CRA Blocks $14.9M of Fraud Attempts, Heightens Security Amid Rising Identity Theft Cases
Hackers successfully stole $6.6 million from the Canada Revenue Agency (CRA) by exploiting personal account information during the 2024 tax season. According to a CRA spokesperson, the “threat actors” had attempted to obtain a total of $21.5 million through false returns before $14.9 million was intercepted.
A joint investigation by CBC’s The Fifth Estate and Radio-Canada revealed that the imposters misused confidential credentials from H&R Block Canada to access hundreds of Canadians’ CRA accounts. Once inside, the hackers altered direct deposit details and filed fraudulent returns. However, H&R Block Canada clarified that their systems were not compromised and that the affected taxpayers were not their clients.
The CRA confirmed that a total of $157 million in fraudulent claims was blocked this year alone. Although the exact source of the breach remains undisclosed, the CRA emphasized their ongoing security measures and collaborative efforts with third parties.
“When unauthorized use of taxpayer information is identified, we take swift action,” the CRA said in a statement, which includes notifying impacted individuals, securing their accounts, and outlining protective steps they can take.
Over the past few years, the CRA has seen a rise in identity theft incidents, particularly following the introduction of COVID-19 emergency benefits. In 2020, the CRA paid out $181 million in fraudulent claims—a figure that has sharply decreased in subsequent years thanks to heightened security controls and proactive fraud detection measures.
Despite the CRA’s strengthened safeguards, including multi-factor authentication and proactive account monitoring, privacy breaches still occur. The CRA acknowledges these challenges and stresses that taxpayer protection remains a top priority. When confirmed breaches occur, the CRA locks accounts, reviews suspicious activity, and offers affected individuals credit protection services at no cost.
Taxpayers impacted by identity theft are not held responsible for any fraudulent payments, penalties, or interest charges. The CRA urges Canadians to stay vigilant and advises them to visit the government website for tips on safeguarding personal information against external threats.