Short answer: If a text, email or call claims to be from the Canada Revenue Agency and offers a refund by Interac e-transfer, says your SIN is suspended, or threatens arrest unless you pay now, treat it as a scam. According to the CRA's "Recognize a scam" page (checked October 25, 2026), the CRA will never send refunds or payments by e-transfer or text message, never threaten arrest, and never ask for your SIN or personal details by text. Do not tap the link. Check your CRA account by typing the official address yourself.
Last reviewed: October 25, 2026.
Key takeaways
- The CRA says it will never send refunds or payments by e-transfer or text message, so any "Interac refund" message is fake.
- The CRA says it only texts for multi-factor authentication, and only if you chose the telephone option. It does not use text or instant messaging apps for anything else.
- A real CRA contact never threatens arrest, deportation or jail, and never demands e-transfer, crypto, prepaid cards or gift cards.
- If you clicked, paid or shared your SIN, act in order: your bank, the police, the CRA, then the Canadian Anti-Fraud Centre (CAFC), and the credit bureaus as soon as your SIN is involved.
- Scammers lean on older relatives. A short family rule ("we never act on a text from the government") works better than a long lecture.
What the fake CRA message usually looks like
These scams come in three common forms. The wording changes, but the pattern does not: urgency, a link or a phone number, and a request for money or personal details.
1. The "refund by Interac e-transfer" text
You get a text saying the CRA owes you a refund and you must "accept" it through a link. The link opens a page that looks like a bank or CRA login and asks for your online banking credentials, a card number or your SIN. The goal is to steal your login, not to pay you.
2. The "your SIN is suspended" call or text
A recorded voice or a message says your Social Insurance Number has been suspended, blocked or linked to a crime. You are told to press a key or call back to "fix" it. The CRA does not work this way. The goal is to get your SIN, your date of birth and often a payment.
3. The "pay now or be arrested" call
A caller claims to be a CRA officer, says you owe back taxes and threatens arrest, a lawsuit or deportation. Payment is demanded by e-transfer, cryptocurrency, prepaid cards or gift cards. The CRA states it does none of this.
This guide is about the CRA specifically. For the general concept, see our explainer on what smishing (SMS phishing) is. For a different Interac-themed trick, a fake payment confirmation sent by email, see our guide to fake e-transfer confirmation emails.
What the CRA says it will and will not do
Everything in this section comes from the CRA's "Recognize a scam" page on canada.ca, which we checked on October 25, 2026. Check that page for the current version, because it can change.
| Channel | What the CRA says it does |
|---|---|
| Text | Only sends texts for multi-factor authentication, and only if you chose the telephone option. It says it will not use text messages or instant messaging such as Facebook Messenger or WhatsApp. |
| Emails only if you registered for email notifications and have a new message in your CRA account, or if you asked for a form or link during a call or meeting with an agent. | |
| Phone | May call. Automated messages are courtesy reminders only, such as filing deadlines or instalments, and do not ask for personal taxpayer information. |
| Letter | May write about information requests, reviews, assessments or audits. |
The CRA will never
- Send refunds or payments by e-transfer or text message.
- Provide or accept payments in cryptocurrency.
- Demand immediate payment through e-transfer, cryptocurrency, prepaid cards or gift cards.
- Threaten arrest, deportation or imprisonment, or use aggressive language.
- Arrange an in-person meeting in a public place to collect a payment.
- Charge a fee to speak with a call centre agent.
- Ask for your SIN or other personal details by text.
Red flags: real versus fake in two minutes
The CRA page lists these warning signs. Use them as a checklist when a message lands.
- A request to reply "HELP". The CRA lists a text that asks you to reply "HELP" as a red flag.
- The web address. A real CRA address starts with canada.ca or ends in cra-arc.gc.ca. Extra words, unusual endings or misspellings are a warning sign.
- Urgency. Tight deadlines, unexpected refunds and arrest warnings are all listed red flags.
- A phone number that looks official. The CRA warns that numbers can be spoofed to look legitimate. Caller ID is not proof.
The CRA's own advice when unsure: hang up and contact the CRA directly using an official number, or type the official web address yourself.
What to do right now, step by step
If you only received the message
- Do not tap links, do not call the number in the message and do not reply, even with "STOP" or "HELP".
- Open a new browser tab and type the CRA address yourself. Sign in to your CRA account and check your messages and refund status there.
- Delete the message. If you want to report it, use the steps in the reporting section below.
Not sure what is wrong? Get a diagnosis first.
Our certified tech can connect remotely, check your software, drivers and backups, and tell you honestly whether the problem needs a hands-on repair.
If you clicked a link but entered nothing
- Close the page. Do not enter anything if it is still open.
- Update your phone or computer, and run a scan with the security tool you already trust. If you are unsure whether anything was installed, get help checking the device before you log in to banking again.
- Change passwords for your email and banking from a different, trusted device if you have any doubt.
If you entered banking details, a card number or a password
- Call your bank or card issuer right away using the number on the back of your card or on the official bank site. Say that you entered details on a fake site.
- Change the online banking password and the email password linked to the account.
- Review recent transactions and set up account alerts.
If you paid money (e-transfer, crypto, gift cards, prepaid cards)
- Contact your bank or the card or gift card provider immediately. Ask what can be done. Speed matters, and recovery is never guaranteed.
- File a police report with your local police.
- Report to the CRA first, then to the CAFC (see below).
