CRA duped in $40M bogus tax refund case. Why did it take a big bank to notice?

In the summer of 2023, a Canadian taxpayer logged into his Canada Revenue Agency account, falsely amended previous tax returns and wrongly claimed he was suddenly owed more than $40 million in refunds.

Then, without verifying the newly filed tax slips, the Canada Revenue Agency authorized the payments and promptly began making the initial instalments, according to sources.

An investigation by CBC's The Fifth Estate and Radio-Canada has learned the scam might never have been detected, except for one thing.

CIBC became alarmed after noticing the government of Canada had deposited an unusually large payment of $10 million to a customer's bank account.

The bank contacted the CRA to make sure it hadn't made a mistake.

Only then did the agency realize it had been duped, according to sources.  

The Fifth Estate and Radio-Canada are not identifying the sources because they are not authorized to speak publicly.

"The CRA has to clean up its act," said Andr​​é Lareau, an associate tax professor at Laval University in Quebec City, in an interview with The Fifth Estate/Radio-Canada.

Lareau said the CRA has a mandate to "assess and evaluate the veracity" of tax returns and that it "cannot execute its functions by just refunding the amount that is claimed." He said this is especially the case when taxpayers amend multiple tax returns.

On Monday, opposition parties called for probes into revelations the CRA had paid out hundreds of millions in bogus refunds, after The Fifth Estate/Radio-Canada reported that tens of thousands of taxpayers' CRA accounts have been hacked since 2020. 

In response to a request from Conservative MP Adam Chambers on Monday, the federal privacy commissioner's office said Tuesday it would be conducting "an investigation into whether the CRA complied with the Privacy Act." 

Chambers also called on Revenue Minister Marie-Claude Bibeau to bring in the RCMP.

"Over $190 million have been improperly paid to scam artists because of privacy breaches at Revenue Canada. Will the minister ... call in the RCMP about this privacy breach so that taxpayers can be repaid?" he asked.  

Canadians have been largely kept in the dark about the extent of losses to the public purse, as well as the weaknesses at the CRA in spotting the schemes in the first place, The Fifth Estate/Radio-Canada's investigation found.