Fake CRA and Revenu Québec Refund Texts: How to Spot Them Before Tax Season 2027

Why this matters before the 2027 tax season

Every winter, millions of Canadians file a tax return and then wait for money. That waiting period is exactly what scammers build their messages around. A text that says "you have a refund pending" lands on a phone that really is expecting one, and the odds of a click go up. Both the Canada Revenue Agency (CRA) and Revenu Québec publish warnings about this pattern, and the CRA's own scam-alert page was updated as recently as October 29, 2026 with a list of active fraud types.

This guide is built only from the agencies' own pages: the CRA's "Recognize a scam" and "Report a scam or identity theft" pages on canada.ca, Revenu Québec's pages on how to tell whether a communication is real and how to prevent phishing, and the Canadian Anti-Fraud Centre (CAFC) reporting page. We do not invent statistics, alerts or victim stories. Where we show an example, it is labeled as an illustrative scenario. If you are a Quebec resident, remember that you may deal with two tax agencies, one federal and one provincial, and scammers pretend to be either one.

This article is different from our other pages on the topic. If you already clicked on a text claiming to be the SAAQ, Revenu Québec or Desjardins, start with our article on fake SAAQ, Revenu Québec and Desjardins texts (French). For the Interac and SIN angle of a single fake CRA text, see our guide to the fake CRA text with a SIN and Interac refund. For parcel scams and holiday shopping traps, read the Black Friday and Cyber Monday survival guide. What you are reading now is the tax-season map: how the real agencies actually reach you, what they never do, a side-by-side table, and a full recovery plan if you already acted.

How the CRA really contacts you

The CRA says it may contact you by phone, automated message, letter or email. That list matters because it does not include text messages for anything except one narrow case. Here is each channel as the CRA describes it.

Phone and automated messages

On a live call the CRA may ask you for information to verify your identity, such as your name, date of birth or Social Insurance Number (SIN). It may also ask for details about your tax account, such as receipts, for tax returns you have not filed, or for financial information such as the name and location of your bank. If you owe a debt, the CRA may ask you to pay using its official payment options and may tell you about possible legal action to recover unpaid amounts.

The CRA can also use an automated phone system as a courtesy reminder, for example about filing a return, making quarterly instalments, or deadlines for a business with a new GST/HST account. Per the CRA, that automated system only delivers a message and does not include or ask for personal taxpayer information.

The key point: a call that matches "we need to verify who you are" can be real. A call that turns into a threat or a demand for an instant payment is not. We explain the difference in the red-flag section below.

Letters

The CRA sends letters about the same subjects as calls: identity verification, additional information it needs, unfiled returns, debts, a return under review, a notice of assessment or reassessment, or the start of an audit. The letter route is the slowest and the one scammers cannot easily imitate at scale, which is why a physical envelope is generally safer than a surprise text.

Email

The CRA says it only sends emails in three situations: you registered for email notifications and have a new message in your CRA account, you asked for a link, form or publication to be sent during a meeting or call with an agent, or you subscribed to an electronic mailing list. Emails from the CRA will not come from a specific named user, will not ask you to reply, and will not include a link asking you to enter personal or financial information.

Text and instant messages

This is the channel to remember. The CRA states that it only sends text messages for multi-factor authentication to its sign-in services, and only if you enrolled with the telephone option. It does not use text messaging or instant messaging apps such as Facebook Messenger or WhatsApp. So a text that says you have a refund waiting, a benefit to claim, or an error to fix is not a CRA communication, no matter how official the logo looks.

How Revenu Québec really contacts you

Revenu Québec lists, on its page "Comment savoir si une communication provient réellement de Revenu Québec?" (last updated September 28, 2026), what it never does. This is the most useful single page for Quebec residents, so we summarize it closely.

• Payment and refund notices. Revenu Québec never tells you by email or text that a payment was made to you, that a refund is owed, or that a transfer was made.
• Changes to your file. It never describes by email or text the nature of a change made to your file or the details of a document filed in your file.
• Missing return. It never tells you by email or text that it did not receive your income tax return.
• Personal information. It never asks by email or text for your SIN (NAS), banking information, a password or passphrase, a confidential code or any other personal information.
• Voicemail. It never leaves a voicemail containing confidential information.
• Online-only documents. It never sends you documents online only unless it first obtained your consent. By default, documents come by mail.

