CRA duped in $40 million fake tax refund case. Why did it take a big bank to realize this?

In the summer of 2023, a Canadian taxpayer logged into his Canada Revenue Agency account, incorrectly altered his previous tax returns, and falsely claimed that he was suddenly owed more than $40 million in refunds.

The Canada Revenue Agency then authorized the payments without verifying the newly submitted tax receipts and began paying the first installments immediately, sources said.

Investigation from CBC Fifth Estate and Radio-Canada has learned that fraud may never be detected, except for one thing.

CIBC was alarmed after discovering that the Canadian government had deposited an unusually large payment of $10 million into a customer’s bank account.

The bank contacted the CRA to make sure it had not made a mistake.

According to sources, only then did the institution realize that fraud had been committed.

Fifth Estatee and Radio-Canada are not disclosing sources because they are not authorized to speak publicly.

WATCH |Hackers gain access to thousands of CRA accounts:

Widget Widget launch. Want to bypass the widget?

Widget Find widget. Want to go back to widget release?

CRA paid out millions in fake tax refunds after hackers accessed thousands of accounts

The Fifth Estate/Radio-Canada investigation found that hackers accessed thousands of Canada Revenue Agency accounts, altered direct deposit information, submitted false returns and reportedly pocketed tens of millions of dollars in fraudulent refunds.

The CRA needs to clean up its laws. André Lareau, an associate tax professor at Laval University in Quebec City, said in an interview: Fifth Estate/Radio-Canada.

Lareau said CRA has authority assess and evaluate accuracy tax returns and cannot fulfill its functions by merely returning the requested amount. This is especially true in cases where taxpayers make changes to more than one tax return, he said.

Call for investigation

Opposition parties on Monday called for an investigation into revelations that the CRA paid out hundreds of millions of dollars in fraudulent refunds. Fifth Estate/Radio-Canada reports tens of thousands of taxpayers’ CRA accounts have been hacked since 2020 (new window).

In response to a request from Conservative MP Adam Chambers on Monday, the federal privacy commissioner’s office said on Tuesday it would be carried out. An investigation into whether the CRA complies with the Privacy Act.

Chambers also called on Revenue Minister Marie-Claude Bibeau to deploy the RCMP.

More than $190 million in improper payments were made to fraudulent artists due to privacy breaches at Revenue Canada. Will the Minister … call the RCMP about this privacy breach so taxpayers can be refunded? he asked.

Canadians have been largely kept in the dark about the extent of losses to public coffers and the CRA’s weaknesses in detecting the schemes in the first place. Fifth Estate/Radio-Canada’s research found.

CRA finds widespread use of scheme

When CIBC raised red flags about an unusual $10 million deposit into a customer’s bank account, the institution immediately sought to recover the public’s money, sources said.

$4 million of the money the CRA mistakenly paid had already been transferred to other banks or spent on acquisitions. But the agency also had to scramble to stop another $10 million payment that was scheduled to be automatically paid just three days later, and another $20 million payment the following week.

The agency eventually learned that it had been duped by numerous other scammers using the same fraudulent T4A scheme in 2023.

According to sources, the CRA soon realized that even though the refunds amounted to tens of millions of dollars, there were few, if any, policies in place to verify the legitimacy of these tax receipts.

The Canada Revenue Agency said in an email Monday that it became aware of a scheme that used: false T4A shifts As a result in 2023 unfair refunds.

The CRA stated that it was aware of the identity of the participants in the fraudulent scheme and that took action quickly to close.

The agency says it does Any enforcement action we may take to return these funds.

A simple scam

In retrospect, the scam turned out to be breathtakingly simple, sources said.

The scammer went online and presented a T4A receipt, which is used to report certain types of income, and altered past tax returns to request a fake refund.

The tax receipts did not include any new income, but included large tax deductions even though no tax had been paid in the first place.

According to sources, shortly after the $10 million CIBC deposit was detected, the CRA changed its policy to ensure that any such refunds over $50,000 were subject to extra scrutiny.

CIBC declined to comment.

‘Canadians deserve a full accounting of what went wrong’

NDP revenue critic Niki Ashton said in a statement: shocking Many Canadians’ personal data was breached and fraudulent refunds were issued to fraudsters. Ashton says there should be parliamentary inquiry into CRA tax evasion and mismanagement of tax evasion.

Canadians deserve a full explanation of what went wrong, how it happened, and how we can ensure it never happens again. he said.

In a commotion outside the House of Commons early on Monday, Revenue Minister Bibeau said: Fraud is completely unacceptable, but I believe the agency has a solid system.

He noted that fraudsters often rely on personal information obtained from outside the CRA.

We work hard to constantly improve the system and have the capacity to detect and prevent.

Taxpayers affected by the breach have been notified, Bibeau said as soon as possible.

We always want to do better, but we still have a strong system.

In its statement, the CRA said it takes abuse of Canada’s tax laws seriously.

The trust and confidence that individuals and businesses place in the CRA are the cornerstones of the Canadian tax system.

Harvey Cashore (new window)Daniel Leblanc (new window) · CBC News ·