In a Facebook post Tuesday, the agency said the messages also claim the notice is not available in the recipient’s CRA account and must be downloaded within a limited time.
The CRA lists it on its scam alerts page as a new notice of assessment phishing scam. The agency said the messages tell recipients that amounts on their return appear incorrect, incomplete or inconsistent with their records.
According to the CRA, the scam is designed to pressure people into clicking a link or button so scammers can collect information they could misuse. Downloading the file could also install malicious software on a device, the agency said.
The CRA said anyone who receives one of the messages should not click any links or buttons, download or open attachments, or reply. Taxpayers can instead check their mail, notices and statements by signing in to their CRA account directly.
The agency said it does not contact taxpayers by text message or through instant messaging services such as Facebook Messenger or WhatsApp. The only texts it sends are sign-in codes for people who chose the phone option for multi-factor authentication.
Emails from the CRA will not include a link asking for personal or financial information, the agency said. Official CRA web addresses either start with canada.ca or end in cra-arc.gc.ca.
The CRA is asking people who receive the messages to report them through the federal government’s cybercrime and fraud reporting system.