Who’s Hacking CRA Accounts?
Across Canada, victims of identity theft are desperately trying to clear their names after scammers gained access to their Canada Revenue Agency (CRA) accounts. A recent investigation by CBC’s The Fifth Estate reveals the scope of the problem and the challenges faced by those affected.
Heidi Germann, a waitress from Creston, B.C., is one such victim.
In late May 2023, someone hacked into her CRA account, stole her identity, and used it to obtain a fraudulent tax refund. Since then, Germann has been fighting to prove her innocence and regain control of her identity.
“I want to know how to get my identity back,” she told The Fifth Estate.
This case is just one example of a widespread scam that’s plaguing the CRA, where imposters are gaining control of Canadians’ tax accounts by posing as authorized tax representatives. Whistleblowers, leaked documents, and testimonies from numerous victims have painted a picture of hackers exploiting a side-door entry to gain access to Canadians’ CRA accounts. They are doing this by obtaining access codes assigned to third-party tax preparer companies in Canada.
The Scam’s Mechanics
Once inside an account, armed with stolen personal information like a social insurance number, the imposters file a fake T4 slip, change direct deposit information, and mislead the CRA into paying out a bogus refund into the scammer’s bank account – all without the victim’s knowledge. These schemes have led to the CRA paying out tens of millions of dollars to scammers.
A CRA analyst, after documenting how “bad actors” had taken over hundreds of Canadians’ tax accounts and duped the agency into paying out over $6 million, wrote, “Canadians will lose trust in the agency.”
Whistleblowers allege that the CRA is misleading the public about the true extent of the financial losses due to imposters. “It literally benefits nobody to hide the reality,” said one source.
Some whistleblowers are not being identified in this story, as they fear retribution for speaking out. “We are constantly reminded of how bad it could be to breach privacy at work,” the source said. However, they believe “no organization in Canada breaches privacy for Canadians more than the CRA.”
“Canadians would be shocked to learn the extent to which the CRA is ignoring tax fraud in Canada,” another agency source told The Fifth Estate. “Tax compliance in Canada has essentially become the Wild West.” Germann’s story is also another example of the CRA paying out refunds without verifying the claims, even when simple Google searches might have raised red flags.
A Victim Fights Back
Germann’s account of the events unfolds, starting with the CRA wrongly blaming her for filing a bogus tax return in 2024. The agency sent her a notice of wage garnishment unless she paid back $10,046.90 – money the agency had paid out to the scammers.
“That’s what freaked me out,” she said. “I’m responsible for these kids.” Germann has had to take on extra shifts at her job because of the hacked account, and the difficulties it has caused.
The CRA incorrectly alleged that she had filed a fraudulent tax return through H&R Block in Alberta. However, Germann knew this was untrue, as she didn’t use H&R Block and hadn’t filed her taxes yet.
After months of research, The Fifth Estate discovered that Germann was involved in a larger scheme that involved, amongst others, H&R Block, a digital online bank in Calgary, and other British Columbians whose identities were stolen. When Fifth Estate host Mark Kelley showed Germann a bank statement with her name on it that had been used by an imposter, she said, “That’s my name. Really creepy.”
Tax Filer Firms and the CRA
To understand the full context of what happened to Germann, and what could happen to others, an examination of how the third-party tax filer companies became a big business in Canada and the United States is crucial. The top two tax filer firms in Canada, Intuit and H&R Block, together form part of a $14 billion-a-year industry in North America, according to IBISWorld. In Canada alone, the industry is worth $1.7 billion annually.
More than 90% of Americans and Canadians file online using third-party tax preparers or their software. The CRA website provides links to 25 private firms offering tax filer services.
Unlike accounting firms, which require their employees to have university degrees, the CRA doesn’t insist tax filers have any minimum qualifications. H&R Block offers a 60-hour online tax school course. Andre Lareau, a tax law professor at the University of Laval in Quebec City, believes that the relationship between tax filers and the CRA creates an additional layer of vulnerability, leaving taxpayers’ private information at risk of hackers.
Federal data security legislation at the CRA doesn’t apply to tax firms, he says. Lareau noted that while the CRA directs Canadians to use third-party tax filers and has “certified” their software, it also tells taxpayers in the fine print that they are “responsible” for checking their “confidentiality policies.”
“In other words,” says Lareau, “the CRA encourages you to file your return online, it gives you the link to these platforms, but it warns you that you do so at your own risk.”
Both the Alberta and British Columbia privacy offices have reported tens of thousands of individual privacy breaches at Canadian tax preparer firms in recent years. For privacy reasons, they won’t identify the specific firms involved.
In the U.S., H&R Block reported a cybersecurity breach last year that lasted for three months and affected over 23,000 customers.
Former CRA investigator Shawna Roy states that access codes used to steal the identity of Canadians and receive bogus refunds are being exploited by “bad actors.” After quitting the agency last May, she is speaking out publicly for the first time.
Roy believes the CRA’s security systems are so weak that it’s a “free for all” for fraudsters. She says they use those electronic credentials to “steal identities of Canadians and exhaust every benefit possible.”
