In the summer of 2023, a Canadian taxpayer logged into his Canada Revenue Agency account, falsely amended previous tax returns and wrongly claimed he was suddenly owed more than $40 million in refunds.
Then, without verifying the newly filed tax slips, the Canada Revenue Agency authorized the payments and promptly began making the initial instalments, according to sources.
An investigation by CBC’s The Fifth Estate and Radio-Canada has learned the scam might never have been detected, except for one thing.
CIBC became alarmed after noticing the government of Canada had deposited an unusually large payment of $10 million to a customer’s bank account.
The bank contacted the CRA to make sure it hadn’t made a mistake.
Only then did the agency realize it had been duped, according to sources.
The Fifth Estate and Radio-Canada are not identifying the sources because they are not authorized to speak publicly.
A Fifth Estate/Radio-Canada investigation has uncovered that hackers accessed thousands of Canada Revenue Agency accounts, changed direct deposit information, submitted false returns and reportedly pocketed tens of millions in bogus refunds.
“The CRA has to clean up its act,” said André Lareau, an associate tax professor at Laval University in Quebec City, in an interview with The Fifth Estate/Radio-Canada.
Lareau said the CRA has a mandate to “assess and evaluate the veracity” of tax returns and that it “cannot execute its functions by just refunding the amount that is claimed.” He said this is especially the case when taxpayers amend multiple tax returns.
Calls for investigations
On Monday, opposition parties called for probes into revelations the CRA had paid out hundreds of millions in bogus refunds, after The Fifth Estate/Radio-Canada reported that tens of thousands of taxpayers’ CRA accounts have been hacked since 2020.
In response to a request from Conservative MP Adam Chambers on Monday, the federal privacy commissioner’s office said Tuesday it would be conducting “an investigation into whether the CRA complied with the Privacy Act.”
Chambers also called on Revenue Minister Marie-Claude Bibeau to bring in the RCMP.
“Over $190 million have been improperly paid to scam artists because of privacy breaches at Revenue Canada. Will the minister … call in the RCMP about this privacy breach so that taxpayers can be repaid?” he asked.
Canadians have been largely kept in the dark about the extent of losses to the public purse, as well as the weaknesses at the CRA in spotting the schemes in the first place, The Fifth Estate/Radio-Canada’s investigation found.
CRA discovered scheme had been widely used
According to sources, once the CIBC raised those red flags about the unusual $10-million deposit to a customer’s bank account, the agency immediately tried to recover the public’s money.
Of the money the CRA had wrongly paid out, $4 million had already been transferred to other banks or spent on purchases. But the agency also had to scramble to stop another $10-million payment that was automatically scheduled to be paid out only three days later, and another for $20 million the following week.
The agency eventually came to learn it had been duped by numerous other scammers using the same fake T4A scheme in 2023.
According to sources, the CRA soon realized it had few, if any, policies in place to verify the legitimacy of those tax slips, even if the refunds were into the tens of millions of dollars.
In an email Monday, the Canada Revenue Agency said that it became aware of a scheme using “false T4A slips” in 2023 that resulted in “unwarranted refunds.”
The CRA said it is aware of who the participants are in the fraudulent scheme and that it “took swift action” to shut it down.
The agency says it is making “every enforcement action at our disposal to return these funds.”
A simple scam
The scam itself was, in retrospect, breathtakingly simple, according to sources.
The scammer went online and filed a T4A slip — used for reporting certain kinds of income — and claimed bogus refunds by amending multiple past tax returns.
The tax slips featured no new income, but included large tax deductions despite no tax having been paid in the first place.
Soon after the $10-million CIBC deposit was detected, the CRA changed its policy to try to ensure any refund of this type over $50,000 would have extra scrutiny, according to sources.
CIBC declined to comment.
‘Canadians deserve a full account of what went wrong’
In a statement, NDP revenue critic Niki Ashton said it was “shocking” that so many Canadians had their personal data breached and bogus refunds paid out to scammers. Ashton said there should be a parliamentary inquiry into the CRA’s “mishandling of tax fraud and tax cheating.”
“Canadians deserve a full account of what went wrong, how this happened and how we can ensure that this never happens again,” she said.
In a scrum outside the House of Commons earlier on Monday, Bibeau, the revenue minister, said that “fraud is obviously unacceptable but I believe that the agency has a robust system.”
She noted that scammers often rely on personal information they obtain from outside the CRA.
“We’re working hard to improve the system all the time and we have this capacity to detect, to block.”
Bibeau said that taxpayers affected by a breach are informed “as soon as possible.”
“We always want to do better, but we still have a strong system.”
In its statement, the CRA said it takes the abuse of Canada’s tax laws seriously.
“The confidence and trust that individuals and businesses have in the CRA are the cornerstones of Canada’s tax system.”
- If you have any tips on this story, please email in confidence, Harvey.Cashore@cbc.ca or Daniel.Leblanc@cbc.ca or phone 416-526-4704.