How can I protect myself from tax identity theft?

Tax identity theft occurs when someone uses your personal information to file a fake tax return. They do this to claim a refund from the Canada Revenue Agency (CRA). They’ll change your information to have the refund sent to their own bank account. Then, when you go to file your return, the CRA might reject it because it sees your return as a duplicate.

Here are some key steps you can take to protect your personal information. These steps will reduce your risk of falling victim to identity theft:

• Protect your Social Insurance Number (SIN). Treat your SIN as confidential information. Don’t give any business your SIN unless you have a legitimate reason to do so.
• Don’t carry your SIN card or other documents that include it in your wallet or purse. Instead, keep them stored securely at home.
• Check your credit report regularly for strange activity.
• Protect personal computers and other electronics with firewalls and security updates.
• Change passwords regularly.
• Don’t share your SIN or personal information over the phone. Only do this if you made the call or know the person or agency is trustworthy. H&R Block and the CRA will never call you to ask for your SIN or personal information.

Handling a case of tax identity theft can take months – and that means it’ll take longer to get your tax refund. The burden of proving that the first return is false rests on the victim. You would have to provide proof that you’re the legitimate filer and the other return is fraudulent. Most importantly, you must show you didn’t receive the refund.

What actions does Canada take to address identity theft? 

The Canada Revenue Agency (CRA) has taken the following steps to fight identity theft and protect your information. 

• They introduced the Personal Identification Number (PIN) as a fast and secure way to identify yourself. A PIN is a unique identifier that’s only available to the rightful owner of the return. You can set up a PIN in your CRA My Account or by contacting a support agent at their call centre.
• All online services require multi-factor authentication. This improves security. Users must verify their identity with extra steps, not just a password.
• Improved monitoring of suspicious activity through advanced data analytics and machine learning. This helps the CRA act quickly and stop fraudulent tax filings. If the CRA thinks there might be identity theft or that your account is at risk, they’ll act quickly. This includes contacting you directly, locking your account to stop transactions, and conducting a detailed interview.
• Cybersecurity infrastructure: The CRA is always updating its cybersecurity infrastructure to protect against evolving threats.
• Public awareness and education programs were launched to help taxpayers protect their personal information and spot possible scams. You can learn more about how to spot potential scams on the CRA website.
• Dedicated support teams were set up to help victims of identity theft. They provide guidance on restoring accounts and securing information.

H&R Block is also working to better protect you from tax identity theft. We’ve made significant investments in fraud mitigation and detection technologies and resources, including sophisticated encryption tools, dedicated security personnel experts, company-wide security training and policies. 

The security of Canadians’ personal data is a top priority for H&R Block Canada. We have comprehensive data security measures in place to safeguard the personal information of the millions of Canadians we work with each year.

What if someone has already stolen my identity?

If you go to file your tax return this year and discover that someone has already filed a return using your personal information, contact the CRA right away at 1-800-959-8281. They have a dedicated Identity Protection Services (IPS) Program to help you resolve identity theft concerns. They’ll review your case and work with you directly to ensure your account is restored and remains protected from unauthorized activity. 

It's also important to notify your financial institutions and any other relevant organizations to prevent further misuse of your personal information. Additionally, you should file a report with your local police and obtain a copy of the report for your records. 

Consider placing a fraud alert on your credit reports with major credit bureaus like Equifax and TransUnion. You should also monitor your financial accounts and credit reports regularly for any signs of suspicious activity.