CRA never emails taxpayers (personal or corporate) to request personal information of any kind. A phishing email may look legitimate as the sender will add CRA logos and have email addresses and website links with ‘CRA’ in it. They will even make the false website look like a genuine CRA website. In order to entice you to click on the links or provide personal information, the phishing email will generally say you are entitled to a refund. The email may even give a deadline when you have to claim the refund. This is to pressure you into quickly taking action before you have time to logically assess the legitimacy of the email. Once you click on the link, it will most likely start asking you to input your name, social insurance number or a business number, banking information and any other personal information that could be used to make fraudulent transactions. There is also a risk that when you click on any links or open any attachments, there could be malicious software attached that automatically downloads onto your computer.

In addition to not requesting information by email, CRA will never request information relating to a passport, health card, or driver’s license. If you are ever unsure if an email is legitimate or not, stop and think. How did they get my email address? Do they already have the information they want? Is this too good to be true? You can always call CRA’s information phone numbers and they will inform you if they are trying to contact you. Just ensure you call from the numbers listed on CRA’s website, not any phone numbers included in the suspicious email or links from the email.

For more details, go to http://www.cra-arc.gc.ca/nwsrm/fctshts/2012/m03/fs120312-eng.html.