It’s time to start preparing your personal income tax return in Canada and the U.S. Just remember that crooks are preparing, too.
Researchers at Sophos said on Tuesday that they are seeing email messages to individuals pretending to be from the Canada Revenue Agency (CRA), claiming the person is entitled to a refund from the government. To collect, the individual is asked to create a CRA account. The message includes a link to a fake CRA website; the goal is to get personal information from victims.
There are several versions of the scam. One says recipients can sign up for an Interac e-transfer of funds.
Crooks hope victims will be fooled by the lure of money and copies of government logos. However, there are several clues messages like these are scams. In this scam
— neither the Canadian nor the American government will send a message that you are entitled to a refund;
— some messages are in fractured English. One, for example, asks recipients to deposit their money rather than withdraw it;
— smart people who hover their mouse over the link for signing into or creating an account will see it doesn’t go to a Government of Canada site. Often the link goes to a page created on Amazon Web Services (AWS).
— smart people who have enabled their email to show the sender’s full email address will see it obviously doesn’t come from the government. A hacker can make the sender’s name appear to be from any well-known agency, company or person. But the full email address will show the real sender.
There is a large number of tax scams aimed at American residents as well. These include phone, letter, or email messages claiming you owe taxes. They will demand that you pay the amount immediately, usually with a prepaid debit card or wire transfer. They may even threaten to arrest you if you don’t pay.
Click here for information from the U.S. Internal Revenue Service (IRS) about identifying tax fraudsters.
Click here for advice from the Canada Revenue Agency. See also this page for details on CRA scams.
Be suspicious of any email, text, or phone call from anyone asking for personal information including your birthdate, credit or debit card number, bank account number, or Social Insurance/Social Security number. Crooks will claim they need these numbers from you to verify information.
If you call a government agency on your own — not using a phone number in an email or text — using personal information for verification is safe.