Hacked Accounts and Stolen Identities
From Kelowna, British Columbia, to Ottawa, Canadians are grappling with the fallout of identity theft, as criminals exploit vulnerabilities within the Canada Revenue Agency (CRA) system. Victims are fighting to clear their names after scammers accessed their accounts and filed fraudulent tax returns.
Heidi Germann, a waitress from Creston, B.C., found herself wrongly accused of tax fraud after someone hacked into her CRA account in May 2023. Using her stolen identity, the imposter secured a bogus tax refund. “I want to know how to get my identity back,” Germann told CBC’s The Fifth Estate. The program investigated Germann’s case and found she was one of many victims.
The Scope of the Scam
The Fifth Estate’s investigation revealed how imposters are exploiting a side-door entry to gain control of Canadians’ CRA accounts. Hackers are reportedly obtaining special access codes assigned to third-party tax preparer companies.
Once inside the account, the scammers use stolen personal information, like Social Insurance Numbers, to file fake income slips, change direct deposit details, and redirect refunds into their accounts. These schemes have cost the CRA millions of dollars.
One CRA analyst wrote, “Canadians will lose trust in the agency,” after detailing how one case alone saw “bad actors” take over hundreds of accounts, defrauding the agency of over $6 million.
Whistleblowers claim that the CRA is downplaying the true amount of losses, with one source stating, “It literally benefits nobody to hide the reality.”
The integrity of tax compliance in Canada has been described by one source as being like that of the “Wild West.”
Victims Wrongly Blamed
Germann’s story highlights the CRA’s apparent failure to verify claims before issuing refunds. Initially, in 2024, Germann was wrongly blamed for a fraudulent tax return and threatened with wage garnishment. She had to pick up extra shifts at Jimmy’s pub in Creston, B.C., because of the lack of refunds.
The CRA incorrectly stated that Germann filed a fraudulent return through H&R Block, even though she wasn’t a client and hadn’t yet filed her taxes that year.
The Fifth Estate decided to investigate the scammers further.
Tax Filers and Security Concerns
The investigation exposed the role of the tax filer industry, a $14 billion-a-year business in North America, and a $1.7 billion a year industry in Canada alone. According to IBISWorld, the top two tax filer firms in Canada are U.S.-owned, Intuit and H&R Block. More than 90% of Canadians file taxes online using third-party tax preparers.
The CRA website provides links to 25 private firms offering tax filer services. Unlike accounting firms, the CRA doesn’t require this industry to have specific qualifications.
Andre Lareau, an associate professor of tax law at the University of Laval, highlights how these tax filer relationships create vulnerability and risk.
He pointed out that the CRA suggests that Canadians use third-party tax filers on its website but advises taxpayers to check those companies’ confidentiality policies, as they are ultimately filing returns “at your own risk.” In 2024, almost 30 million people used tax firms or tax software to file their tax returns to the CRA.
Both Alberta and British Columbia’s privacy offices have reported tens of thousands of privacy breaches at Canadian tax preparer firms in recent years.
Shawna Roy, a former CRA investigator, said that she witnessed firsthand the exploitation of third-party access codes. She says weak security systems have created a “free for all” for fraudsters.
Roy, who worked in the agency’s anti-fraud unit, reported that the unit was disbanded despite recommending an audit of third-party tax firms. She left the agency in May 2024.
A Trail of Clues
Another victim, referred to as Paul, had his CRA account hacked in the summer of 2023. He discovered that three new “authorized representatives,” including “H&R Block” and “H&R Block Canada, Inc.,” had been added to his online account.
He had never used H&R Block and discovered that a T4 slip associated with his name had been flagged. It was later discovered that a bank account at DC Bank in Calgary, also under his name, received fraudulent tax returns. DC Bank understood his situation and promised to cooperate with the RCMP.
Bank records revealed that money had been spent, including on a cellphone purchase, meals, and a road trip. Paul obtained the bank records and, with the help of anti-fraud expert Vanessa Iafolla, proved that he was not associated with the transactions.
Following the Digital Footprints
The Fifth Estate tracked three fake companies involved in the tax fraud back to a house in Edmonton. The sole director of the companies was another identity theft victim.
Another company, “Expedited Enterprises,” was linked to a property in St. Albert, where Douglas Poplett lived. Poplett has a lengthy criminal history of fraud and was connected to Christina Cherpak, who also has faced identity theft charges.
CCTV Footage and Unanswered Questions
Analyzing DC Bank transaction records, the Fifth Estate traced the fraudulent activity to specific locations. CCTV footage from an Edmonton restaurant, Len’Steves, showed Doug Poplett and Christina Cherpak using a stolen credit card machine.
The Fifth Estate also investigated how H&R Block was involved. Paul’s tax return was filed at a franchise location in Spruce Grove, Alberta, from which H&R Block has been unable to provide answers. However, H&R Block has claimed the investigation is based on “speculation.”
The CRA and its commissioner declined to be interviewed for the story, but Commissioner Bob Hamilton has stated that the agency has teams addressing fraud.
A confidential source estimates that the value of the fraud could be closer to $500 million in recent years. They stated that Canadians should be angry and that “Tax season is coming, it’s going to happen all over again.”
Both Germann and Paul are still waiting for apologies and for the CRA to resolve the situation. Germann is also picking up extra shifts at her job to offset the benefits she is not yet receiving. Paul is worried about who else might have been involved. “I’m one of so many people that unfortunately has been victim to [a] sophisticated scheme. I don’t know how big it is. I don’t know how far it goes.”
