If you’ve received a CRA email, or something claiming to be one, your first instinct is probably to wonder whether it’s real. Before you click any link, call back any number, or send any money, there is one rule that changes how you read everything. This guide explains what CRA actually sends, what it never sends, and your next step.
Key Takeaways
- CRA does send emails, but only as brief alerts telling you new mail is waiting in your secure My Account portal
- CRA will never email you asking for personal information, banking details, or immediate payment
- A legitimate CRA email never contains an unsolicited login link or attachment
- Always access My Account by navigating to canada.ca yourself, never through a link in any email
Does CRA Send Emails?
Yes, but only in a very specific way. CRA uses email exclusively as a notification system. When CRA has correspondence for you, it deposits it inside your secure CRA My Account portal, then sends a short email to tell you something is waiting. The email itself contains no tax details, no payment amounts, and no login link. It is simply a prompt: log in and check your account. This applies to both individuals (CRA My Account) and businesses (My Business Account).
If you have not registered for online mail, CRA has historically sent paper letters to your address on file. However, that is changing.
Starting July 3, 2025, CRA began automatically switching eligible individuals from paper mail to online delivery, without requiring them to opt in. Phase 1 covered approximately 500,000 benefit recipients. Phase 2, effective September 4, 2025, extended the change to an additional 900,000 individuals. If you hold a CRA My Account and were previously receiving paper mail, you may have been switched automatically. CRA notifies affected individuals by email or letter before making the change, and you can revert to paper at any time by updating your correspondence preference inside My Account. See CRA’s online mail transition page for the full details.
The practical implication: more Canadians are now receiving CRA email notifications than ever before, which also means more Canadians are targets for scammers who know this. If you have never created a CRA My Account at all, auto-enrollment cannot apply to you, and any email claiming to be from CRA remains highly suspicious.
The rule: Any email that goes beyond “you have a message waiting” is not a legitimate CRA email.
Types of CRA Email Notifications
If you’re registered for online mail, here are the most common reasons CRA will send you a notification email:
- Notice of Assessment (NOA): Posted after CRA processes your T1 or T2 return: confirms your refund, balance owing, or nil result
- Benefit and credit statements: New statements for the Canada Child Benefit, GST/HST credit, or other federal benefits
- Instalment reminders: Quarterly instalment due dates posted to your account
- Audit or review correspondence: If CRA selects your file for review, it posts an initial contact letter to My Account and often sends a notification email: this is how many Canadians first learn they’re under audit
- Account security alerts: Changes to your account (new direct deposit profile, password reset, address update)
- Balance owing notices: Outstanding amounts posted to your account
In every case, the actual content is inside My Account: the email is just the alert.
Personal Tax Sample Notification
Corporate Tax Sample Notification
What a Legitimate CRA Email Looks Like
A genuine CRA notification email is recognizable once you know what to look for. The table below covers the main differences: bookmark it or share it with someone who might need it.
| Feature | Legitimate CRA Email | Scam / Phishing Email |
|---|---|---|
| Sender domain | Ends in @cra-arc.gc.ca or @canada.ca | Gmail, Outlook, or lookalike domain |
| Message length | Brief, no tax details | Often long, urgent, detailed |
| Login link | None: you navigate to canada.ca yourself | Prominent “Click here to log in” button |
| Attachments | None | PDF, ZIP, or “tax form” attached |
| Language | Neutral, formal, bilingual | Threatening, urgent, or broken French |
| Asks for information | Never | Asks for SIN, banking, or payment |
| Response required | No: log into canada.ca independently | Yes: act immediately within the email |
CRA’s notification emails are automated and no-reply: you cannot and should not respond to them by email. All replies go through My Account or by phone.
How to Spot a Fake CRA Email
A CRA email scam has become harder to spot as fraudsters improve their techniques, but the red flags remain consistent.
Check the full sender address. Scammers can spoof the display name: “Canada Revenue Agency” can appear on any email. What they cannot fake easily is the domain. If the address after the @ is anything other than cra-arc.gc.ca or canada.ca, stop.
Watch for urgency and threats. Real CRA correspondence gives you reasonable time to respond. Phrases like “Your account will be suspended in 24 hours,” “A warrant has been issued,” or “Your refund expires today” are scam tactics, not government communication.
