CRA launched ‘witch hunt’ against whistleblowers who exposed millions in bogus refunds, sources say

The Canada Revenue Agency is on a “witch hunt” to find whistleblowers who may have spoken to the media and exposed how it has been repeatedly duped into paying out millions in bogus refunds to scammers, according to sources.

“The consensus is that management is nervous,” one source said. “Any media contacts [they’re saying]: ‘Don’t talk to them at all, don’t talk to journalists.’ I think they’re very much trying to control the narrative.”

According to multiple sources, the CRA’s senior leadership is anxious, looking for ways to silence employees and to limit media coverage.

Last month, an investigation by CBC’s The Fifth Estate and Radio-Canada revealed the tax collector has been keeping Canadians largely in the dark about how many hundreds of millions of dollars in public funds it has wrongly paid out, as well as the extent to which taxpayers have had their CRA accounts hacked by fraudsters.

In response to questions about the validity of its previously released numbers, the CRA in an email Wednesday now says that those numbers could be higher.

“The figures provided represent confirmed fraudulently obtained refunds due to unauthorized use of taxpayer information, at a point in time. Given the inherent complexities of this workload and the evolving fraud landscape, it is possible that the previous numbers will change.”

Two weeks ago, CBC reported that tens of thousands of CRA taxpayer accounts were hacked — numbers far larger than what the agency had previously reported to Parliament. CBC/Radio-Canada also reported that the agency wrongly authorized the release of $40 million in bogus refunds to a single bank account without verifying what turned out to be sham documents.

Since those reports, The Fifth Estate/Radio-Canada have heard from multiple insiders who have raised concerns over attempts to downplay the extent of the problems facing the agency.

Sources have described the focus on whistleblowers as a “witch hunt” and say they fear retaliation.

The Fifth Estate/Radio-Canada has also been told that employees believe the CRA is going through computers to see who accessed what files and for what reason.

CBC/Radio-Canada is not identifying the sources because they have not been authorized to speak publicly.

In its emailed response Wednesday, the CRA did not deny it is investigating potential whistleblowers.  

“We take seriously our responsibility to prevent any harmful distribution of protected information and we are dedicated to upholding the integrity of the tax system,” a spokesperson said. 

“At all times, the CRA is focused on ensuring that all employees adhere to their duty of loyalty and confidentiality to the CRA, the government of Canada and all Canadians.”

Refer calls to media relations office, bosses say

CBC has obtained a copy of an internal email sent out Nov. 6 by CRA Commissioner Bob Hamilton and Deputy Commissioner Jean-François Fortin.

The email, labelled “Upholding Our Integrity,” stated that its authors were writing “in light of recent media reports regarding privacy and security at the CRA.”

“If you are approached by a journalist, please refer them to the media relations team.”

CRA management is in “damage control,” said one source.

Sources have told The Fifth Estate/Radio-Canada that public servants felt their concerns were not taken seriously enough when raising alarm bells internally about millions in bogus refunds.

One source said the CRA is wrongly going after potential whistleblowers when it is the agency that needs to take responsibility for not installing better safeguards to protect taxpayer accounts and the public’s money.

“I strongly feel that Canadians have the right to know how their personal information is handled as well as protected by the CRA,” said another source, who asked not to be identified, stating they are also concerned about “retaliation” by the agency.

“We are constantly reminded of how bad it could be to breach privacy at work,” the source said, adding they believe that “no organization in Canada breaches privacy for Canadians more than the CRA.”

CRA misleading public on extent of losses: sources

According to multiple sources, the CRA has repeatedly understated the dollar value of bogus refunds it has paid out to scammers.

In a previous statement, the CRA told The Fifth Estate/Radio-Canada that, since 2020, it had lost $190 million to bogus scams involving hacked accounts, but that almost all of the losses came in 2020, in the first year of the pandemic.

The CRA stated that number was down to $3 million this year, an indication it is now better at “identifying and stopping fraudulent claims before they can be paid out.”

Multiple sources have told The Fifth Estate/Radio-Canada those numbers do not reflect the extent of the losses of the public’s money.

In one example alone, according to sources, the CRA paid out more than $6 million this year to fraudsters who hacked into taxpayer accounts.  

One source described the CRA’s claim it had only confirmed $3 million in losses to hacked accounts in 2024 as “garbage.”  

Minister expected to be called to committees

Another source said the real number is “well beyond” what has been stated by the CRA.

“I sure hope that elected officials have the power to make the CRA accountable on providing real clear answers when requested,” a source said. “It literally benefits nobody to hide the reality.”

Opposition parties have said they plan to call Revenue Minister Marie-Claude Bibeau and CRA officials to testify before both the ethics and finance committees.

The figures that CRA provided publicly — even if disputed — are only from bogus refunds based upon personal tax returns, also known as T1 returns. 

Sources have said that if the CRA had included other bogus refunds it had been duped into paying out, including those from businesses and GST accounts, the amounts would be significantly higher, well into the hundreds of millions.

The Fifth Estate/Radio-Canada also asked the CRA for the total amounts lost to the public purse, including bogus payouts on GST and business returns, whether or not from hacked accounts.

In an email last week, the CRA said it has “no further information to provide on this topic at this time.”

CRA takes fraud ‘extremely seriously,’ email says

In their email to employees on Nov. 6, the CRA commissioner and deputy commissioner said they “want to assure you — and the Canadians we serve — that the CRA takes the protection of personal information and any attempt to defraud the government of Canada extremely seriously.”

“When the CRA becomes aware of a potential identity theft or suspect an account could be the target of a threat actor, immediate preventative measures are taken,” the statement said. “We directly contact affected individuals to inform them of the incident.”

• If you have tips on this story, or if you were the victim of a hacked CRA account, please call 416-526-4704 or email, in confidence, Harvey.Cashore@cbc.ca or Daniel.Leblanc@cbc.ca