Revenu Québec also explains what it can do. Depending on your choices, you may receive an alert by email or text (or both) if something happens in your file and you accepted the updated terms of use of Mon dossier pour les citoyens, registered for the alert service, asked for alerts through customer service, or ticked box 10.3, 10.4 or 10.5 on your return. If you have an active collection file, it may phone you on behalf of the Government of Quebec and the agency lists the official numbers you can safely call back when a voicemail was left. At your request, it can send an access code by text or automated call to use Mon dossier through a sign-in partner, a verification code by email to validate your email address, or documents through a secure email service. Everything on that list happens because you asked or because you already have a file in progress.

One more detail from Revenu Québec's alert-service page, as shown in its search listing: its emails and texts never contain hyperlinks. We could not load the full page text on the day we checked, so treat that sentence as reported from the listing, and confirm it on the agency's page. It matches the agency's own prevention page, which suggests asking yourself whether you received "a text from Revenu Québec containing a clickable hyperlink" as part of deciding whether a message is genuine.

The fake messages the CRA itself is warning about

The CRA's "Recognize a scam" page lists active scam types and says what to do for each. We grouped them by how they reach you. Everything below is paraphrased from the CRA page as it stood on November 5, 2026. We are not adding our own alerts: if a scheme is not on the CRA or Revenu Québec pages, we do not claim it is circulating right now.

Refund and credit lures (text, email, phone)

• Fake refund or credit. A message claims the CRA owes you a refund, with a fake CRA email address or phone number. You are told to click a link and supply your SIN, date of birth, name, or online banking details so you can "accept the refund by e-transfer". The CRA will not send refunds or payments by e-transfer or text message.
• GST/HST credit. A text or email offers a GST/HST refund or credit and asks you to reply or click a link to complete an application with an urgent deadline.
• Fake Interac e-transfer deposit. A text with an image carrying the Government of Canada logo offers an Interac e-transfer deposit. A second text follows, with a link to a realistic copy of a financial institution's sign-in page.
• "Reply Y" or "reply HELP" texts. One fraudulent text refers to a line on your latest assessment and asks you to reply "Y". Another says there is an error on your account and asks you to text back "HELP". The first then sends a fake CPP-related link leading to imitation CRA and banking sites.
• Carbon rebate and benefit codes. Messages with a link to the Canada Carbon Rebate, or about credits such as the home accessibility tax credit, disability tax credit, multigenerational home renovation tax credit or Old Age Security pension, may include a link and a code. The CRA says it does not send texts or emails about benefits or credits with links to click.

"Your return has a problem" emails

• Revised notice of assessment. Emails say your return has errors and tell you to download a "revised notice of assessment" quickly, claiming it is not available in My Account. The CRA says to view your information in your CRA account instead, and warns that clicking may download malicious software.
• Tax return document to review. An email says a tax return document is waiting behind a button or link. The CRA notifies you by email when something is available in My Account, and those emails do not contain a link asking you to fill in an online form with personal or financial details.
• EFILE fake sign-in (for preparers). Tax preparers receive messages asking them to sign "conditions" to keep their EFILE accounts, leading to a copy of the EFILE sign-in page. The CRA says to reach EFILE only from official canada.ca pages.

Account takeover and identity theft

• Email bombing. If criminals have a reused or breached password, they log in, change something on your account, then flood your inbox with unwanted email to bury the real notification about the change. The CRA suggests signing in to your CRA account to check for mail and changing passwords regularly.
• Fake returns in your name. Scammers who have your personal information can file a fake return. The CRA lists warning signs: a change on your account, an email saying your account was modified, a delay in receiving credits or refunds, or difficulty filing online.

Phone threats and payment demands

• Spoofed calls. Callers claiming to be the CRA demand payment or information and may spoof a local number, an official police number or even the CRA's own number. The advice: do not provide information, hang up and contact the CRA directly.
• Arrest-warrant and cryptocurrency scripts. One described scheme has a "CRA agent" demand cryptocurrency to cancel an RCMP arrest warrant, then a "police officer" calls back with instructions to deposit money into a cryptocurrency terminal. The CRA says it does not threaten arrest, deportation or prison and does not demand payment in cryptocurrency, prepaid cards or gift cards.

