In embarrassment, the Canada Revenue Agency launches a “hunt for sources”

The Canada Revenue Agency (CRA) is seeking to uncover the identities of whistleblowers who may have spoken to the media and revealed how the taxman was repeatedly duped by fraudsters who obtained millions in fake refunds, say several sources.

According to sources, senior management is seeking to limit revelations that raise questions about the effectiveness of security measures within theARC and as to the real extent of the financial losses.

It’s clear: managers are nervoussaid one of the sources. We understand that you should not speak to journalists. I think managers want to control communications.

According to an investigation by - and the show The Fifth Estate from CBC, tens of thousands of taxpayer accounts atARC have been hacked in recent years, a number far higher than reported to Parliament.

A second report showed that the agency wrongly authorized the payment of $40 million in refunds to a taxpayer, without verifying the validity of the tax slips on file.

Since these reports, numerous sources have claimed that theARC seeks to minimize the extent of the problems affecting the activities of this federal agency.

An inside source described the search for whistleblowers as witch hunt.

According to our information, employees believe that theARC would examine employee computers to see who had access to which internal documents and for what reasons.

In a written response, theARC did not deny that it was conducting internal investigations into possible whistleblowers.

We take our responsibility to prevent the harmful dissemination of protected information seriously and are committed to preserving the integrity of the tax system declared a spokesperson, Etienne Biram.

At all times, theARC ensures that all its employees respect their duty of loyalty and confidentiality towards theARCthe Government of Canada and all Canadians.

-/CBC agreed to protect the confidentiality of sources who were not authorized to speak publicly.

Avoid the media, bosses ask

In an internal email sent on November 6, the commissioner ofARC, Bob Hamiltonand Deputy Commissioner Jean-François Fortin asked their employees not to speak to the media.

In this email titled Defend our integritythese two managers said they wrote to employees following recent media reports regarding privacy and security atARC.

If you are approached by journalists, please refer them to the Media Relations teamthey ask.

The management of theARC is in mode crisis managementsaid a source.

Sources said several officials believe their concerns were not taken seriously enough when they raised questions about the handling of fraud cases.

A source said that theARC wrongly attacks potential whistleblowers, when it would beARC to implement adequate measures to protect taxpayer accounts and public funds.

I firmly believe that Canadians have the right to know how their personal information is treated and protected by theARCsaid another source, who asked not to be named for fear of professional reprisals from theARC.

We are constantly reminded of how serious it can be to violate privacy at work, but no organization in Canada violates the privacy of Canadians more often thanARC.

Heavy financial losses

In October, theARC said it lost $190 million due to tax account hacks from 2020 to 2024 while noting that almost all of the losses occurred in 2020, at the start of the pandemic.

L’ARC said that number dropped to $3 million this year, indicating that it is now getting better detect and neutralize fraudulent requests before [que les sommes exigées] can be paid.

Several sources said these figures do not reflect the true extent of the loss of public funds.

Thus, a source said that the figure of 3 million in losses in 2024 worthless. Another source said the actual number is far beyond of what was publicly announced by theARC.

For example, a single scheme employed in 2024 allowed fraudsters to obtain 6 million in fake refunds, sources say.

Open in full screen mode

The figures provided publicly by theARC refer only to fraudulent refunds made in connection with individual tax returns.

Sources said that if theARC had included other false reimbursements made to companies in connection with accounts of TPSthe amounts would have increased by hundreds of millions of dollars.

-/The Fifth Estate asked theARC a breakdown of the amounts that would have been lost in relation to the accounts of TPS and corporate declarations, but without success.

The Canada Revenue Agency has no further information to provide on this subject at this time.replied Benoit Sabourin, a spokesperson for theARC.

The opposition parties announced their intention to summon the Minister of Revenue, Marie-Claude Bibeau, and representatives of theARC to testify before the parliamentary ethics and finance committees.

Open in full screen mode

I really hope that the elected officials will demand accountability fromARC by demanding precise answers to clear questionssaid a source. No one wins if we hide reality.

In response to questions regarding the validity of previously published figures, theARC indicated by email that these figures could be revised upwards.

The figures provided represent confirmed refunds fraudulently obtained due to unauthorized use of taxpayer information, at a specific point in time. Given the complexity inherent in this work and the evolving fraud landscape, the numbers may changesaid Etienne Biram.

L’ARC takes fraud extremely seriously

In their email to employees dated November 6, the commissioner and deputy commissioner of theARC stated that they wanted to assure employees and the public that theARC takes the protection of personal information and any attempt to defraud the Government of Canada extremely seriously.

When theARC becomes aware of potential identity theft or suspects that an account may be the target of a malicious actor, immediate preventative action is takenthey indicate. We are contacting those affected directly to inform them of the incident.

If you have information relating to this story, please contact [email protected] (New window) or [email protected] (New window) in complete confidentiality.