David Rotfleisch on How the CRA's Own Incompetence Can Backfire

Image by DC Studio via freepik

Introduction: When the CRA Falls Victim to the Very Scams It Aims to Combat

Many Canadian taxpayers have fallen victim to scams where fraudsters impersonate the Canada Revenue Agency (CRA), taking advantage of the agency’s authority and taxpayers’ fear of tax penalties and administrative consequences.

These scams, including cryptocurrency scams, are designed to appear authentic, mimicking CRA communications through fake calls, emails (despite the CRA not using email to communicate), text messages (which the CRA also does not use), and online interactions. While scams targeting the CRA and Canadian taxpayers—often orchestrated by overseas boiler rooms—are not new, what has surprised the public is that the CRA itself has now become a victim of fraud due to its own mismanagement and lack of oversight.

The Canada Revenue Agency (CRA), responsible for administering, enforcing, and collecting taxes, has faced a series of significant missteps and systemic failures in recent years. Many of these issues might have been avoided or mitigated through improved planning and more effective management practices.

The CRA has consistently failed to take appropriate action, leading to errors that create opportunities for fraudsters and cybercriminals to exploit the system. Not only has the CRA been targeted by scams, but it has also repeatedly fallen victim to them. As a result of its own mismanagement, the CRA has yet to establish a comprehensive and effective system to detect and prevent existing and potential fraudulent activities.

This article explores recent fraudulent activities that have had a significant impact on the CRA and Canadian taxpayers, while discussing measures that both the CRA and taxpayers could have implemented to prevent and address these issues effectively.

Tax-Refund Fraud: CRA Deceived in Multi-Million-Dollar Fake Tax Refund Scheme

How does the CRA verify the legitimacy of a $10 million tax refund issued to an individual? A recent case exposed the agency’s inadequate verification systems and lack of proper controls when processing large tax refunds.

As a result, the CRA only discovered the fraudulent tax refund claims after the Canadian Imperial Bank of Commerce (CIBC) flagged a suspicious $10 million payment made to an individual. From the bank’s standpoint, receiving such a substantial tax refund was highly unusual for an individual taxpayer.

Following the bank’s standard procedure, CIBC flagged the payment and reached out to the CRA for verification. It is believed that the CRA may have never uncovered the scam without the bank’s intervention. Had the CIBC not raised the alarm, the CRA would have likely continued issuing millions in fraudulent tax refunds linked to the same scheme.

After the incident and following calls from Parliament for investigations into the scheme, the Federal Privacy Commissioner’s Office launched an inquiry. The investigation revealed that the CRA had disbursed over $190 million in fraudulent tax refunds through the “fake T4A scheme.”

The scam is fairly simple and takes advantage of the CRA’s online assessment system. When a taxpayer files a tax return or amends an existing one, the CRA’s system quickly issues an Express Notice of Assessment or Notice of Assessment if no issues are flagged. Scammers can exploit this by submitting a T4A slip with no new income but large tax deductions, then amending multiple past tax returns to claim substantial tax refunds.

Once the CRA’s online assessment system processes the T4A slip and amended returns, it automatically issues the tax refunds to the scammers, without verifying the authenticity of the T4A slip or whether the claimed tax payments were actually made. By the time a CRA officer reviews the returns, the scammers, who have already received the fraudulent tax refunds, are often impossible to track down.

Cyberattacks Compromised Tens of Thousands of CRA Accounts

The CRA has been advocating for the digitization of Canada’s tax system for several years, starting with the launch of the Tax Filing Infrastructure Readiness program in 2008. By May 2017, nearly 90% of Canadian tax returns were submitted electronically.

Since its introduction, the CRA’s electronic system has been targeted by numerous cyberattacks, compromising the accounts of thousands of taxpayers. In 2020, following a forensic review, the CRA detected suspicious activity on around 48,500 accounts. As a result, the CRA temporarily locked these accounts and instructed affected taxpayers to take additional steps before they could regain access.

In August 2022, in the case of Sweet v. Canada (2022 FC 1228), the Federal Court, while certifying the case as a class action lawsuit, revealed that at least 48,110 online CRA accounts had been affected by the “unauthorized use of credentials.” In 12,700 of these cases, scammers altered the taxpayers’ direct deposit information and fraudulently applied for the Canadian Emergency Response Benefit (CERB). The lead plaintiff, representing thousands of individuals whose CRA accounts were vulnerable to hacking, argued that the CRA’s operational failures in securing the online database led to this breach. The class action is still ongoing and has yet to be heard by the Federal Court or settled.