Aimed at specific groups

• Seniors. A scam claims the CRA is sending extra payments to low-income seniors, with websites linking to Telegram or WhatsApp groups.
• Benefit disinformation. Websites claim that new payments exist. The CRA specifically says there is no new $2,000 direct-deposit relief payment, no $680 rent support, no $533 inflation relief and no $3,900 one-time payment. The CRA also notes the Grocery Rebate was a one-time payment in July 2023, and that the new Canada Groceries and Essentials Benefit is described as building on the GST credit, with eligible recipients not needing to apply but needing to have filed their returns.
• Recovery scams. People who already lost money get contacted by "recovery" services that demand a fee first. See our page on the fake anti-fraud centre recovery scam (French).

Real versus fake: side-by-side table

Use this table when something lands on your phone. It only contains behaviours the CRA or Revenu Québec describe on their own pages.

Notice the pattern: the real agencies tell you something is waiting and ask you to go to the account yourself. The fakes put the action inside the message.

Red-flag checklist: ten seconds before you tap

Revenu Québec suggests four reflexes before acting on any odd message: verify that the request is authentic, do not act immediately, do not disclose personal information, and check whether the communication really comes from the agency. The checklist below turns that advice and the CRA's warning signs into something you can run through quickly. If you tick even one box, stop.

What to do with a message that fails the checklist, per the agencies: do not click any link, do not open any attachment, do not reply, and do not call a phone number you cannot verify. Then report it (see the reporting section) and delete it.

Fake websites that look real

The CRA warns that fake sites can be very convincing and that checking the web address is the quickest test. Its page gives concrete examples of look-alike addresses: extra words (such as "cra-login-canada.com" or "cra-account-notice.info"), unusual endings (.info, .su, .com), or extra characters and odd abbreviations ("crra", "c-ra", "revagency"). Some fake addresses rearrange letters slightly, hoping you will not notice.

The official CRA website uses addresses that either start with canada.ca or end with cra-arc.gc.ca. The dot before ".ca" or ".gc.ca" matters: the CRA says scammers have tried hyphens instead, such as "-gc-ca". Short official addresses such as canada.ca/myaccount and canada.ca/cra-scam-alert also start with canada.ca. National police, crime-reporting and cybersecurity resources (rcmp.ca, antifraudcentre.ca, getcybersafe.ca, reportcyberandfraud.canada.ca, cybertip.ca) have their own addresses. Government websites do not contain non-government advertisements, so a sign-in page surrounded by ads is a warning sign.

The safest habit: type the address yourself

The CRA's advice is simple: type the official address directly into your browser rather than clicking a link in a text or email, and bookmark the official pages you use. The same goes for Mon dossier at revenuquebec.ca. A bookmark you created yourself is safer than any link someone sends you, because a link is a one-way trip to wherever the sender wants.

Also keep in mind that QR codes can hide the address entirely. If a letter, flyer or sticker asks you to scan a code to "claim a refund", read our explainer on QR code phishing.

Using My Account and Mon dossier as your source of truth

If a message claims something changed in your tax file, the safest answer is to check the account yourself. The CRA says you can verify what you hear by registering for a CRA account, using its secure channels, or contacting it directly. For notices of assessment, the CRA's scam alert tells you to look in your CRA account rather than download anything from an email. At Revenu Québec, Mon dossier pour les citoyens is the equivalent portal, and the agency's own checklist for suspicious messages starts with whether you are registered to it and whether your email address and cell number in your profile are current.

Why keeping your contact details up to date helps

Revenu Québec's alert service sends email or text only to people who opted in or whose profile meets the conditions listed above. If you have never signed up, any "alert" you receive that claims a refund or payment is automatically suspect, because that is something the agency says it never does by email or text. If you have signed up, you will recognize the alert style. Either way, you can log in yourself to confirm.

Protecting the account itself

The CRA lists a "keep your CRA account secure" page and warns about credential reuse: criminals test passwords stolen from other sites. Practical steps that follow from that:

• Use a unique password for each tax portal. A password manager makes this realistic; see our password manager guide.
• Turn on multi-factor authentication where the portal offers it. The CRA does send text codes for its own sign-in services if you chose the telephone option, so a code you requested is normal. A code you did not request means someone is trying to get into your account. Our MFA guide explains the options, and our passkeys guide covers the passwordless route.
• Never give a code to anyone who contacts you. A caller who asks you to read back a code you just received is trying to log in as you.
• Check your account regularly during tax season, especially for changes to banking, address or contact information, since those are the changes the CRA tells you to report if you did not make them.

How refund and direct deposit notices really work

Scam texts rely on a vague idea of how refunds arrive. Here is what the agencies say, and where we have to be careful about what we can and cannot claim.

