Phishing Scams in Canada
Canadian phishing attacks target CRA, Service Canada, Canada Post, and major banks — with tax season and CERB-related campaigns among the highest-volume attacks reported to the Canadian Anti-Fraud Centre.
Part of: Phishing
Last reviewed: 1 June 2026
Canada experiences significant phishing activity concentrated around its major government services — the Canada Revenue Agency (CRA), Service Canada's Employment Insurance and CPP systems, and Canada Post. The pandemic period saw a sharp increase in CERB and CRA benefit phishing that subsequently transitioned into general CRA impersonation fraud.
Canada's bilingual population means phishing campaigns run in both English and French, with French-language campaigns targeting Quebec often using more locally specific CRA and Revenu Québec branding.
How this scam works on Canada
CRA phishing peaks in February–April (RRSP contribution season and T4 filing) and claims either that the recipient has a refund available or owes an outstanding balance. The linked page collects CRA My Account credentials or direct banking information.
Canada Post phishing follows the same pattern seen in the UK and Australia — small customs or redelivery fee requests — but uses Canada Post branding specifically and targets Canadian postal codes.
Service Canada phishing campaigns impersonate EI and CPP payment notifications, claiming that payment is ready but account details must be confirmed to process the deposit.
Common red flags
- CRA email or text claiming a refund is available and requires bank details
- Canada Post SMS about a delivery held for a customs or redelivery fee
- Service Canada message about a payment requiring account confirmation
- Any government message with a link asking for SIN number or banking details
- Email with CRA letterhead and a link — the CRA uses My Account for digital communication, not links in emails
How to protect yourself
- Access CRA only through My Account at canada.ca/my-cra-account — never via email or text links
- Report suspicious CRA communications to 1-800-959-8281 or the CRA phishing line
- Forward phishing SMS to 7726
- Report to the Canadian Anti-Fraud Centre at antifraudcentre.ca
- Enable multi-factor authentication on CRA My Account
How to report it
- Report to the Canadian Anti-Fraud Centre at antifraudcentre.ca or 1-888-495-8501
- Report CRA impersonation to the CRA directly
- Contact your bank immediately if financial details were entered
Frequently asked questions
Does the CRA ever email links to claim a refund?
No. The CRA communicates through My Account and postal mail. They do not send emails with links to claim refunds or with links requiring you to enter banking information. Any such email is phishing — do not click any links and report to the CRA.