TORONTO -- Tax season can be a particularly precarious time for Canadians.

Not only is there pressure to file your tax return accurately and on-time, you’re doling out vast amounts of sensitive personal information online while doing so.

Practising good personal data protection etiquette online should be top of mind for consumers year-round. But it becomes increasingly important during tax season, when cybercriminals tend to prey on consumers who are more likely to fall for scams that ask for their personal information.

Here are some important security measures to keep in mind while handling your personal information online this tax season:


Canadians have faced an influx of online scams and robocalls purporting to be from federal organizations including the Canada Revenue Agency (CRA) over the last few years.

These scams often threaten consumers with the imminent threat of arrest or lawsuit before asking for a litany of personal information, such as social insurance numbers.

In 2019, Canadians lost more than $1.4 million to CRA scams, according to numbers provided to by the Canadian Anti-Fraud Centre (CAFC). In fact, as of Feb. 2, the CAFC had confirmed 34 successful instances of CRA fraud in 2020, costing consumers over $10,000 total.

“A lot of the scams take place over email and SMS,” Christine Beauchamp, director of the Canadian Centre for Cyber Security, told in a telephone interview.

“They have a variety of messages that make them seem very legitimate and professional. You might not be able to tell right away whether or not they’re legitimate.”

When it comes to online scams in particular, the CRA says it will never:

  • Ask for prepaid credit cards or gift cards.
  • Collect or distribute payment via e-transfer or bitcoin.
  • Send an email with a link that asks you to divulge personal or financial information, unless you have called the CRA to ask for a form or a link for information. In this case, a CRA agent would send you an email during the call with that information.

Beauchamp adds that users should never click on links included in suspicious emails, especially if it’s not a secure link.

Sites with a secure connection will display a lock symbol in the left hand side of the URL bar in your web browser. Secure sites will also start with “https” (the “s” stands for secure).



Your income tax return contains a wealth of incredibly sensitive personal information -- perfect for anyone who wants to steal your identity.

“If there is one password you want to keep incredibly strong and unique, I would say it’s definitely the one that’s associated with your tax return file,” Beauchamp said.

Whether you are filing online through the CRA’s website, or using a third-party program to help you with your return, make sure that you use a password that is eight to 10 upper- and lower-case letters mixed with numbers. That’s the formula experts say is most secure.

When choosing numbers to add to your password, be sure not to use anything that is easily identifiable, such as your address or date of birth.

If you have a hard time remembering your passwords, Beauchamp suggests stringing together three or four random words you’ll remember, which is often as strong as an alphanumerical password.


When filing your taxes online, be mindful of where you save the PDF copy of your return and any supporting documents.

If possible, Beauchamp recommends storing these files on an encrypted external hard drive or a secure drive in the documents section of your computer. Files that are saved on your computer’s desktop are not as protected as those stored in the documents folders.

Experts don’t recommend storing these kinds of personal documents in the cloud.

Keep in mind that you should be filing your return from a secure internet connection and not from a public Wi-Fi connection.

Public Wi-Fi networks are highly susceptible to Man-in-the-Middle-style attacks, which allow eavesdroppers to intercept data transmissions and read them.


The CRA has an entire website dedicated to helping Canadians protect themselves against fraud, including information about the most common scams.

The government’s Get Cyber Safe websitehas additional information about filing your taxes online safely. will have stories on tax season every Money Monday. Look for it in our 5 Things to Know.