The fake Revenu Québec refund email

What the scam looks like

The email has the right logo, the right blue, and a subject line that reads like paperwork: "Important notice about your file." It says your return has been processed and a refund is waiting, or that a provincial balance is still outstanding. Either way, you have to "confirm your details" before a deadline. The link opens a copy of the My Account (Mon dossier) sign-in page, and the form wants your username and password, your SIN, and a bank account number.

The hook is how tax works here: in Québec you file two returns, one with the CRA for federal tax and one with Revenu Québec for provincial tax. The scam slips into the gap between them - "the federal side is settled, the provincial side isn't" - and most people can't say exactly where one file ends and the other begins.

Revenu Québec does send email, for instance to tell you a document is waiting in My Account, but never to make you type a password, a SIN, or a card number into a page opened from a link. Refunds go out by direct deposit or cheque, using the information already on your file. What the criminals want is your My Account access: from there they change the direct-deposit account and collect the refund in your place.

Red flags

• An email that bridges the two governments: "your federal return has been processed, the provincial balance remains." The two agencies handle your file separately and don't write to you on each other's behalf.
• A "My Account" sign-in page opened from a link, asking for your password, your SIN, or your full card number.
• A short fuse: interest piling up, a refund about to be "cancelled" if you don't confirm today.
• A payment method that makes no sense for a government: gift cards, cryptocurrency, or an Interac e-Transfer to a person.

What to do

• Don't click the link. Open My Account yourself by typing the Revenu Québec address into your browser. If the notice is real, it will be waiting there.
• Keep the two files straight: the CRA for federal, Revenu Québec for provincial. Neither will ask you to settle something on the other's behalf.
• Already entered your details? Change your password, check which account is registered for direct deposit, then report it to the Canadian Anti-Fraud Centre (1-888-495-8501).
• Not sure about an email? Paste it into our email checker - it points out the tells.