a message claims to be from the CRA, check My Account yourself instead of using the link.
• The CRA may ask for identity details on a phone call, so a request alone does not prove a call is fake or real. If a call worries you, get the caller’s name and phone number, hang up, and call back on a published CRA number (1-800-959-8281 for individuals).

Common 2026 scam patterns

SMS and text scams

Fraudsters send texts that appear to come from a short code or a spoofed number containing “CRA” or “Revenue Canada.” The message typically includes a shortened URL or a look-alike domain (cra-refund.ca, my-cra.com, canada-revenue.net) and a line about a refund waiting for collection. Some 2026 variants ask you to reply “Y” to confirm receipt — this confirms your number is active and is used to escalate contact. Do not reply and do not click the link.

Email and phishing

Phishing emails use CRA logos, official-looking footers, and spoofed sender addresses like [email protected] (which any sender can fake). They may include a PDF attachment labelled as a T1 assessment notice — opening it runs a macro or redirects you to a fake CRA My Account login page. Branding quality has improved sharply in 2026; do not use visual polish as a trust signal.

Phone-call scams

Scammers spoof caller ID so your phone displays “CRA” or a 1-800 number. The call may be an automated message or a live agent. The script typically follows a threat-and-resolve pattern: “There is a warrant for your arrest due to unpaid taxes — press 1 to speak to a CRA agent to resolve this immediately.” The CRA does use automated phone messages, but only as courtesy reminders (for example about filing, or quarterly instalments), and they do not ask for personal taxpayer information. The CRA will not threaten to arrest or deport you.

What the CRA will and won’t do

The CRA WILL:

• Communicate refund status through your CRA My Account inbox and the “My Benefit and Credit Payments” section.
• Allow you to call back using a published CRA number — individuals: 1-800-959-8281, businesses: 1-800-959-5525.
• Ask for identity details such as your name, date of birth or SIN on a phone call, to verify who you are.
• Send written notices (Notice of Assessment, letters) by mail or to your My Account inbox if you are registered for online mail.

The CRA WON’T:

• Demand payment by gift cards, cryptocurrency, prepaid cards, or Interac e-Transfer — ever.
• Threaten arrest, deportation, police action, or licence suspension in a phone call or email.
• Ask for remote-desktop access to your computer to “process” your refund or review your return.
• Ask for personal or financial information in a voicemail or email, or send you a text or instant message with a link asking for it.

For the official summary of CRA fraud and scam guidance, see the CRA scams and fraud page.

If you’ve already clicked a link or shared details

1. Do not reply or click further links. Cut contact immediately.
2. Report it to the Canadian Anti-Fraud Centre at antifraudcentre-centreantifraude.ca or call 1-888-495-8501.
3. Report to the CRA via their report-scam page: canada.ca/en/revenue-agency/corporate/scams-fraud/report-scam.html.
4. Change your passwords on CRA My Account, your email, and online banking. Enable two-factor authentication where you have not already.
5. If your SIN was shared, contact Service Canada immediately at 1-866-274-6627 to flag your SIN and protect against identity theft.
6. Contact your bank immediately if you shared payment or banking details or clicked a link in a payment context.

Verify your real refund before trusting any message

Your real CRA refund appears in CRA My Account and is deposited on the published NETFILE timeline — you can receive a refund in as little as eight business days with direct deposit after an online filing. Confirm the amount yourself before any message arrives.

Use our refund estimator to see your real refund amount in 30 seconds — no SMS required.

---

Last verified 2026-05-01. CRA scam-warning guidance for the 2026 filing season.