• Not by text or e-transfer. The CRA states it will not send refunds or payments by e-transfer or text message. Revenu Québec states it never notifies you by email or text that a refund is owed or that a transfer was made.
• Information lives in your account. You can view your personal income tax and benefit information, mail, notices and statements in your CRA account. The same logic applies to Mon dossier at Revenu Québec.
• Banking changes are a red flag trigger. Revenu Québec's checklist asks whether you recently changed your banking details, and the CRA lists unauthorized changes to banking, address, business or personal information as a reason to contact it. If a refund is "delayed" and you did not change anything, check your account for unauthorized changes before assuming the delay is innocent. The CRA lists a delay in receiving credits or refunds among the warning signs of identity theft.

We did not manage to open the CRA's direct deposit page on the day we wrote this, so we are not describing the setup steps in detail. Set up or change direct deposit only inside your account or in your tax software, never by following a message or a caller. When timing is uncertain, check the current processing times on the agency's own pages rather than trusting a number from a message.

I clicked, paid or gave my SIN: what to do, step by step

First, breathe. Being fooled is common, because these messages are designed by people who do it for a living, and the CRA itself says generative AI makes scam messages more convincing. What matters now is speed and order. The steps below combine the CRA's and Revenu Québec's reporting guidance with standard account-protection steps. Pick the section that matches what happened, and do the steps in order.

Scenario A: you only clicked a link (nothing typed)

1. Close the page. Do not enter anything on a second prompt.
2. Run a security scan on the phone or computer. If a file was downloaded (the CRA warns the fake "revised notice" email may deliver malicious software), do not open it, and delete it. If the device behaves strangely afterwards, see our guide to signs your device or business was hacked.
3. Change the password of any account you were already signed in to on that device, starting with email and banking.
4. Report the message (see "Where to report" below). Clicking alone is still worth reporting, because the CRA says to report attempts even when you gave nothing.

Scenario B: you typed a password or banking sign-in on a fake page

1. Call your bank or credit card issuer right away using the number on the back of your card or the bank's official app, not a number from the message. Ask them to lock or monitor the account and cards and to reverse any pending transfers they can.
2. Change the password of that account from a clean device. If you reuse that password anywhere else, change it there too. This is exactly the credential reuse the CRA describes.
3. Turn on multi-factor authentication where it is missing.
4. If you typed your CRA or Revenu Québec credentials, sign in at the official site by typing the address yourself, change the password, and check for changes to banking, address and contact information. Contact the agency (see below) to have protections placed on your account.

Scenario C: you gave your SIN (NAS) or other identity details

1. Contact the CRA. The CRA's page says you should contact it if you suspect your account was compromised, notice unauthorized changes, see a benefit application made without your consent, or want to disable online access. You can submit its online form, call, call the automated line, or fax Form RC213. For personal accounts the phone line listed is 1-833-995-2336 (Monday to Friday, 8:00 am to 4:00 pm local time; TTY 1-800-267-7622). For business accounts it is 1-800-959-5525. The CRA says protections can be placed on your account immediately during a call, and that a designated officer will contact you within 14 business days after an online, automated-line or fax submission. Confirm the numbers on canada.ca before dialing.
2. Contact Revenu Québec. Its page says to reach the agency quickly if you think you were a victim of phishing or identity theft so it can add protection measures, and to report the situation to the Canadian Anti-Fraud Centre as well. It points to a dedicated "signaler une tentative d'hameçonnage ou un vol d'identité" page on its site.
3. Report SIN misuse to Service Canada if you suspect or know someone is using your SIN: 1-866-274-6627, per the CRA page.
4. Call the two credit bureaus, Equifax and TransUnion. The CRA tells victims to contact credit reporting agencies such as Equifax or TransUnion. Ask what protection options they offer (such as a fraud alert or file monitoring), review your credit report for accounts you do not recognize, and keep notes of each call. Go to their official sites, equifax.ca and transunion.ca, because options and fees change.
5. Tell your bank, even if no money moved yet, because SIN plus date of birth plus address is enough for someone to try to open accounts or take over yours.
6. File a police report with your local police and keep the report number. The CAFC says victims should contact their local police as soon as possible.
7. Report to the CAFC online at reportcyberandfraud.canada.ca (anonymous reporting is possible) or by phone at 1-888-495-8501, Monday to Friday 10 am to 4:45 pm Eastern. Its page states that local police investigate while the CAFC keeps a central repository of information to assist investigations.
8. Change passwords for email first (it is the key to resetting everything else), then banking, then government portals, then everything else, using a password manager.