In 2020, Roy worked in an anti-fraud unit called the Business Intervention Team, where she discovered bad actors using tax preparer credentials to hack into Canadian accounts. She said that she recommended the CRA audit third-party tax preparation firms to root out imposters. This recommendation, she said, was ignored, and eventually, the unit was disbanded.
The Kelowna Victim and a Clue
Germann’s CRA account remains frozen, preventing her from filing her real return and receiving child tax benefits and other credits. When she finally contacted the CRA’s identity protection office, she realized how many other Canadians’ accounts had been hacked. She recalls an employee saying, “This could take a long time, because there’s so many people.”
In Kelowna, a man who goes by the name “Paul,” had a clue that could help solve the mystery. His account was also hacked in the summer of 2023. He was in contact with The Fifth Estate after reading the stories of other hacked CRA accounts.
Paul also received a letter from the CRA in the spring of 2024 implying he was the fraudster, demanding $30,000 in fraudulent returns. Paul was given a fake T4 slip with his name. He noticed three new “authorized representatives” – H&R Block, H&R Block Canada, Inc., and Rochelle [last name withheld] – on his CRA account. He contacted H&R Block, as he’d never used their services.
The Bank Account Trail
Paul, after contacting H&R Block and being promised a fraud investigation, received a letter from “DC Bank” in Calgary. He had never heard of DC Bank. He says that the bank told him that “your accounts are being closed.” He called the bank and learned that multiple refunds had been issued to his name. The bank agreed to co-operate with a criminal fraud investigation.. Paul then obtained his bank records from DC Bank.
Paul’s bank records showed transactions from a prepaid Mastercard account, which was used by the imposter. This included a $9,372.20 deposit, e-transfers totaling almost $4,000 to unknown parties, and spending at various locations, including a cellphone store, restaurants, and a trip to Banff.
One month later, there was also an e-transfer of $255 into the imposter’s account from someone named Heidi Germann. Bank records provided the proof he needed. He told H&R Block what he found, but was told they couldn’t find his account.
Anti-fraud expert Vanessa Iafolla, principal at Anti-Fraud Intelligence Consulting in Halifax, assessed the bank records.
Iafolla stated, “The fact that people can have accounts set up that are in their name, but they had absolutely no relation to setting up is wild. And especially when those accounts are used to scam the Canada Revenue Agency. That’s a real serious problem for the corporations that are allowing their accounts and their businesses to be used in this way.”
The Edmonton Connection
The Fifth Estate traced fake T4 slips to a house on 132nd Avenue Northwest in Edmonton, connected to the tax fraud. The fake T4 slips are created by fake companies that claim to be the employers of the tax filers. A fake T4 slip is essential in the scam, needed for the imposters to claim bogus tax refunds.
The sole director of the companies was someone else whose identity had also been stolen, from British Columbia’s Interior. The address on 132 Avenue Northwest was listed on the fake T4 slips.
Another fake company, “Expedited Enterprises,” was also listed at the address. The second address listed for the company led to Douglas Poplett.
Poplett faced theft charges in 2020. His Facebook page showed that Poplett and wife, Christina Cherpak, had married in 2021.
CCTV Footage Reveals the Imposters
The Fifth Estate analyzed DC Bank transaction records to find spending locations related to the fraud.
At a restaurant called Len’Steves in Edmonton, the owner, Len Regondola, found that her credit card machine had been stolen on August 23, 2023. Two customers, a man and a woman, arrived at the restaurant and stayed until well after closing. The machine was replaced with one belonging to another business. The fraudsters attempted to give themselves over $25,000 in refunds.
Regondola caught the scam, but had CCTV footage from the time. The footage revealed that the man matched the description of Douglas Poplett. The woman in the footage appeared to be Poplett’s wife, Christina Cherpak.
H&R Block’s Role
Paul’s attempts to find answers from H&R Block resulted in limited success. He recalls there were three e-tranfers on the DC Bank Card to unknown recipients immediately after the bogus refund was deposited. Freake assigned him a new reference number and assured him that they would launch an internal fraud investigation. Days went by before Freake said that the office filing his taxes was a franchise office, and that the corporate office couldn’t see the information.
In January, the Fifth Estate visited the H&R Block franchise in Spruce Grove, Alberta, where the fraudulent tax return was filed.
Cherry Sekura, the owner of the franchise, declined to speak with the host. H&R Block declined to answer specific questions, stating that the Fifth Estate’s investigation was “misleading and irresponsible” and based on “speculation.”
DC Bank explained that they closed Paul’s account due to “abnormal” patterns. The CRA declined to be interviewed about the hacked accounts and stolen identities.
CRA Commissioner Bob Hamilton said that the agency has “dedicated teams to address fraud” and has repelled hundreds of thousands of attacks. Whistleblowers say that Canadians haven’t been given a full accounting of the money stolen.
The source put it this way:“Tax season is coming, it’s going to happen all over again.”
Back in Creston, Heidi Germann is still working extra shifts to make up for lost benefits. She has not received an apology from the CRA. In Kelowna, Paul remains concerned about his identity’s disruption.
“I’m one of so many people that unfortunately has been victim to [a] sophisticated scheme. I don’t know how big it is. I don’t know how far it goes.”
