Scammers impersonate the CRA, banks, Canada Post, and Service Canada constantly. Before you click, reply, or pay anything, run through this checklist — then verify directly with the real organization, never through a number or link the message gave you.
Five Red Flags of a Fake Message
- Urgency and threats — "act within 24 hours or face arrest/legal action." Real government agencies don't threaten immediate arrest by text or email.
- Unusual payment methods — gift cards, cryptocurrency, or e-transfer to a personal name. No legitimate agency asks for these.
- A callback number inside the message itself — the safest rule: never call a number given to you in the suspicious message. Look up the real number yourself.
- Requests for your SIN, full password, or one-time codes — legitimate organizations never ask you to read back a 2FA code you just received.
- Slightly-off sender details — a CRA email from "@cra-gov-refund.com" instead of a canada.ca address, or a link that doesn't match the real domain when you hover over it.
How to Verify, Organization by Organization
Canada Revenue Agency (CRA)
Don't call any number in the message. Log into your own CRA My Account, or call the CRA's published line directly.
Verify at canada.ca — Individuals: 1-800-959-8281 →Your bank
Call the number printed on the back of your physical card or on the bank's official website — never a number from the text or email itself.
Canada Post / delivery notices
Check your tracking number directly on canadapost-postescanada.ca rather than clicking a link in a text claiming a package is "held" pending a fee.
Service Canada / EI / CPP
Log into your own My Service Canada Account rather than clicking a link in an unexpected email or text about your benefits.
Where ComplaintCA Fits
ComplaintCA's Verify a Document tool analyzes an uploaded screenshot, email, or file for phishing and fraud indicators, entirely on your device. If it turns out to be a real scam, the Cyber Crime Report path helps you document and report it to the Canadian Anti-Fraud Centre.
Not sure about a message you got? Upload it or ask Asya before you act.
Start with Asya Now →Frequently Asked
How do I know if a CRA letter or call is real?
Never use a number from the message. Log into CRA My Account or call the CRA's own published line, 1-800-959-8281.
What are the biggest red flags of a scam message?
Threats of arrest, demands for gift cards or crypto, urgency, requests for your SIN or a 2FA code, and a callback number only found in the message itself.
How can I check if a link or attachment is safe?
Don't click it — go to the organization's site directly, or use ComplaintCA's Verify a Document tool for an AI analysis.
Is a text from my bank ever legitimate?
Yes, but a real one won't ask you to click a link to "verify" your password or read back a text code. Call the number on your card if unsure.
Where do I report a confirmed scam message?
The Canadian Anti-Fraud Centre at 1-888-495-8501 or reportcyberandfraud.canada.ca. Contact your bank first if you already sent money. See ComplaintCA's full guide on how to report a scam or fraud in Canada for the complete reporting order.
What is ComplaintCA?
A Canadian civic platform that helps residents verify suspicious documents with AI, report cyber crime, file complaints, and find the right authority for their issue.
Sources & Verification
This guide is maintained by ComplaintCA and checked against the official sources linked throughout, including:
Learn more about how ComplaintCA verifies information on our About page.