For a longer recovery plan with documents to gather and Quebec-specific bodies, see our guide to identity theft recovery in Quebec (French) and the English identity theft recovery guide.

Scenario D: you paid money

1. Call your bank or payment provider immediately. If you paid by Interac e-transfer, ask whether the transfer can be stopped or flagged. Speed matters, and results are not guaranteed.
2. If you bought gift cards, keep the cards and receipts and contact the card issuer.
3. If you sent cryptocurrency, note every address and transaction ID. See our crypto scam recovery article (French) for realistic expectations.
4. File the police and CAFC reports above.
5. Beware of recovery offers. The CRA warns that messages targeting people who already lost money promise to help recover it but really aim to steal more, usually by asking for a deposit or information first. Do not pay any fee to get your money back.

Our page on the fake e-transfer confirmation email shows how the other half of the Interac trick works, and it is useful if the scammers posed as a bank rather than the CRA.

Three illustrative scenarios (not real cases)

These are made-up examples to show how the checklist plays out. Names, amounts and timing are invented.

Illustrative scenario 1: the March text

"Marc" filed his return in late February and keeps checking his bank for the refund. On a Tuesday evening he gets a text with a government-style logo: "Refund of $412.50 approved, accept within 24 hours". He taps. A page that looks like his bank asks for his online banking sign-in. Nothing in the message passes the test: it is a text, it promises a refund, it carries a link and a deadline. The agencies say refunds are not sent by text or e-transfer. If Marc had closed the page, he would have lost nothing. Instead he typed his sign-in, so he follows Scenario B within minutes and his bank blocks the attempted transfer.

Illustrative scenario 2: the voicemail

"Nadia", 71, hears a voicemail: "This is the tax office, a warrant has been issued, press 1". She presses 1 and a man tells her to pay by buying gift cards. The CRA says it does not threaten arrest or ask for gift cards. Nadia hangs up. Her daughter looks up the CRA's contact page and calls the agency with the number printed there. The daughter also asks Nadia to share any similar call with her, which is the single most protective habit discussed in the seniors section below.

Illustrative scenario 3: the "revised notice" email

A freelance designer gets an email saying her return has errors and a "revised notice of assessment" must be downloaded within hours. She recognizes the pattern from the CRA's scam list, signs in to My Account by typing the address herself, sees no changes, and reports the email through reportcyberandfraud.canada.ca. Total time lost: five minutes.

Protecting seniors and relatives

The CRA specifically lists a scam aimed at seniors that claims extra payments are going to low-income older adults, with websites pointing to Telegram or WhatsApp groups. Phone threats are also a common route to older relatives. A few practices work better than lectures.

• Agree on a family rule once, calmly: "No government agency will ever ask you to act on a text. If it mentions money, you show me or call me before doing anything."
• Write the official numbers on a card next to the phone, taken from canada.ca and revenuquebec.ca, so a caller's "callback number" is never the only option.
• Hang up is a complete answer. The agencies advise ending a suspicious call and then finding an official number yourself. Practice the phrase "I will call you back on the official number."
• No shame. People who feel embarrassed hide the mistake for days. Say clearly that a quick report matters more than how it happened.
• Voice cloning: a call that sounds like a relative asking for money is a separate risk; see our guide on AI voice cloning scams and, for Quebec families, the French article on voix clonée et arnaques familiales.
• Help with the account. Offer to set up My Account or Mon dossier together, update the contact details and, if the person wants it, authorize a trusted representative through the official process. Revenu Québec points to an "Autorisation ou procuration" page for this. Do not share passwords by text.

For ongoing help at home, our senior computer security article (French) covers wider habits, and IT Cares offers remote support for relatives who prefer to talk to a person.

