The Canada Revenue Agency has temporarily locked an unspecified number of online taxpayer accounts as a “precaution” after an internal analysis revealed some account credentials such as user IDs and passwords may have been compromised, the agency said via email on Wednesday.
“These credentials were not compromised as a result of a breach of CRA’s systems. Rather, they have been obtained through a variety of means by sources external to the CRA,” Christopher Doody, a CRA media relations representative, wrote. “As a precautionary security measure and to prevent unauthorized access to these accounts, we took swift action to lock the accounts and are in the process of contacting the legitimate account holders to unlock their accounts.”
Affected users received an alert on Tuesday saying their emails had been disconnected from their CRA accounts. The tax agency says it will work with those taxpayers to re-establish their credentials, prioritizing COVID-19 benefit recipients who need access to the CRA’s online platform in order to receive payments.
Jeremy Bellefeuille, press secretary at the Office of the Minister of National Revenue, said the CRA is regularly monitoring whether the same credentials taxpayers used for their CRA accounts have potentially been compromised in third-party leaks. If it finds external breaches, the agency locks the accounts.
Taxpayers affected by the precautionary lockouts will receive a letter from the CRA with instructions on how to contact the agency and authenticate themselves, Bellefeuille said.
Bellefeuille urged those who don’t have a pressing need to access their accounts to wait for the letter rather than contact the agency via phone.
However, many taxpayers will likely need to use the CRA’s online platform in the 2021 tax season, which kicks off on Monday, Feb. 22.
The CRA has not said how many taxpayers have been impacted.
And while the tax agency has begun reinstating access to some of the locked accounts, it hasn’t been sharing much information directly with affected users, Global News reporting indicates.
Phyllis Skrzyniak, an aesthetician in Aurora, Ont., for example, has regained control of her account after connecting with a CRA service representative at the end of an almost four-hour wait on Tuesday.
Skrzyniak, who told Global News she let her husband Rob handle most of the call with the CRA because she suffers from anxiety, says she is relieved to have regained access to her account. She was also impressed with the patience and professional demeanour of the CRA agent who handled her call, she says.
But when Skrzyniak spoke with Global News on Wednesday morning she said she still had no idea what prompted the CRA to temporarily freeze her account.
“I was just flagged for something I don’t even know of,” she says. “It’s not right that they’re not letting people know what’s happening.”
Across Canada, taxpayers who’ve been shut out of their own CRA accounts without explanation over the past couple of days expressed similar feelings: concern about suddenly being cut off the online platform, frustration at the long phone wait time, and puzzlement at the initial lack of answers about what happened.
Dozens of taxpayers have taken to social media sharing similar stories of frozen accounts and hours spent waiting for assistance through CRA phone helplines.
In Summerside, N.L., IT worker Barry Wheeler says he was worried his blocked account might be connected to a security breach like the one CRA reported in August of last year, which compromised the usernames and passwords of thousands of accounts.
“My anxiety was through the roof,” Wheeler told Global News via email.
Wheeler says a CRA agent restored access to his account on Tuesday evening after three and a half hours on the phone.
“All is good now, and I have to be honest, other than the long wait times, I was pleased with things,” Wheeler wrote, describing the agent he spoke with as “very professional” and “very understanding.”
But not everyone found a resolution at the end of a more than three-hour phone call.
In Calgary, Jessy Roos, who runs a small mental health counselling agency, has yet to be allowed back into her CRA account. After a three-hour wait on Tuesday, she says her call was simply disconnected.
When Roos tried to call CRA at 9 a.m. M.S.T. on Wednesday, she says she couldn’t get through. After a recorded message about all agents being unavailable, the system simply hung up, she says.
Roos, who has been receiving the Canada Recovery Benefit, says she can’t submit a request for her next payment without access to her CRA account.
She plans to phone CRA again later Wednesday, a time-consuming task she expects will eat into her workday. But Roos calls herself “lucky” to be able to set her own hours as a small business owner.
“I have the flexibility to choose when to take these calls and how much time I can spend on it when I know other people don’t necessarily have that choice,” she says.