CRA is warning Canadians about a new wave of fake tax refund texts — here's how to protect yourself

The messages can look very convincing. Some display the CRA name, reference a refund amount and include a link to what appears to be a government login page. But if you click the link and enter your information, scammers can gain access to your banking credentials, social insurance number (SIN) and other sensitive personal information, potentially setting off months or even years of financial headaches.

The CRA has been very clear about one thing: it does not send text messages or emails asking Canadians to click a link to collect a refund. If you receive one of these messages, it's a scam.

What the fake CRA text looks like

The new messages typically impersonate the CRA and claim you have an unprocessed tax refund. They will include an urgent call to action and encourage you to "click now" to verify your identity or lose your refund, along with a link to a spoofed website that mimics the government's official My Account portal.

The websites can be sophisticated, mirroring CRA branding closely enough to fool someone scanning quickly on their phone. Once you enter your credentials, the scammers have what they need.

In 2025, the Canadian Anti-Fraud Centre (CAFC) tracked more than $704 million in total fraud losses reported by Canadians (2), a figure that significantly understates actual losses because most fraud goes unreported, the agency notes.

And scammers are increasingly using a tactic called “smishing”, or phishing by text, in part because Canadians increasingly trust texts over emails and are more likely to act on them quickly.

Why this scam works — and who is most at risk

Like most forms of fraud, CRA tax refund scams rely heavily on urgency. The message creates pressure by implying there's a deadline to claim your refund, pushing people to act before stopping to think things through.

Timing also plays a major role. During and after tax season, many Canadians are already expecting refunds or correspondence from the CRA, so a text claiming a refund is available doesn't necessarily seem suspicious at first glance.

Scammers also take advantage of familiarity. Millions of Canadians regularly use CRA My Account (3), so seeing what appears to be a legitimate login page can feel routine enough that people let their guard down. While seniors, newcomers to Canada and first-time tax filers are often targeted because they may be less familiar with how the CRA communicates, these scams are sent out widely. Anyone with a cellphone number can receive one.

Stop leaving money on the table. Compare Canada’s top-rated high-interest savings accounts and switch to a provider that actually helps your balance grow.

How to tell if a CRA text is real or fake

There are a few important warning signs Canadians should know. First, the CRA will never send you a text message containing a link and ask you to log in or confirm personal information. In fact, the agency rarely communicates via text, and legitimate messages won't include refund amounts, threats, or urgent deadlines that pressure you to act immediately.

Official CRA texts also come from short codes, not random cellphone numbers. If you receive an unexpected message, avoid clicking any links. Instead, go to canada.ca/my-cra-account in your browser, or contact the CRA at 1-800-959-8281 to verify whether the message is legitimate.

What to do if you clicked

If you clicked one of these links and entered personal or financial information, it's important to act quickly. The sooner you respond, the better your chances of limiting any damage.

The CRA advises anyone who believes they may have compromised their My Account credentials to change their password immediately and contact the agency to flag the account for review.