What to Do If Your CRA Account Is Locked in Canada

Common Reasons Your CRA Account Gets Locked

Your Canada Revenue Agency My Account can become locked for several specific reasons, most commonly related to login security. Entering your CRA user ID or password incorrectly multiple times in succession will trigger an automatic lock on the account as a protective measure against unauthorized access. Forgetting your credentials entirely and making repeated failed attempts to retrieve them is another frequent cause of a lockout. In recent years, the CRA has also proactively locked large numbers of accounts as a cybersecurity precaution, such as the instance where 800,000 user IDs and passwords were revoked after the agency learned credentials may have been obtained by unauthorized third parties through external sources like phishing scams. It is important to note that these mass lockouts are not due to a breach of the CRA’s own online systems but are a defensive action. Understanding the cause of your lockout can help you choose the most efficient path to regaining access to your tax information and online services.

Immediate Steps to Regain Access to a Locked Account

When you find yourself locked out of your CRA account, your first action should be to remain calm and assess which recovery options are available to you. The CRA explicitly states that you do not need to call if you are only temporarily locked out, which often refers to a short-term lock from incorrect password entries. Your immediate recourse is to try signing in using a different login method that you may have previously set up, such as a second CRA user ID, your online banking login, or a BC Services Card. If one method fails, you have other avenues to attempt before resorting to a phone call, which can involve long wait times, so the goal is to use an existing, verified credential to bypass the lock on your primary login method and access your account dashboard. Success with an alternate method allows you to manage your tax affairs immediately while you address the issue with your primary credentials. You should attempt the following steps in order:

• Use a different CRA user ID and password if you had more than one set up for your account.
• Sign in using a Sign-In Partner, which is typically your online banking login from a participating Canadian financial institution.
• If you are a resident of British Columbia, use your BC Services Card details to log in.
• If the above options are unavailable or fail, proceed to create a new CRA user ID through the registration process.

Creating a new CRA user ID involves completing the first step of registration online, which grants you limited access to your My Account. The CRA will mail a security code to your address on file to give you full access. You can still file your tax return online and apply for emergency benefits while you wait for your security code. The security code typically takes about ten days to arrive in the mail.

The Process for Creating New CRA Credentials

When you cannot access your account through any alternate sign-in method, your next step is to register for a new CRA user ID and password. This process is designed to verify your identity securely and can be initiated online without calling the CRA by visiting the CRA login page and selecting the option to register for a new credential. Upon completing this first phase, you are granted limited access to your My Account, which allows for some basic functions, but to lift all restrictions and gain full access, the CRA must mail a physical security code to the residential address they have on record for you. This mailing process is not instantaneous and typically takes approximately ten days for delivery, so planning ahead is crucial if you need full account access by a specific date, and it is vital to use your current and correct mailing address during this process. The security code cannot be sent electronically or provided over the phone for security reasons, and once it arrives, you must return to the CRA website and enter it to complete your registration and unlock full account functionality.

During the interim waiting period, you retain the ability to file your current year's tax return electronically and apply for any relevant benefit programs, which ensures a lockout does not prevent you from meeting your obligations or receiving support. This mailed security code procedure is a standard security protocol the CRA uses to prevent identity fraud and ensure that only the legitimate account holder can restore full access, and it was a key part of the process for the 800,000 accounts locked in 2021. If you have forgotten your CRA user ID or password, you may be able to register for a new credential online with no need to call, and you can get your most recent information once full access is restored. The CRA will mail you a new unique password that you can use to get back into the system, and this mail can be time consuming but is a necessary security step.

What to Do If Online Recovery Options Fail

If you have exhausted all online recovery options, such as alternate logins and new credential registration, and you still cannot access your CRA account, your final recourse is to contact the CRA directly by telephone. The general inquiries line to call is 1-800-959-8281, where an agent can assist you with reactivating your account, but you should be prepared for potentially long wait times, especially during peak periods like the tax filing season. When you speak with an agent, you will need to verify your identity by answering security questions based on the information the CRA has in your file, such as details from your past tax returns or personal information, and in some specific cases, reactivating a locked account may involve fulfilling other outstanding obligations, such as filing a past due tax return, before access is restored. For individuals who cannot or prefer not to wait on the phone, an in-person visit to a Service Canada office is another potential avenue for resolving account issues where you would need to bring government-issued photo identification and your Social Insurance Number (SIN).

