Updated March 29 with comments from the CRA about security measures

Taxpayers are struggling with the fallout of cybersecurity breaches involving the Canada Revenue Agency. Many who were victims of fraud after their accounts were hacked are fighting to clear their names.

Last year, the CRA revealed that thousands of taxpayers were victims of fraud involving the Canada Emergency Response Benefit. Thieves hacked their accounts and applied for CERB money in their name. The culprits used a cyberattack called credential stuffing, testing previously stolen user names and passwords across different websites, including the CRA.

Claire Storness, who lives in Metro Vancouver was a victim. In June, she received a notice stating that her bank account information was changed. She later learned that thieves had received $10,000 in her name and had deposited it in three different bank accounts across the country.

“It’s very worrisome for us and we feel quite anxious about it,” said Storness.

She says she reported it to the CRA in July, contacted her banks, filed a police report, reported it to the Canadian Anti-fraud Centre, enrolled in credit monitoring, opened new bank accounts, changed passwords and made repeated calls to the CRA.

She says someone from a CRA investigation team contacted her to launch an investigation, but she has since received a T4A showing $10,000 in CERB income. She was on the hook to pay it back and pay taxes on it. Normally, she says, she receives a tax refund every year.

“That will be obliterated if I have to pay tax on money I never received,” Storness said. “It’s just a terrible problem trying to get through to them. No department seems to know what the other one’s doing and I have to retell the whole story over again.”

After trying for months to resolve it, she contacted McLaughlin on Your Side. We reached out to the CRA and the next day the agency contacted Storness.

“Oh, I was so relieved. I couldn’t believe it at first,” she said.

Storness says they asked her to provide two pieces of ID showing her address and a void cheque to put new deposit information on file. When CRA received it, the agency said, she would be disassociated from the T4A and CERB systems.

In a further email to CTV News, a CRA spokesperson said: “The CRA is prioritizing fraud and identity theft calls, and ensuring that they are being answered as quickly as possible … Taxpayers who are confirmed victims of identity fraud will not be held responsible for any money paid out to scammers.”

“In the event that an individual needs to file their return before the corrective measures have been completed, they should only file using the income they actually received,” the spokesperson continued. “If they are using ‘auto-fill my return,’ they will need to manually uncheck the T4A slip that contains incorrect information.”

The agency also confirmed that as part of Identity Protective Services (IPS), the CRA contacts the affected taxpayers by phone in order to support them through the process.

Storness said she had concerns when she received a call from an investigator who started asking personal questions to verify her identity. She got a name and an employee number and called the CRA to confirm that person’s identity.

CTV News questioned that practice by the CRA, reminding them that scammers often call Canadians pretending to be with the CRA in an attempt to seek personal information for identity theft purposes.

We asked the CRA to confirm if the investigator who called Storness was legitimate and we suggested that perhaps the agency could set up a general phone number listed on their website for the IPS.

With such a system, when investigators call taxpayers who reported being victims of fraud, they could just give them their name and employee ID number. Then, the taxpayer would go to the CRA website, confirm the number for Identity Protective Services, call it and ask to be transferred to that investigator.

It would add a layer of protection and added confidence for taxpayers already suffering from anxiety after being the victims of fraud.

The CRA welcomed our suggestion but also responded responded by saying the call Storness received was indeed from one of its agents. In addition, the CRA stated, "taxpayers who receive a letter from the CRA as a result of being victims of fraud are provided with the direct number to the staff that are trained to assist them." 

Storness is adamant she did not receive a letter and taht the call she received from an investigator was a cold call. However, she says she is feeling a bit more relieved about the whole situation.

“It’s amazing that when you got involved things started happening right away and I really appreciate that you were able to do that,” she told CTV News.