The Canada Revenue Agency will harden its defences against identity thieves following published reports about cyber criminals making off with ill-gotten tax returns.
Later this month, the CRA will introduce a system that allows taxpayers to set a personal identification number for their accounts to be used when making telephone enquiries.
In addition, taxpayers will be able to request Client Directed Enhanced Confidentiality (CDEC) on their accounts. It would require, in addition to the PIN, that a secret question be asked and answered before any changes are made to an account.
The taxpayer will be able to set both the question and answer.
The measures are meant to protect the integrity of the tax system against the threats posed by corporate data breaches and identity theft.
Frank Vermaeten, assistant commissioner of the agency’s assessment, benefits and services branch, said the PIN system will allow taxpayers to quickly authenticate their identity while also offering an increased level of protection against fraud.
“It’s designed to provide convenience and security,” he said.
The introduction of the measures follows a series of reports, published by the Citizen, about a dozen identity-theft tax-fraud cases tied to a single accounting firm, Raymond Chabot Grant Thornton.
One of the firm’s Ottawa clients, a 47-year-old physiotherapist, had a fraudulent tax return filed in her name in April. The identity thief made off with a $9,178.22 tax return after convincing a CRA telephone agent to change her address and bank account number.
Another client, an Ottawa lawyer, discovered that an identity thief had electronically filed a false, $30,000 tax return by maximizing his RRSP donations and changing his direct deposit information. The money was paid out in April but later recovered by the CRA.
Raymond Chabot Grant Thornton says there were no data security breaches at its offices.
Silvano Tocchi, the CRA’s director general of digital services, said one advantage of CRA’s new PIN system is that the password will not be held with financial institutions, employers or accountants. “If your tax information is stolen from your tax preparer, your PIN is not going to be there,” he said.
The tax agency is also experimenting with voice recognition and other forms of biometric identification, including facial recognition, as part of a longer-term security strategy.
“We want to make sure we get that right so that it doesn’t, I guess, freak Canadians out,” Tocchi said.
Blockchain-type technology is also being examined, he said, to see if it can offer both a better user experience and improved security. Built to facilitate the trading of Bitcoin, a digital currency, blockchain technology is now being adapted for use as a means to pass information safely and securely online.
In the United States, the Internal Revenue Service has cited identity theft tax fraud one of its highest priorities and partnered in an information-sharing centre that analyses the latest methods of cyber criminals.
Corporate data breaches are often at the root of identity theft, and in just the past the month, millions of Canadians have been victimized.
Canada’s privacy commissioner is now examining the recent data breach at Capital One in which one million social insurance numbers were stolen from Canadians. In early July, Desjardins Group announced that an employee pilfered the data of 2.7 million individuals at the Quebec-based financial services company. The data, shared outside the firm, included birth dates, social insurance numbers and email addresses.
Tocchi said the data breaches present a challenge to the CRA as it seeks to protect taxpayers’ returns and tax benefits.
“We worry each time that this kind of information, from these sources, leaks into the ether: that people will misuse it and misrepresent who they are when they interact with us,” he said. “Each time large amounts of financial information get leaked, there’s a bigger risk.”
The best way for a taxpayer to guard against identity theft, he added, is to register for an online account, a feature known as My Account , and ask to be notified whenever a change is made to it. The system will automatically send taxpayers an email if an individual’s address, banking information or marital status is changed.
By mid-August, taxpayers will also be able to set up a PIN online or by telephone once they’ve established their identity through a series of security questions, including ones related to specific lines from a previous tax return.
Copyright Postmedia Network Inc., 2019