Representatives may need to submit a power of attorney to represent a client with a locked account. If you are still unable to access your account after a certain date, such as March 22, 2021, you should call the CRA. You should bring your SIN number and identification if you go in person to Service Canada. The CRA will require identity verification to unlock your account.

Managing Tax Obligations During an Account Lockout

A locked CRA account does not prevent you from meeting your core tax filing responsibilities or accessing emergency benefits, as you can still file your personal income tax return online through various certified tax software platforms or through a professional tax preparer. Tax professionals can often use tools like the Auto-fill my return service, which requires specific authorization, to retrieve necessary information like T4 and RRSP data directly from the CRA on your behalf, and if you are filing yourself, you will need to rely on the physical tax slips and financial documents you have received from employers and other payers. The ability to apply for programs like the Canada Emergency Benefit was specifically maintained during the mass account lockouts, ensuring that financial support was not interrupted by security measures, and if you are expecting a refund or need to make a payment, you can still do so through your tax software or your financial institution's online bill payment service using the CRA as the payee and your SIN as the account number. The key limitation during a lockout is your inability to directly view notices of assessment, benefit statements, or carryforward amounts stored in your online account, but these documents are also mailed to you, and critical deadlines like the April 30 filing date remain in effect regardless of your account access status.

Planning your filing process around the potential ten-day wait for a security code is an important part of managing your obligations smoothly during a lockout period, and using a tax professional can help bypass some of these access issues if you need to file urgently. There are many ways you can still file a tax return without your information, including contacting a tax preparation service that can request authority to access your account and use the Auto-fill service once they begin your tax return. You may contact a service to have them file the return for you as they will be able to retrieve the important information needed to file your return, and they have the ability to request authority to access your account. During this time while you wait for account access, the CRA will mail you a new unique password that you can use to get back into the system, and this mailed process, while time consuming, does not stop you from filing.

Preventing Future CRA Account Lockouts

Taking proactive measures can significantly reduce the risk of your CRA account becoming locked in the future, starting with securely recording your CRA user ID and password in a safe place, such as a password manager or a locked physical document, to prevent forgetting them. Enrolling in and properly managing multi-factor authentication (MFA), which may involve receiving a one-time passcode, adds a critical layer of security that can prevent unauthorized access even if your password is compromised, and it is also prudent to set up at least one alternate sign-in method, such as linking your online banking credentials as a Sign-In Partner. Regularly updating your contact information, especially your mailing address, with the CRA ensures that any critical communications or security codes can reach you without delay, and remaining vigilant against phishing scams and fraudulent communications that impersonate the CRA is essential, as these are a primary external source for credential theft. Never provide your CRA login details, SIN, or personal information in response to an unsolicited email, text message, or phone call, and periodically logging into your account, even outside of tax season, can help you stay familiar with your credentials and monitor your account for any unusual activity.

By implementing these practices, you maintain control over your access and help the CRA's security systems protect your sensitive financial and personal data from third-party threats, minimizing future disruptions and the frustration of a locked account. Keeping your passwords and user IDs in a safe place so that you can locate them in the event of not being able to login is crucial, as losing your login details and having your CRA account locked keeps you from obtaining very important information. The benefits of using your My CRA Account include accessing tax information and managing benefits, so taking these type of measures will help you stay on top of your account and watch for any suspicious activity. The CRA uses your bank login details to verify you as a secure way of keeping your identity secure, so setting up this Sign-In Partner option provides a reliable backup method.

Frequently asked questions

Sources and further reading

1. My CRA account is locked. What should I do? support.hrblock.ca
2. Is your CRA Account Locked? Find out everything you ... accufile.ca

This article explains how things work and is not financial, tax or legal advice. Rules, limits and rates change, so check the current figures with the Canada Revenue Agency, your province or your financial institution before you act.