In the summer of 2023, a Canadian taxpayer logged into his Canada Revenue Agency account, incorrectly altered his previous tax returns, and falsely claimed that he was suddenly owed more than $40 million in refunds.

The Canada Revenue Agency then authorized the payments without verifying the newly submitted tax receipts and began paying the first installments immediately, sources said.

Investigation from CBC Fifth Estate and Radio-Canada has learned that fraud may never be detected, except for one thing.

CIBC was alarmed after discovering that the Canadian government had deposited an unusually large payment of $10 million into a customer’s bank account.

The bank contacted the CRA to make sure it had not made a mistake.

According to sources, only then did the institution realize that fraud had been committed.

Fifth Estatee and Radio-Canada are not disclosing sources because they are not authorized to speak publicly.

WATCH | Hackers gain access to thousands of CRA accounts:

CRA paid out millions in fake tax refunds after hackers accessed thousands of accounts

The Fifth Estate/Radio-Canada investigation found that hackers accessed thousands of Canada Revenue Agency accounts, altered direct deposit information, submitted false returns and reportedly pocketed tens of millions of dollars in fraudulent refunds.

“The CRA needs to clean up its act,” said André Lareau, a tax professor at Laval University in Quebec City. Fifth Estate/Radio-Canada.

Lareau said the CRA has the authority to “assess and evaluate the accuracy” of tax returns and “cannot discharge its functions by merely refunding the amount requested.” This is especially true in cases where taxpayers make changes to more than one tax return, he said.

Call for investigation

Opposition parties on Monday called for an investigation into revelations that the CRA paid out hundreds of millions of dollars in fraudulent refunds. Fifth Estate/Radio-Canada tens of thousands of people taxpayers’ CRA accounts have been hacked since 2020.

In response to a request from Conservative MP Adam Chambers on Monday, the federal privacy commissioner’s office said in a statement on Tuesday that it would conduct “an investigation into whether the CRA complies with the Privacy Act.”

Chambers also called on Revenue Minister Marie-Claude Bibeau to deploy the RCMP.

“More than $190 million in improper payments were made to fraudulent artists due to privacy breaches at the Canada Revenue Agency. Will the Minister… call the RCMP about this privacy breach so taxpayers can be refunded?” he asked.

Canadians have been largely kept in the dark about the extent of losses to public coffers and the CRA’s weaknesses in detecting the schemes in the first place. Fifth Estate/Radio-Canada’s research found.

CRA finds widespread use of scheme

When CIBC raised red flags about an unusual $10 million deposit into a customer’s bank account, the institution immediately sought to recover the public’s money, sources said.

$4 million of the money the CRA mistakenly paid had already been transferred to other banks or spent on acquisitions. But the agency also had to scramble to stop another $10 million payment that was scheduled to be automatically paid just three days later, and another $20 million payment the following week.

The agency eventually learned that it had been duped by numerous other scammers using the same fraudulent T4A scheme in 2023.

According to sources, the CRA soon realized that even though the refunds amounted to tens of millions of dollars, there were few, if any, policies in place to verify the legitimacy of these tax receipts.

The Canada Revenue Agency said in an email Monday that it became aware of a scheme that used “incorrect T4A vouchers” in 2023 and resulted in “unfair refunds.”

The CRA said it was aware of the identity of those involved in the fraud scheme and “took swift action” to shut it down.

The agency said it was taking “every enforcement action available to us to return these funds.”

A simple scam

In retrospect, the scam turned out to be breathtakingly simple, sources said.

The scammer went online and presented a T4A receipt, which is used to report certain types of income, and altered past tax returns to request a fake refund.

The tax receipts did not include any new income, but included large tax deductions even though no tax had been paid in the first place.

According to sources, shortly after the $10 million CIBC deposit was detected, the CRA changed its policy to ensure that any such refunds over $50,000 were subject to extra scrutiny.

CIBC declined to comment.

‘Canadians deserve a full accounting of what went wrong’

NDP revenue critic Niki Ashton said in a statement that it was “shocking” that so many Canadians’ personal data was breached and fraudulent refunds were issued to fraudsters. Ashton said there should be a parliamentary inquiry into the CRA’s “mismanagement of tax evasion and evasion”.

“Canadians deserve a full accounting of what went wrong, how it happened, and how we can ensure it never happens again,” he said.

During a scuffle outside the House of Commons early on Monday, Revenue Minister Bibeau said “fraud is completely unacceptable but I believe the agency has a robust system in place.”

He noted that fraudsters often rely on personal information obtained from outside the CRA.

“We work hard to constantly improve the system and have the capacity to detect and prevent.”

Taxpayers affected by the breach will be notified “as soon as possible,” Bibeau said.

“We always want to do better, but we still have a strong system.”

In its statement, the CRA said it takes abuse of Canada’s tax laws seriously.

“The trust and confidence that individuals and businesses place in the CRA are the cornerstones of the Canadian tax system.”

• If you have any tips on this story, please email [email protected] or [email protected] or call 416-526-4704.