On Tuesday, the Taxpayer’s Ombudsperson, Mr. François Boileau released a report that examined the communication the Canada Revenue Agency (CRA) provided to taxpayers in mid-February 2021.

The report, titled The Lockout: Communication Was the Key, dives into the situation and provides five recommendations to the CRA concerning its effort to protect accounts that may have been compromised.

In sum, the CRA locked out 187,000 Canadians from their CRA account during this timeframe.

The report comes a day after the union representing CRA workers proposed a series of pay bumps that total to more than 30% of current wages to keep up with inflation.

The Union of Taxation Employees (UTE) proposal has been met with mixed reactions.

To give some backstory to Boileau’s report, in the summer of 2020, “credential stuffing” attacks were perpetrated on some CRA accounts and GCKey services.

These cyberattacks were acknowledged by the Government of Canada’s Chief Information Officer who urged the CRA to secure all accounts to prevent fraud from being committed by bad actors. 

At the same time, applications for many Covid-19 benefits were still open. The CRA received significant media attention during this period because many recipients of these benefits were informed there might be issues establishing their credibility for the payments.

Consequently, the CRA unintentionally emailed 119,200 Canadians informing them they were locked out of their CRA account without being told why.

This email caused many Canadians to be concerned. It is obvious why they should have been. Canadians did not request the removal of their email address and the CRA provided no reasoning behind the decision.

Taxpayers were not able to validate the information in their email as an error message would pop up. This led Canadians to reach out to the CRA’s call centre. Ultimately most calls were dropped as the contact centre’s queues were at capacity.

The report continued, “for the Canadians who managed to get through in the first couple of days and regain access, they were still provided with little information as to why their email address was removed.”

In the days that followed, the CRA provided responses to the media and on its social media channels. Then 24 days later on March 12, 2021, the CRA issued a statement regarding the accounts that were locked.

Then 56 days after the official statement, the CRA finally sent a letter to 67,800 taxpayers who officially did not have an email address on file.

The Taxpayer’s Ombudsperson indicated that the CRA failed to put Canadians first, be client-centric and provide consistent information regardless of the channel Canadians preferred to use.

Moving forward, the five recommendations put forth by the report are the following:

1. The CRA should review its communications processes to make sure it proactively informs Canadians about issues that could affect them.

2. The CRA should ensure its web page alerts always provide current information.

3. The CRA should ensure that it always provides a link for more information to a Government of Canada web page from its social media posts.

4. The CRA should make the information it provides to media outlets available to Canadians at the same time.

5. The CRA should make sure it has adaptable plans to communicate emerging issues effectively.

"Being transparent with Canadians is incredibly important. When affected CRA account users were locked out, the CRA should have been ready with a clear and useful communication strategy so worried and frustrated Canadians would not have needed to call the CRA. Situations like this should not happen in the future,” said Boileau.