During the peak of the 2024 tax filing season, the Canada Revenue Agency uncovered breaches of confidential taxpayer data, allegedly involving one of Canada’s largest tax preparation firms. An investigation by CBC and Radio-Canada revealed that scammers had fraudulently accessed taxpayers’ online CRA accounts, stealing at least $6 million in bogus tax refunds. The public was unaware of the scheme until it was exposed in news reports by CBC and Radio-Canada. As of now, the CRA has not identified the individuals responsible for the hack.

Telecom “Carousel Scheme”: The CRA Reportedly Disbursed $100 Million in Fraudulent Payments to Carousel Fraud Operations

The CRA has made a public commitment to “combating aggressive Income Tax and Goods and Services Tax/Harmonized Sales Tax arrangements,” particularly those identified as the “Carousel Scheme.” According to the CRA, this scheme typically involves a network of entities, including a “missing trader” and a “zero-rater,” who collaborate to sell goods to one another or create the illusion of transactions between themselves.

The missing trader collects GST/HST but fails to remit the tax to the CRA, while the zero-rater, by claiming to sell goods offshore, alters the taxable status of the goods and can claim input tax credits without actually charging or remitting GST/HST. The CRA further notes that this scheme can be challenging to detect and disrupt, as the records of the involved entities are often carefully fabricated and include multiple parties, making it more complex to trace.

In April 2024, a previously sealed affidavit from a CRA officer was made public, revealing how alleged scammers, including a Toronto-based company, Gold Line Telemanagement, successfully deceived the CRA into issuing $37 million in sales tax refunds.

Before the affidavit was released, the CRA publicly acknowledged to the media that over $63 million had been paid out in a similar scheme involving a different group of entities, some of which had connections to Gold Line Telemanagement.

Experts believe that the CRA may not have fully uncovered the extent of the carousel schemes involving various groups of entities. Gold Line Telemanagement and the other implicated parties have denied the CRA’s allegations. The Tax Court of Canada has not yet issued a decision on the Carousel Scheme cases, and the CRA’s claim that these entities participated in fraudulent transactions remains unproven. If the scheme is indeed fraudulent, it is likely that the CRA has been involved in additional cases beyond the two currently under investigation.

Tax Pro Tips – Stay Alert and Critical When It Comes to Your Tax Affairs!

It is challenging for individual taxpayers to safeguard themselves against the CRA’s errors or mismanagement. In most cases, taxpayers are only informed of the issue after the CRA has contained it, often long after any damage has occurred—if they are notified at all.

Affected taxpayers often have limited options, especially when the CRA is unable to identify the scammers or the origin of the issue. In some cases, the CRA may even wrongly accuse a taxpayer of being involved in fraudulent schemes, leading to lengthy legal disputes and considerable costs to dispute the false claims. It’s crucial to remain vigilant and proactive about your tax matters to prevent any issues from escalating.

If you believe the CRA has made errors in your tax matters, it’s essential to consult with one of our experienced Canadian tax lawyers. We can offer legal guidance, identify potential issues, and help you understand your rights and responsibilities when dealing with the CRA.

Frequently Asked Questions (FAQs)

How Did the CRA End Up Losing Million Dollars in Tax Refunds?

The CRA fell victim to a scam involving counterfeit T4A slips and amended tax returns. In this scheme, fraudsters submitted fake T4A slips and revised previous tax returns to claim refunds for taxes that were never actually paid.

The CRA’s online assessment system processed and issued refunds, including some as high as $10 million, without flagging any issues. This allowed scammers to receive fraudulent tax refunds without the CRA verifying the authenticity of the T4A slips. By the time the CRA began investigating the returns, the scammers had already disappeared.

How Can I Safeguard Myself From Cyberattacks On CRA Accounts?

A data breach is particularly concerning when hackers gain access to personal and tax information. With this sensitive data, they can impersonate taxpayers to fraudulently claim refunds, open credit accounts, secure loans, or even commit other criminal acts. It’s crucial to take proactive steps to protect yourself from potential cyberattacks.

If you have an online CRA account, it’s important to regularly review your account activity. If you notice any unusual activity, reach out to the CRA or consult with a legal expert. For any notices or letters you receive that appear to be from the CRA, verify their authenticity by directly contacting the CRA. Additionally, always ensure that you keep your personal information secure and avoid sharing it with anyone who doesn’t have a legitimate need for it.

Disclaimer: This article just provides broad information. It is only up to date as of the posting date. It has not been updated and may be out of date. It does not give legal advice and should not be relied on. Every tax scenario is unique to its circumstances and will differ from the instances described in the articles. If you have specific legal questions, you should seek the advice of a Canadian tax lawyer.