CRA leadership knew of major gaps in fraud detection as agency paid out bogus refunds, records show

In early 2024, senior officials at the Canada Revenue Agency were so concerned it had wrongly authorized bogus refunds of tens of millions of dollars that they wrote confidential briefing notes stating that the agency was plagued by significant "gaps" in its ability to spot — and stop — scammers, records show.

The Fifth Estate/Radio-Canada has learned that the agency knew of "major risks" in its fraud detection systems, including one previously undisclosed scheme that led to a potential loss of $100 million in bogus payouts since last November.

According to sources, one of the most glaring weaknesses identified by senior managers was that imposters were able to pose as accountants or tax preparers and hack into taxpayer accounts.

"This impacts the agency's ability to detect suspicious activity both proactively and in a timely manner, resulting in undetected fraud, extended unauthorized account access and/or changes to accounts," said one internal memo written earlier this year. 

"This gap leads to financial losses, impacts the privacy of Canadians and could lead to media reports outlining a lack of action by the CRA."

According to sources, those concerns were raised internally, at the executive level in branches in charge of security of taxpayers' accounts.

The Fifth Estate/Radio-Canada is not identifying the sources because they are not authorized to speak to the media.

"Consensus is that these gaps pose major risks to the agency. While there are funding and [human] resource considerations, all agree that visibility is needed on the issue," the CRA memo concluded.

In public, however, Revenue Minister Marie-Claude Bibeau and her agency continue to paint a far different picture of the CRA's ability to detect fraudulent payouts.

"Fraud is obviously unacceptable but I believe that the agency has a robust system," the minister said three weeks ago in Ottawa. "The CRA's systems are solid. We are able to deal with and block attempts at fraud, inform those affected and ensure the necessary followup." 

The CRA recently said that it had confirmed losses of only $3 million this year to bogus refunds of taxpayer accounts hacked by fraudsters — a number it said was a "drastic reduction" from previous years.

Today, those assertions by the minister and her agency's senior leadership are coming under increasing scrutiny as multiple insiders have told CBC that the CRA knew that the numbers it presented to the public about bogus refunds were underreported and misleading.

"It literally benefits nobody to hide the reality," said one source.

In Parliament, committees in the Senate and the House of Commons have called on the minister and CRA officials to testify about recent revelations that tens of thousands of taxpayer accounts have been hacked by scammers and hundreds of millions of bogus refunds wrongly paid out.