In early 2024, senior Canada Revenue Agency officials said they were so concerned that they had mistakenly approved tens of millions of dollars in fake refunds and said the agency was plagued by significant “gaps” in its ability to detect them. A confidential report was prepared. Stop it — scammers, records show.
fifth estate/ Radio-Canada says the agency has been aware of “significant risks” to its fraud detection system since last November, including an undisclosed scheme that resulted in potential losses of $100 million in fake payments. I learned that.
One of the most obvious weaknesses senior executives identified was the ability for fraudsters to pose as accountants or tax preparers and hack into taxpayers’ accounts, sources said.
“This is impacting the agency’s ability to proactively and timely detect suspicious activity, resulting in undetected fraud, fraudulent accounts,” one internal memo written earlier this year said. Expanded access and/or changes to accounts may occur.”
“This gap could lead to financial losses, impact Canadians’ privacy, and lead to media coverage outlining a lack of action by the CRA.”
Those concerns were raised internally at the branch executive level, which is responsible for the security of taxpayer accounts, the people said.
fifth estate/Radio-Canada is not identifying the sources as they are not authorized to speak to the media.
“The consensus is that these gaps pose a huge risk to authorities. [human] “We all agree that given resources, visibility is needed on this issue,” the CRA memo concluded.
But in public, Revenue Minister Marie-Claude Bibeau and her agents continue to paint a very different picture of the CRA’s ability to detect fraudulent payments.
“Wrongdoing is clearly unacceptable, but we believe we have strong systems in place at our agencies,” he said in Ottawa three weeks ago. “The CRA’s systems are strong. We are able to respond to and block fraudulent attempts, notify those affected, and ensure any necessary follow-up.”
The CRA recently announced that it has confirmed losses of only $3 million this year from fake refunds in taxpayer accounts hacked by fraudsters, but that this figure is a “significant reduction” compared to previous years. CRA stated.
“Hiding reality is in no one’s interest.”
Today, such claims by ministers and the senior leadership of their authorities are subject to increasing scrutiny. Multiple insiders told CBC that the CRA knew the numbers it presented to the public about fake refunds were underreported and misleading.
One source said, “Hiding the reality is literally in no one’s interest.”
In Congress, Senate and House committees asked ministers and CRA officials to testify about recent revelations that tens of thousands of taxpayer accounts were hacked by fraudsters and hundreds of millions in fake refunds were fraudulently paid out. I am asking you to do so.
Mr. Bibeau and some executives are scheduled to testify before the Senate National Finance Committee on Tuesday.
Basic information not confirmed
Sources say it appears no one at the CRA was tasked with verifying basic documents before disbursing millions of dollars, and agency officials believe numerous fraudulent schemes were successful. He expressed concern that this may be the case.
When such fraud was discovered, it was often after the fact.
Officials say many of the frauds would never have been discovered if banks had not contacted the CRA after noticing suspicious deposits from the Canadian government into customer accounts.
Other scams have been discovered after taxpayers tried to file their returns and then realized that scammers had tricked them into changing their direct deposit information or other personal information.
Multiple victims who had their accounts hacked told CBC/Radio-Canada that they were treated poorly by authorities, who sometimes believed they were not telling the truth about the hack, and received no calls back from the CRA. I was told that calls and refunds were slow. They have legitimate obligations.
Fifth Estate and Radio-Canada investigation reveals hackers accessed thousands of Canada Revenue Agency accounts, changed direct deposit information, filed false tax returns, and pocketed tens of millions of dollars in fake refunds. It became clear that he had entered.
Many victims said the CRA seemed to have little interest in pursuing the actual scammers.
AJ Brauer, a high school teacher in Ottawa, said he discovered his account had been hacked in 2020. He said he was aware of the change in the bank transfer information, but was unable to contact him because the CRA fraud line did not answer the phone. weekend.
When he finally got in touch, he said the CRA didn’t seem to share his level of concern, and the CRA did not follow up on the information he provided that could identify the scammer.
“I’m a law-abiding citizen and I don’t like the idea of people stealing public revenue,” Brauer said. “It took two years to fully extricate ourselves from this identity theft. What did the CRA do to fix its own problems?”
“Line 45600” scheme
Sources said agency officials have repeatedly sounded the alarm about how easy it is for fraudsters to change information on taxpayer accounts without verification by the account’s rightful owner.
One of the scams, which falsely claims to deduct taxes from income received from a trust, was first discovered within the CRA in November 2023. According to sources, the scheme escalated rapidly until late April 2024, by which time the fraudsters were demanding $128 million in counterfeit money. refund.
Sources say the CRA is working to recover some of the fake refunds paid under the program, estimated to be potentially $100 million.
Internally, agency officials say nothing prevents fraudsters from making multiple amendments to the same tax return on the same day, something that would never or rarely happen under normal circumstances. he pointed out.
But once fraudsters discovered this gap, they repeatedly exploited it, filling out certain lines of tax returns with false information to obtain fraudulent refunds, sources said.
The CRA’s media relations office declined to answer specific questions about this particular scheme, known as line number 45600.
But agency spokeswoman Nina Iussoupova said, “The vast majority of Canadians are honest, and the CRA has effective systems in place to manage the small number of people who submit fraudulent claims.” Ta.
Scammers used a third-party tax auditing company
Sources say one of the big weaknesses in fraud detection is so-called third-party EFILE credentials, special codes given to accounting firms that pay taxes on behalf of Canadians.
fifth estate/ Radio-Canada investigation finds scammers frequently hack into taxpayer accounts by obtaining codes used by accounting firms, altering taxpayers’ direct deposit information and defrauding the CRA of refunds. It became clear that they were repeatedly asking them to pay.
Sources said one of the flaws was the fact that the agency allowed multiple users from the same accounting firm to use the same EFILE number and password.
Officials say who is using these credentials to access taxpayer accounts, whether the fraudster operates within the accounting firm or an outside fraudster who obtains these passwords. This means that in many cases it is not possible to determine exactly who was hacked into.
fifth estate/ Radio-Canada reported last week that sources have now told the media about the millions of dollars the CRA has been paid in fake refunds, and a whistleblower who may have reported significant weaknesses in the agency’s fraud detection. reported that they believed they were conducting a “witch hunt” to find the
- If you have a tip about this story, or if you were a victim of a hacked CRA account, please call 416-526-4704 or confidentially at Harvey.Cashore@cbc.ca or Daniel.Leblanc@cbc.ca Please send an email to.
