Welcome to The Buzz
Explore expert opinion, insights, news, and updates from the world of bookkeeping.
CRA: Enhanced authentication requirements are coming to the Canada Revenue Agency’s digital services
The Canada Revenue Agency (CRA) continues to add enhanced security measures to help Canadians feel safe and confident when using digital services such as My Account, My Business Account, and Represent a Client. On October 16, 2023, the CRA will be implementing two additional enhancements to further improve the security for taxpayers and representatives, as well as some changes to help reduce the amount of users who become locked out of their accounts.
What’s changing and what does this mean for you?
Credential reduction: New users will only be able to register for one credential (a CRA user ID and password or Sign-In Partner) to access all of their CRA online accounts. This precautionary security measure will help ensure that their account is protected and safe from potential misuse. Existing users with multiple credentials can continue to use them and will not be impacted by this change. Existing credentials will only be removed if a user calls in or if the user revokes them themselves.
Although new users will only be able to register for one credential, they will still have the ability to also enroll with a provincial partner (BC Services Card or Alberta.ca Account) for My Account only.
New registration and authentication requirement: In addition to the existing shared secrets that users must enter to validate their identity during registration (social insurance number, date of birth, current postal code or ZIP code, and an amount entered on one of their income tax and benefit returns), the CRA will further enhance the security of its sign-in services by requiring users to also provide line 15000 from their most recent income tax and benefit return.
Changes that will reduce locked accounts
The CRA will also be implementing some changes to help reduce the amount of users who become locked out of their accounts:
- When signing in to the CRA’s sign-in services, users will be able to click a new “eye” icon to unmask their password.
- When enrolling in Multi-factor authentication (MFA), users will be able to self-correct their information.
- When entering the MFA one-time passcode, an entry error will no longer mean a lockout.
Need More Information?
For more information on the enhanced authentication requirements, check out the following resources: