Scam texts in Canada: how to spot fake CRA, Canada Post and 407 ETR messages

Scam texts work because they look like the messages we get every day: a tax refund, a parcel update, a toll statement, a fraud check from the bank. The link is the trap — it leads to a convincing copy of a real website that asks for a payment, your card details or a login. Get Cyber Safe — the Government of Canada campaign led by the Communications Security Establishment — calls this smishing: phishing by text message.

The scam texts Canadians see most

• The CRA — a refund waiting, a balance owing or a problem with your account, with a link to 'sort it out'.
• Canada Post — a parcel that needs a payment, a new delivery date or your card details.
• 407 ETR — 407 ETR says it's seeing increasing reports of messages impersonating the company.
• Your bank — 'Did you make this payment?' or 'Your account is locked', followed by a link or a request for a code.

The Canadian Anti-Fraud Centre received more than 112,000 fraud reports in 2025, with over $704 million in reported losses — and phishing alone accounted for 2,869 reports.

What the genuine messages look like

• The CRA says it only sends text messages for multi-factor authentication when you've chosen the telephone option, and that it will not use text messages or instant messaging such as Facebook Messenger or WhatsApp. It won't send refunds by e-transfer or text, or demand payment by Interac e-Transfer, cryptocurrency, prepaid cards or gift cards.
• Canada Post says its genuine tracking and notification texts only come from 272727 or 55555, and only if you signed up for them. It will never text you to ask for card or banking details, login details, or payment for deliveries or tracking.
• 407 ETR says it will never ask for passwords, PINs or credit card details in text messages or emails, and that you should only sign in at 407etr.com or through its app.
• The Canadian Bankers Association says your bank will never call, email or text to ask for sensitive information such as passwords, login details or one-time passcodes.

How to check without tapping the link

1. Don't tap the link and don't reply.
2. Sign in to your CRA account, bank or the company's app yourself — by typing the address or opening the app — and look for the same message or charge there.
3. For a parcel or toll notice, check on Canada Post's own website or at 407etr.com, using details you already have.
4. If you're still unsure, call the organization on a number you already know is real, such as the one on the back of your bank card.

How to report a scam text

• Forward the text to 7726 (SPAM on most keypads). Get Cyber Safe says this alerts your cellular provider, is free and won't count against your messaging plan.
• Report it to the Canadian Anti-Fraud Centre at reportcyberandfraud.canada.ca or on 1-888-495-8501 — the CRA asks you to report scam attempts even if you didn't share anything.
• Canada Post says you don't need to report suspicious texts to it — send them to 7726 and the CAFC instead.
• Then delete the message.

If you've already tapped, paid or shared details

1. Call your bank or card issuer straight away, using the number on the back of your card, and tell them what you shared.
2. Change the password on any account you entered on the fake site — and anywhere else you use the same password — and turn on two-step verification.
3. If you shared CRA sign-in details or your SIN, the CRA lists 1-833-995-2336 for a compromised CRA account and Service Canada's 1-866-274-6627 for SIN misuse.
4. If identity details were taken, ask Equifax and TransUnion to place a fraud alert on your credit file, and report it to the CAFC and your local police.

Can a security app help?

Partly. Get Cyber Safe recommends installing anti-virus and anti-spyware protection on a new computer and turning on automatic updates wherever you can. On phones, several security suites add scam-text and link checking on top of what the phone does itself. It's a useful safety net — especially for family members who are less confident online — but no app replaces the habit of checking through the official app or website before you pay anything.

The message isn't the scam. The link is. Go to the real website yourself, every time.