Fake CRA Refund Messages 2026: How to Spot a Tax Scam

With the April 30 T1 deadline just passed, fraudsters know exactly when to strike. The weeks immediately after filing season are peak season for CRA impersonation scams — texts claiming you have a refund waiting, emails demanding account “verification” before release, and spoofed phone calls threatening arrest. Below are the clearest signals that a message is fake, what the real CRA will and won’t do, and how to verify your actual refund.

Don’t trust an SMS or email saying you’re owed a refund. Calculate your real refund with our refund estimator →

How to tell a genuine CRA message from a scam

• The CRA never asks for your SIN by SMS or email. Any message asking you to “confirm” your Social Insurance Number is a scam.
• The CRA never demands payment by gift cards, cryptocurrency, prepaid debit cards, or Interac e-Transfer. The e-Transfer variant is a top 2026 CRA impersonation pattern — scammers send a fake “refund deposit” link that harvests your banking credentials. Real CRA refunds arrive via direct deposit or cheque, never an e-Transfer you have to “accept.”
• Genuine CRA domains are canada.ca and cra-arc.gc.ca. Any link to cra-refund.ca, my-cra.com, canada-revenue.net, or anything else is fraudulent.
• The CRA never threatens immediate arrest, deportation, or police action for unpaid taxes. That threat is a near-universal marker of phone and SMS scams.
• Legitimate CRA communications come through your CRA My Account inbox, not unsolicited SMS or e-Transfer notifications. No inbox message means the contact is not from CRA.
• CRA agents will not ask for personal information to “verify” your account on a cold call. If CRA calls you, get their name and badge number, hang up, and call back on a published CRA number (1-800-959-8281 for individuals).

Common 2026 scam patterns

SMS and text scams

Fraudsters send texts that appear to come from a short code or a spoofed number containing “CRA” or “Revenue Canada.” The message typically includes a shortened URL or a look-alike domain (cra-refund.ca, my-cra.com, canada-revenue.net) and a line about a refund waiting for collection. Some 2026 variants ask you to reply “Y” to confirm receipt — this confirms your number is active and is used to escalate contact. Do not reply and do not click the link.

Email and phishing

Phishing emails use CRA logos, official-looking footers, and spoofed sender addresses like [email protected] (which any sender can fake). They may include a PDF attachment labelled as a T1 assessment notice — opening it runs a macro or redirects you to a fake CRA My Account login page. Branding quality has improved sharply in 2026; do not use visual polish as a trust signal.

Phone-call scams

Scammers spoof caller ID so your phone displays “CRA” or a 1-800 number. The call may be a robocall or a live agent. The script typically follows a threat-and-resolve pattern: “There is a warrant for your arrest due to unpaid taxes — press 1 to speak to a CRA agent to resolve this immediately.” CRA does not use robocalls for compliance calls and does not threaten arrest over the phone.

What the CRA will and won’t do

The CRA WILL:

• Communicate refund status through your CRA My Account inbox and the “My Benefit and Credit Payments” section.
• Allow you to call back using a published CRA number — individuals: 1-800-959-8281, businesses: 1-800-959-5525.
• Ask security questions (name, SIN, date of birth, address) only if you initiate the call to confirm you are the account holder.
• Send written notices (Notice of Assessment, letters) by mail or to your My Account inbox if you are registered for online mail.

The CRA WON’T:

• Demand payment by gift cards, cryptocurrency, prepaid cards, or Interac e-Transfer — ever.
• Threaten arrest, deportation, police action, or licence suspension in a phone call or email.
• Ask for remote-desktop access to your computer to “process” your refund or review your return.
• Request your SIN, credit card number, or banking details by SMS, email, or unsolicited phone call.

For the official summary of CRA fraud and scam guidance, see the CRA scams and fraud page.

If you’ve already clicked a link or shared details

1. Do not reply or click further links. Cut contact immediately.
2. Report it to the Canadian Anti-Fraud Centre at antifraudcentre-centreantifraude.ca or call 1-888-495-8501.
3. Report to the CRA via their report-scam page: canada.ca/en/revenue-agency/corporate/scams-fraud/report-scam.html.
4. Change your passwords on CRA My Account, your email, and online banking. Enable two-factor authentication where you have not already.
5. If your SIN was shared, contact Service Canada immediately at 1-866-274-6627 to flag your SIN and protect against identity theft.
6. Contact your bank immediately if you shared payment or banking details or clicked a link in a payment context.

Verify your real refund before trusting any message

Your real CRA refund appears in CRA My Account and is deposited on the published NETFILE timeline — typically 8 business days for direct deposit after an online filing. Confirm the amount yourself before any message arrives.

Use our refund estimator to see your real refund amount in 30 seconds — no SMS required.

---

Last verified 2026-05-01. CRA scam-warning guidance for the 2026 filing season.