The small-business angle

Business owners face the same lures plus a few of their own. The CRA's alert list includes an EFILE sign-in lure aimed at tax preparers and discounters, and the CRA has separate business-account contact lines for reporting identity theft (the business line is listed as 1-800-959-5525). A few specifics for a small company or a self-employed worker:

• Payroll and GST/HST accounts matter. The CRA notes it notifies businesses about GST/HST registration reviews and may use automated reminder calls for new GST/HST accounts. Those reminders do not ask for personal taxpayer information. A "GST/HST audit" call that asks for a card number is not the CRA.
• Separate who can log in. If your bookkeeper or accountant has access, make sure each person uses their own credentials and that access is removed when they leave.
• Email is the weak point. A business email takeover often starts with a fake notice. Read our guides on business email compromise and, in French, la fraude par courriel (BEC) pour les PME.
• Train the person who opens the mail. Whoever handles the shared inbox should know the three rules: no links for refunds, no codes shared, call back on an official number.
• Quebec privacy law. If a phishing incident exposes customer or employee personal information, you may have obligations under Quebec's privacy law (Law 25). Write down what happened and when, and check the incident requirements on the Commission d'accès à l'information website. We do not give legal advice here.
• Keep a verified contact sheet for the CRA business line, Revenu Québec and your accountant, so a rushed employee does not search for a number in the middle of a scam call.

Tax season 2027: what to expect and what to do now

We did not find a dated November 2026 alert from the CRA, Revenu Québec or the CAFC announcing a specific new campaign, and we are not going to invent one. What we can say, from the agencies' pages, is that the CRA's list of active scam types was last modified on October 29, 2026, and that the patterns on it (refund lures, credit lures, fake notices of assessment, spoofed calls) are the same ones to expect when returns are being filed. Filing dates for the 2026 tax year are published by the CRA and Revenu Québec, so check their pages for exact opening and deadline dates rather than relying on a message that mentions one.

Remember that scammers do not need a tax message at all. Fake delivery texts and parcel notices get more common as the holidays approach; our guide on fake delivery text scams covers that side, and our overview of smishing explains why text messages are such a popular channel. For AI-written email lures that avoid the old typo giveaways, see how to spot AI-generated phishing emails. The CRA itself says scams may contain typos and fuzzy logos but that generative AI lets scammers produce more realistic copies, so a clean-looking message proves nothing.

What it costs: DIY versus paying for help

Everything in the steps above is free to do yourself. Reporting to the CRA, Revenu Québec, Service Canada, the CAFC and the police costs nothing. Contacting the credit bureaus: ask what each option costs before agreeing, since the plans and fees are theirs to set. The real cost is time and, if you sent money, the amount lost, which is why the first call to the bank matters more than any tool.

If you want a technician to go through your devices and accounts with you, IT Cares offers a single 119.99$ CAD, 60-minute Expert Consultation by remote session.

Official resources and where to report

• CRA: "Recognize a scam" and "Report a scam or identity theft" on canada.ca (see sources below). Personal account line 1-833-995-2336.
• Revenu Québec: pages on how to know whether a communication is genuine, how to prevent phishing and identity theft, and what to do if you were a victim.
• Canadian Anti-Fraud Centre: reportcyberandfraud.canada.ca, or 1-888-495-8501.
• Service Canada (SIN misuse): 1-866-274-6627.
• Your local police for any fraud where you lost money or identity information.
• Credit bureaus: equifax.ca and transunion.ca.

When to call a pro

You can handle most of this alone. Call us if you entered a password on a fake page and are not sure which accounts share it, if a device is acting strangely after a click or download, if a parent's phone or email seems taken over, or if you simply want someone to check your setup before tax season. We work remotely across Canada and on site in Quebec, and we will not ask for your SIN, banking details or tax information. Our line is 1 (888) 711-9428.

Frequently asked questions

Related guides

• Fake CRA text scam with SIN and Interac refund
• Faux textos SAAQ, Revenu Québec et Desjardins: j'ai cliqué (FR)
• Black Friday and Cyber Monday scams survival guide
• Identity theft recovery guide
• What is smishing (SMS phishing)
• Fake delivery text scam: what to do
• MFA guide for business owners
• Business email compromise: protect your small business

Sources and official references

Last verified: November 5, 2026

• CRA: Scams and fraud, Recognize a scam (opened 2026-11-05, page modified 2026-10-29)
• CRA: Report a scam or identity theft (opened 2026-11-05, modified 2026-03-20)
• CRA: Scams and fraud overview (opened 2026-11-05)
• Revenu Québec: Comment savoir si une communication provient réellement de Revenu Québec? (opened 2026-11-05, updated 2026-09-28)
• Revenu Québec: Comment prévenir l'hameçonnage et le vol d'identité? (opened 2026-11-05)
• Revenu Québec: Que faire en cas d'hameçonnage ou de vol d'identité? (opened 2026-11-05)
• Canadian Anti-Fraud Centre: Report fraud and cybercrime (opened 2026-11-05, modified 2025-11-27)