- Keep records: the message, phone numbers, screenshots, transaction details.
If you gave your SIN
These steps follow Service Canada's page "Social Insurance Number fraud and data breach" on canada.ca (page dated May 13, 2026).
- File a police report. Keep the case reference number and the officer's name and phone number, and ask for a copy. The report must include your name and either your full SIN or its last three digits.
- Report to the Canadian Anti-Fraud Centre through its website or by phone.
- Contact TransUnion Canada and Equifax Canada and add a fraud alert to your file if you have not already. Service Canada notes a fraud alert may involve a fee, and that it tells creditors to contact you before opening new accounts in your name.
- Contact each creditor about unauthorized activity. Ask them to close accounts you did not open and decline applications you did not make.
- Tell your financial institutions if your credit reports show suspicious activity.
- Report suspicious mail activity to Canada Post.
- If your SIN was used to get government money, such as Employment Insurance, report it directly to that program.
Should you ask for a new SIN?
Service Canada does not recommend it. According to that page, having multiple SINs can increase fraud risk, a new SIN does not erase or protect your old one, and the SIN Program will not issue one without proof that your SIN was used to commit fraud. You apply in person at a Service Canada Centre. You also do not have to report SIN fraud to the SIN Program itself.
For a broader recovery plan, see our identity theft recovery guide.
How to report a fake CRA message
The CRA's "Report a scam or identity theft" page (dated March 20, 2026) says that depending on what was taken or given, you should report to the right authorities, such as your financial institution, credit reporting agencies like Equifax or TransUnion, and your local police. It also says to notify the Canadian Anti-Fraud Centre after reporting to the CRA.
- CRA: the page offers an online form (a designated CRA officer will contact you within 14 business days, according to the page), plus phone lines for personal, business and trust accounts. Find the current numbers on that page rather than from a message you received.
- CAFC: report online at reportcyberandfraud.canada.ca. Check the CAFC site for its current reporting options.
- The CRA page says that if someone tried to scam you but you gave no personal information, you should still report it.
Official pages: CRA: Recognize a scam, CRA: Report a scam or identity theft, Service Canada: SIN fraud and data breach, Canadian Anti-Fraud Centre: Report.
Protecting older relatives
Scammers often target seniors because a threat from "the government" feels serious. Practical steps that help:
- Agree on one simple rule: "The government will never ask me to pay or share my SIN by text or phone. If someone does, I hang up and call you."
- Write the rule down next to the phone, with the real CRA contact page address (type it, do not search for a number in a message).
- Make it safe to tell. People hide scams out of embarrassment. Say clearly that anyone can be fooled and that speed matters more than blame.
- Help set up their CRA account so they can check messages and refund status themselves, which removes the need to trust a text.
- Ask their bank what alerts and limits can be set on e-transfers and large withdrawals.
- Be present for the first call. If they paid or shared a SIN, walk through the SIN steps above together.
Phone scams that use cloned voices add another layer. See our note on AI voice cloning scams. If someone pretending to be tech support asked to connect to the computer, read tech support scam warning signs.
Common mistakes
- Calling the number in the message to "verify" it.
- Replying "STOP", which can confirm your number is active.
- Trusting caller ID, since the CRA warns numbers may be spoofed.
- Waiting a day to call the bank after entering details.
- Skipping the credit bureaus after sharing a SIN.
- Searching for a "CRA phone number" and clicking an ad. Type the canada.ca address instead.
Readers in the US and UK
The same script is used with other tax agencies. In the UK, HMRC's guidance on gov.uk says to send suspicious texts to 60599 or email phishing@hmrc.gov.uk, and not to open links or reply to a text offering a tax refund in exchange for personal or financial details (checked October 25, 2026; network charges may apply to the text). In the US, we could not verify an IRS reporting page on October 25, 2026, so we are not linking one. Type the IRS web address yourself and look for its scam reporting page rather than using a link from a message.
Need a second pair of eyes?
If you clicked a link on a phone or computer and want the device checked, our technicians can walk through it with you remotely. See remote repair or Windows support. We never ask for banking passwords or your SIN.
Frequently asked questions
Does the CRA send refunds by Interac e-transfer?
No. The CRA's "Recognize a scam" page says it will never send refunds or payments by e-transfer or text message.
Does the CRA ever send text messages?
Per the CRA, only for multi-factor authentication, and only if you chose the telephone option. It says it will not use text messages or instant messaging such as Facebook Messenger or WhatsApp.
Can the CRA suspend my SIN?
The CRA page lists asking for your SIN by text and threatening language as scam signs. A message saying your SIN is "suspended" and asking you to act is a red flag. Check your CRA account by typing the address yourself.
Will the CRA have me arrested if I do not pay immediately?
The CRA says it will never threaten arrest, deportation or imprisonment, or use aggressive language, and never demands immediate payment by e-transfer, crypto, prepaid cards or gift cards.
I entered my SIN on a fake site. What now?
Follow the SIN steps above: police report, CAFC, TransUnion and Equifax fraud alerts, creditors and your financial institutions. Service Canada does not recommend getting a new SIN in most cases.
Should I report a scam if I did not lose money?
Yes. The CRA page says that if someone attempted to scam you but you did not give personal information, you should still report it, and the CAFC says the same.
How can I be sure a CRA message is real?
Do not use the link or number in it. Sign in to your CRA account by typing the official address, or contact the CRA using an official number from canada.ca.