Who’s hacking CRA accounts?

px_eliezer_

Victims of identity theft across Canada want their names cleared after scammers got into their accounts with the Canada Revenue Agency....

Whistleblowers, leaked documents and multiple victims have painted a picture of hackers repeatedly using a side-door entry to take control of Canadians’ CRA account by obtaining the special access codes assigned to third-party tax preparer companies in Canada...

These latest schemes come amid revelations the Canada Revenue Agency has paid out tens of millions of dollars to scammers after tens of thousands of taxpayer accounts were hacked over the past few years.

https://www.cbc.ca/newsinteractives/features/whos-hacking-cra-accounts

Thane_Bitter

px_eliezer_ Thanks for the reminder that it's nearly knee in the package season, with all the other ball busting that has been going on I nearly forgot (a time without pain).

Not quite joking aside, the problem is the CRA has long been a stupid victim of fraud, GST rebates to non-existing companies, COVID payments to non-people, it seems they do very little to go after those that are actively trying to rip off the nation. Even if you do pay your taxes the CRA will hold you responsible for the non-payment of other people, what a wonderful organization the CRA is.

Somewhat-Reticent

Well, that's not good.

Dks01

H&R Block says it wasn’t them.

FrathosCAN

Dks01 It looks like there is an insider at H&R Block though otherwise how would that one person's details simply disappear while trying to have the issue investigated?

You also have to wonder about DC Bank, how do they allow people to open accounts in other people's name as ID is required AFAIK when setting up a new account?!?

Somewhat-Reticent

Thane_Bitter stupid

Deliberate Ignorance ? Cheap is as Cheap does ?

gwailodan

Thane_Bitter To me, the problem is people grant access to their CRA account to companies like H&R block, then don’t remove access once the return is filed and the Notice of Assessment is received.

Dks01

FrathosCAN No idea. Speculation isn’t my specialty.

styvas

Amazing that, with a little determination, the CBC was able to uncover so much information that neither of the police nor the CRA was able or willing to do.

ZZZZZZZ

gwailodan

or add security questions before logging on. 🙈

Thane_Bitter

gwailodan It could be that they never set up access in the first place and the HRB or whatever tax group did it for them, had them sign a document that stated they had given them access among all the other papers to sign and check. They are unlikely to recall that and likely have no idea that such access exists or how it works, how to revoke or change it.

CRA’s page on accounts and access: https://www.canada.ca/en/revenue-agency/services/e-services/cra-login-services/help-cra-sign-in-services/cra-userid-password.html

gwailodan

ZZZZZZZ From what I read in the story, it’snot a “hack” . Access was granted. then the wrong person used that access.