Are the CRA login codes sent by snail mail affected by the strike? - RedFlagDeals.com Forums (2025)

Not sure but would think that is automated.

If I remember correctly they will say by what date to expect code by.

UPDATE: I'm wrong.

Canadians are encouraged to use CRA’s online services to manage their tax affairs. There are many tasks that taxpayers can complete by logging into My Account.
However, until the labour disruption is concluded, letters containing the CRA security code will not be mailed to Canadians who register for the CRA’s online services.
Canadians wishing to register for online services including My Account for Individuals, My Business Account (MyBA) and/or Represent a Client (RAC) will be unable to complete their registration and have full online access at this time.
Canadians registering for My Account will have access to limited services until they complete the registration process by entering the security code.
Canadians who are locked out but who had previously completed the registration process, may be able to regain access after successfully completing the caller verification process when contacting the contact centres.

https://www.canada.ca/en/revenue-agency ... mpact.html

georvu wrote: ↑Not sure but would think that is automated.

If I remember correctly they will say by what date to expect code by.

UPDATE: I'm wrong.

Canadians are encouraged to use CRA’s online services to manage their tax affairs. There are many tasks that taxpayers can complete by logging into My Account.
However, until the labour disruption is concluded, letters containing the CRA security code will not be mailed to Canadians who register for the CRA’s online services.
Canadians wishing to register for online services including My Account for Individuals, My Business Account (MyBA) and/or Represent a Client (RAC) will be unable to complete their registration and have full online access at this time.
Canadians registering for My Account will have access to limited services until they complete the registration process by entering the security code.
Canadians who are locked out but who had previously completed the registration process, may be able to regain access after successfully completing the caller verification process when contacting the contact centres.

https://www.canada.ca/en/revenue-agency ... mpact.html

Thanks for finding that

Sucks, i was hoping it was automated

Quentin5 wrote: ↑Thanks for finding that

Sucks, i was hoping it was automated

You may be able to use a sign-in partner (B.C. or Alberta governments) or your bank login instead of registering for the CRA account route?

Cheers,
Doug

dmehus wrote: ↑You may be able to use a sign-in partner (B.C. or Alberta governments) or your bank login instead of registering for the CRA account route?

Cheers,
Doug

I am not convinced the bank login route is safe, plus i would prefer the government not be able to access my bank balances, even if i change the password afterwards they were able to record my bank account balance.

GoodFellaz wrote: ↑The strike is over so u should get the letter now

Indeed, i plan to call on Monday and see what the backlog is

Quentin5 wrote: ↑I am not convinced the bank login route is safe, plus i would prefer the government not be able to access my bank balances, even if i change the password afterwards they were able to record my bank account balance.

If you actually understood anything about cyber-security, and how authentication ID sharing across different web services works at a technology level (SAML tokens), the bank login method is actually far more secure than having a separate CRA login ID & password, and it is technically impossible for CRA to access your bank account balance using this method.

The CRA has other legal and simpler means to access your bank info if they really wanted to - they wouldn't need to try and illegally use your bank login credentials to access it.

Quentin5 wrote: ↑I am not convinced the bank login route is safe, plus i would prefer the government not be able to access my bank balances, even if i change the password afterwards they were able to record my bank account balance.

They can, any time they want to, should they wish to request information about your bank accounts from your financial institution.

I do not believe the CRA can access your bank accounts directly if you use a sign-in partner, though. They use a third-party authentication service, Verified.Me, to verify you logged into your bank account. They can't see anything directly like you think they can.

doomvilla wrote: ↑
If you actually understood anything about cyber-security, and how authentication ID sharing across different web services works at a technology level (SAML tokens), the bank login method is actually far more secure than having a separate CRA login ID & password, and it is technically impossible for CRA to access your bank account balance using this method.

The CRA has other legal and simpler means to access your bank info if they really wanted to - they wouldn't need to try and illegally use your bank login credentials to access it.

Lets bear in mind i am not a cyber security expert by trade.
That said do you have a link handy that explains this, i would be interested in learning more.

dmehus wrote: ↑
They can, any time they want to, should they wish to request information about your bank accounts from your financial institution.

I do not believe the CRA can access your bank accounts directly if you use a sign-in partner, though. They use a third-party authentication service, Verified.Me, to verify you logged into your bank account. They can't see anything directly like you think they can.

Sure with a warrant they can but i am not required to give away that which they have to get a court order to access.
TFSA is different, all transactions are reported, but that is easily found if you dive into your CRA info.

Quentin5 wrote: ↑Lets bear in mind i am not a cyber security expert by trade.
That said do you have a link handy that explains this, i would be interested in learning more.

Sure with a warrant they can but i am not required to give away that which they have to get a court order to access.
TFSA is different, all transactions are reported, but that is easily found if you dive into your CRA info.

They don't need a warrant, though, if it's for a CRA audit. There are provisions within the relevant federal legislation allowing for warrantless searches by the CRA of your banking and financial records. They are, however, limited, by what they may gather and use the information for. In that way, CRA have special powers over, say, policing services, in that they do not need to go through the courts.

Quentin5 wrote: ↑I am not convinced the bank login route is safe, plus i would prefer the government not be able to access my bank balances, even if i change the password afterwards they were able to record my bank account balance.

It's almost as safe as using a CRA userid. The steps are:

• Navigate to CRA
• Navigate to Interac partners page
• Navigate to your bank's page with a unique code in the URL (signon?skeyUUID) that, I believe, tells the bank to leave a special security token/cookie on your device. Enter 2FA code
• You are then redirected to CRA as an authenticated user, with requirement for 2nd 2FA

I'm not a web developer, but to answer your question here is what I think the difference is:

1. Logging on with CRA userid creates a standard secure browser session. If you close the tab/session, you have to login all over again.
2. Logging on via a sign-in partner leaves a special, time-limited token (cookie) on your device. Anyone with this token who navigates to the CRA sign-in partner page is immediately logged in, however, 2FA is again required by CRA.

Conceivably, if the time-limited token can be accessed by a bad actor, they might be able to use it to establish the same CRA browser session that you establish when redirected after navigating to your bank. I tested what happens if I close my tab/session and again navigate to the sign-in partner page. I get reconnected as me every time without having to re-authenticate to my bank. So, yes, this is an extra vulnerability...but keep in mind that the bad actor also needs to be able to intercept your 2FA code.

Maybe someone can correct any inaccuracies in the above, but the bottom-line is that the sign-in partner method is 99% as secure as a CRA userid. It's also less prone to getting you locked out and having to chase down some obscure value from line xxxxx on your recent tax return.

dmehus wrote: ↑They don't need a warrant, though, if it's for a CRA audit. There are provisions within the relevant federal legislation allowing for warrantless searches by the CRA of your banking and financial records. They are, however, limited, by what they may gather and use the information for. In that way, CRA have special powers over, say, policing services, in that they do not need to go through the courts.

Didn't know this but I don't get audited on a regular basis. Frankly never so far
That said i do know what you mean but in general i trend towards personal privacy, especially when i have the legal right to not give it up.