{
  "slug": "cra-tax-refund",
  "canonical_name": "Canada Revenue Agency refund and e-Transfer scams",
  "family": "prize-refund-tax",
  "impersonates": {
    "brand": "Canada Revenue Agency",
    "disclaimer": "Canada Revenue Agency is not involved; criminals impersonate the brand.",
    "official_fraud_page": null
  },
  "goal": [
    "personal-data",
    "payment",
    "credentials"
  ],
  "channels": [
    "email",
    "sms",
    "call"
  ],
  "summary": "Emails, texts and calls pretending to be the CRA: a tax refund to claim, an INTERAC e-Transfer waiting, or a debt to pay now. The refund form collects identity and card details; the debt version wants gift cards or a transfer.",
  "status": "archived",
  "first_seen": "2016-08",
  "last_seen": "2016-08",
  "recognise": [
    "The CRA does not send refunds by e-Transfer or ask for card details by email",
    "A form asking for far more than a tax agency needs",
    "Threats or deadlines on the phone"
  ],
  "variants": [],
  "specimen": {
    "date": "2016-08",
    "channel": "email",
    "from": null,
    "reply_to": null,
    "subject": null,
    "attachment": null,
    "body_text": null,
    "redactions": [],
    "image": "/wp-content/uploads/canada-revenue-agency-phishing-email.png",
    "sources": [
      "https://soft2secure.com/knowledgebase/canada-revenue-agency-scam"
    ]
  },
  "tells": [],
  "indicators": {
    "sender_domains": [],
    "senders": [],
    "reply_to": [],
    "phone_numbers": [],
    "urls": [],
    "wallets": [],
    "attachments": [],
    "note": "Indicators change weekly; an empty list never means an email is safe."
  },
  "what_to_do": {
    "if_received": [
      "Do not use the link or call back; check your account through the CRA's own site",
      "Delete it"
    ],
    "if_called_or_paid": [
      "Entered a password? Change it now, and everywhere else you used the same one",
      "Entered card details? Call your bank, ask them to block the card and reissue",
      "Entered a one-time code? Sign in to the real service now and check for changes to email, phone and payment settings"
    ],
    "report_links": [
      {
        "label": "Report to the FTC",
        "url": "https://reportfraud.ftc.gov/"
      }
    ]
  },
  "malware_family": null,
  "timeline": [
    {
      "date": "2016-08-31",
      "type": "specimen",
      "title": "Specimen №1: refund email and fake refund form",
      "text": "The guide documented the email and the form that collected identity and card details.",
      "added": [],
      "removed": [],
      "sources": [
        "https://soft2secure.com/knowledgebase/canada-revenue-agency-scam"
      ]
    },
    {
      "date": "2026-09-02",
      "type": "registry",
      "title": "Family created",
      "text": "Grew out of the 2016 guide. The CRA skin recurs every tax season; this record holds the 2016 wave.",
      "added": [],
      "removed": [],
      "sources": []
    }
  ],
  "related": [
    "irs-tax-refund",
    "hmrc-tax-rebate"
  ],
  "sources": [
    "https://soft2secure.com/knowledgebase/canada-revenue-agency-scam"
  ],
  "legacy_urls": [
    "/knowledgebase/canada-revenue-agency-scam"
  ],
  "legacy_redirect": false,
  "created": "2026-09-02",
  "updated": "2026-09-02",
  "changelog": [
    {
      "date": "2026-09-02",
      "text": "Record created at the registry launch."
    }
  ],
  "url": "https://soft2secure.com/scams/cra-tax-refund",
  "licence": "CC BY 4.0",
  "generated": "2026-09-03"
}