Key Points
CRA settlement offers up to $5,000 compensation for 2020 data breach victims.
Eligible Canadians affected by credential stuffing attacks can now file claims.
Scammers impersonate CRA with fake text messages during tax season.
Never respond to unsolicited CRA messages requesting personal information or urgent action.
A major Canada Revenue Agency settlement is now available for eligible Canadians affected by a 2020 credential stuffing attack. The settlement stems from a class action lawsuit involving Government of Canada online accounts, including CRA accounts, My Service Canada accounts, and GCKey-accessed services. Eligible Canadians may claim compensation of up to $5,000 for the security breach. As tax season intensifies, scammers are also impersonating the CRA through fake text messages and emails, making it critical for taxpayers to understand both the settlement opportunity and how to spot fraudulent communications.
Understanding the CRA Settlement and Eligibility
The settlement addresses the 2020 credential stuffing attacks that compromised federal online services. Eligible Canadians can claim up to $5,000 in compensation through the class action lawsuit. The breach affected multiple government platforms, creating widespread security concerns for millions of users across Canada.
To qualify, you must have had an account accessed through one of the affected services during the breach period. The settlement process is now open for eligible claims, and affected individuals should review their eligibility carefully before submitting documentation.
How to Protect Yourself From CRA Scams This Tax Season
Scammers are actively impersonating the CRA through text messages and emails claiming tax discrepancies or benefit holds. The Canada Revenue Agency never sends unsolicited text messages requesting urgent action, personal information, or links to click. These fraudulent messages often appear in both French and English, making them seem legitimate.
Scammers create convincing fake letters and messages designed to trick taxpayers into revealing sensitive data. Never click links in unsolicited messages or provide personal information via text or email. Always contact the CRA directly through official channels if you have questions about your account.
Red Flags and Verification Steps
Legitimate CRA communications arrive through official mail or your secure CRA account portal, never through text messages or unexpected emails. Watch for urgent language, threats of account holds, or requests for immediate action—these are classic scam tactics. Verify any CRA communication by logging into your account directly or calling the official CRA phone number.
If you receive a suspicious message claiming to be from the CRA, do not respond or click any links. Report the scam to the Canadian Anti-Fraud Centre and the CRA directly. Protecting your personal information is essential during tax season when scammers intensify their efforts.
Next Steps for Settlement Claims and Account Security
Eligible Canadians should gather documentation proving they were affected by the 2020 breach and submit their claims through the official settlement process. Keep records of any unauthorized account access or suspicious activity during the breach period. The settlement provides financial compensation for the security incident and the inconvenience caused.
After claiming compensation, strengthen your account security by enabling two-factor authentication on all government accounts. Change your passwords regularly and monitor your accounts for unusual activity. Stay informed about CRA communications and remain vigilant against tax-time fraud schemes targeting Canadian taxpayers.
Final Thoughts
The CRA settlement offers eligible Canadians meaningful compensation for the 2020 credential stuffing attack, but scammers are exploiting tax season with fake messages. Verify all CRA communications through official channels, never respond to unsolicited requests for personal information, and report suspicious activity immediately. Claim your settlement if eligible while protecting yourself from fraud.
FAQs
Eligible Canadians affected by the 2020 credential stuffing attack can claim up to $5,000 in compensation through the class action settlement.
You’re eligible if your account was accessed through CRA, My Service Canada, or GCKey services during the 2020 breach period. Review settlement details for specific criteria.
No. The CRA never sends unsolicited text messages requesting urgent action or personal information. Verify all communications through official CRA channels.
Disclaimer:
The content shared by Meyka AI PTY LTD is solely for research and informational purposes. Meyka is not a financial advisory service, and the information provided should not be considered investment or trading advice.
What brings you to Meyka?
Pick what interests you most and we will get you started.
I'm here to read news
Find more articles like this one
I'm here to research stocks
Ask Meyka Analyst about any stock
I'm here to track my Portfolio
Get daily updates and alerts (coming March 2026)