You receive an email that appears to be from the CRA. It uses your name, includes an official-looking logo, and refers to a tax refund you may reasonably be expecting. The writing is polished, there are no spelling mistakes, the link seems to be real, and even the email address looks convincing!

None of that means the message is legitimate.

Tax scams aren’t new, but generative artificial intelligence (AI) is making them easier to produce and personalize. The CRA has recently issued warnings that scammers can use AI to create realistic text, images, audio, websites, and other content, sometimes using public information to make a message feel surprisingly specific.

Unfortunately, this all means that spotting these new scams may take more than looking for an “obvious” mistake.

The old warning signs aren’t enough

For years, people were told to watch for poor grammar, strange formatting, blurry logos, and awkward language. Those are still worth noticing, but they’re no longer reliable on their own. AI can copy the tone of an official notice and produce a convincing version of a government sign-in page. A scam may even include your name, date of birth, or other personal details.

That can make the message feel credible, but it doesn’t prove where it came from. The question you need to be asking now more than ever is: can you verify the request somewhere else?

“You have a refund waiting”

One common scam promises a tax refund, GST/HST credit, benefit payment, or Interac e-transfer.

The message may say the payment will expire or that you need to confirm your information immediately. A link then leads to a page asking for banking details, a Social Insurance Number, a date of birth, or login credentials. The timing can seem believable, especially if you recently filed a return.

Know that the CRA does not send refunds or payments by text message or e-transfer. It also won’t email you a link asking you to enter personal or financial information.

“There’s a problem with your account”

Another message may claim your CRA account has been suspended, information is missing, or immediate verification is required.

The link might lead to a page that looks almost identical to the official CRA sign-in screen. Any information entered there goes to the scammer instead.

It probably goes without saying, but don’t use the link. Open a new browser window, go to the official CRA website yourself, and double check whether a notice or account change actually exists.

“Pay now or face legal action”

Some scams rely on fear rather than the promise of money.

A caller may say you owe tax and demand immediate payment through cryptocurrency, a gift card, a prepaid credit card, or an e-transfer. They may threaten arrest, deportation, or police involvement.

Caller identification isn’t proof that the call is real. Phone numbers can be spoofed to look local or even appear to come from the CRA, and generative AI can create voice messages that sound convincingly like a real person.

The CRA won’t pressure you to pay through cryptocurrency, gift cards, or prepaid cards. It also won’t threaten arrest or deportation. A legitimate tax balance should still be addressed, but you can verify it independently before sending money.

Pause, verify, and protect

When a message asks you to act urgently, slow things down.

1. Pause: Don’t click the link, open the attachment, reply, or provide information right away.
2. Verify: Sign in to your CRA account through the official website, not through the message. You can also contact the CRA using a phone number found independently on Canada.ca.
3. Protect: Never provide passwords, banking credentials, or sensitive identification information in response to an unexpected email, text, or voicemail.

A polished, personal message can still be fraudulent.

Businesses need a clear process too

Business scams may reach owners, bookkeepers, payroll administrators, and finance teams.

Decide in advance who can access CRA accounts, respond to tax correspondence, and approve unexpected payments. Employees should also know how unusual requests will be verified.

These basic controls can stop a convincing message from turning into a costly mistake.

What if you already clicked?

Entering login details, downloading a file, sharing personal information, or sending money requires a quick response. Stop communicating with the sender and change affected passwords. If banking information was shared, contact your financial institution. Check your CRA account for unauthorized changes or modified direct deposit details.

Depending on what happened, you may also need to contact the CRA, the Canadian Anti-Fraud Centre, or a cybersecurity professional.

What legitimate CRA communications may look like

The CRA does contact taxpayers by phone, mail, and email in some situations, so the communication method alone doesn’t settle the question. The CRA may call to verify identity, request supporting information, or discuss an outstanding balance. The CRA may also email you to say a new message is available in your online CRA account.

The CRA will not ask you to send personal or financial information by email or voicemail, send a refund by text message, or demand payment using gift cards or cryptocurrency.

When something feels unusual, confirm it through a channel you found and accessed yourself. Visit the CRA’s website for more detailed information on how you can verify if a message is legitimate whether it came by phone, letter, or email.

Convincing isn’t the same as credible

AI can make a fraudulent message more polished, specific, and believable. It can’t make the request legitimate. Before acting on an unexpected tax communication, pause and confirm it through a trusted channel that you accessed independently.

When a message relates to a tax matter your DMCL team is already assisting with, contact your DMCL advisor using the phone number or email address you normally use (or from our website) before taking action.