Be suspicious of surprise refund announcements. CRA does not email you to announce an unclaimed refund. Refund details appear in your Notice of Assessment inside My Account after filing, not in an unsolicited email.
Hover over any link before clicking. On desktop, hold your cursor over the link without clicking: the actual destination URL will appear in your browser’s status bar. If it doesn’t lead to canada.ca or cra-arc.gc.ca, don’t click it. On mobile, press and hold the link to preview the URL.
If you’re still unsure after checking these, call CRA directly at 1-800-959-8281 to verify. Never call any number listed inside the suspicious email itself. See the CRA scam recognition page for more examples.
What to Do When You Received a CRA Email
Follow these steps in order, whether the email turns out to be real or suspicious.
Step 1: Don’t click anything yet. Check the full sender email address (not just the display name shown in bold) and read the overall tone. Urgency, threats, or requests to act immediately within the email are red flags before you go any further.
Step 2: Navigate to canada.ca manually. Type it directly into your browser. Do not use any link from the email. Alternatively, Google Search “CRA My Account” for a direct link to the login page.
Step 3: Log into CRA My Account. Use your CRA credentials or your banking sign-in (most major Canadian banks support CRA sign-in). Check your Messages and Correspondence sections. If the notification was legitimate, the actual correspondence will be there in full. If nothing is there, the email was not from CRA.
Step 4: Follow instructions inside My Account. Submit documents through the Secure Document Drop tool. Pay outstanding balances through My Account or your bank. Do not reply to the email itself.
Step 5: Report suspicious emails. If the email appears fraudulent, forward it to phishing@cra-arc.gc.ca and report it to the Canadian Anti-Fraud Centre at 1-888-495-8501.
If your My Account shows an audit letter or reassessment, review our CRA audit letter guide before responding: timelines are strict. For complex situations, CRA audit representation from a qualified CPA can protect your position early.
Conclusion
A CRA email is never something to act on directly: it is always just a prompt to log into your secure account.
- CRA emails are notification-only; all real correspondence lives inside My Account
- CRA will never ask for personal information, payment, or login credentials by email
- Urgency and threats are scam indicators, not government communication
- Always navigate to canada.ca yourself, never through a link in an email
If your My Account is showing an audit letter, reassessment notice, or outstanding balance, don’t respond alone. Faiq Shad, CPA, LPA has reduced CRA reassessments by up to 95% for clients across the GTA. Book a free consultation before the deadline passes.
Frequently Asked Questions
What does a CRA email actually say?
A legitimate CRA email says very little by design. It typically reads something like: “You have new mail in your CRA My Account. Please log in to view your correspondence.” It will not name what the correspondence is about, state any dollar amounts, or ask you to take any action within the email itself. If the message contains specific financial details or instructions to act immediately, it is not from CRA.
Will CRA email me to say I have a refund?
No. CRA does not announce refunds by email. After you file, CRA posts a Notice of Assessment to My Account and sends a notification to log in and view it. Any email that announces an unclaimed refund out of the blue is a scam.
What email address does CRA send from?
Legitimate CRA emails come from addresses ending in @cra-arc.gc.ca or @canada.ca. Always verify the full address, not just the display name, which can be faked by scammers.
What if I already clicked a link in a suspicious CRA email?
If you only clicked but entered nothing, close the page and run a malware scan. If you entered your CRA credentials, go to canada.ca immediately via banking sign-in, change your password, and call CRA at 1-800-959-8281. If you provided banking information, contact your bank right away.
Can CRA contact me by text message?
No. CRA does not use text messages for tax accounts, refunds, or payment demands. Any text claiming to be from CRA with a link or callback number is a scam. Delete it and report it to the Canadian Anti-Fraud Centre.
How do I know if I’m registered to receive CRA email notifications?
Log into CRA My Account and navigate to your Profile or Notification Settings. If your email address is on file and online mail is enabled, you are registered. If you’ve never set this up, CRA has no email address for you on file and will not send you any CRA email notifications, which means any email you receive claiming to be from CRA should be treated with immediate suspicion.
