How to spot a fake government website or message in Canada
How to spot a fake government website or message in Canada
Government impersonation is the most effective scam operating in Canada, because it combines an authority you cannot ignore with a deadline you cannot verify quickly. Newcomers are targeted disproportionately, often in their own language.
Everything below is a small number of rules that hold up under pressure.
Rule 1 — read the domain, not the words
The only part of a web address that identifies who runs the site is the domain immediately before the first single slash.
Real:
https://www.canada.ca/en/revenue-agency...https://www.ontario.ca/page/...https://ircc.canada.ca/...- Provincial and municipal sites on their own official domains
Not real, regardless of what else the address says:
canada.ca.forms-secure.net— the domain here isforms-secure.netcra-canada-refund.comservice-canada-benefits.orgontario-gov.ca
The trick is always the same: put the trusted words somewhere in the address where they are decorative. Read right to left from the first single slash.
The safe habit: never reach a government site by clicking a link in an email, text or search advertisement. Type canada.ca or ontario.ca yourself, or use a bookmark, and navigate from there.
Rule 2 — know what real agencies never do
The CRA, IRCC, Service Canada and ServiceOntario do not:
- Demand payment in gift cards, cryptocurrency, prepaid cards or e-transfer
- Threaten arrest, deportation or immediate legal action over the phone
- Ask for your password, or for a verification code sent to your phone
- Send text messages with links asking you to claim a refund or verify identity
- Ask for a SIN, passport or health card number by email or text
- Ask you to stay on the line while you go to a bank or a store
- Cancel your SIN — this is a fabricated threat used constantly and there is no such process
If any of these happen, it is a scam. There is no ambiguity and no exception worth considering.
Rule 3 — the paid-form trap
A large industry exists around charging for government forms and applications.
The pattern: a site that looks official, ranks in search results, and offers to "help you apply" for a passport, a permit, a benefit, an ETA or a licence — for a fee, sometimes on top of the real government fee, sometimes instead of ever filing anything.
What is true:
- Government forms are free to obtain on canada.ca and ontario.ca.
- Official application fees are paid to the government, through the government's own portal.
- Legitimate paid help exists — a licensed immigration consultant, a lawyer, an accountant. You are paying for their professional service, and they should say so plainly and give you a written retainer.
What to check: is this a licensed professional providing a service, or an anonymous website charging for a free PDF? See What to send a realtor, broker or consultant for how to verify a licence.
Rule 4 — verify by calling back
Caller ID is trivially spoofed, and scam calls routinely display a real government number.
Always hang up and call back on a number you look up yourself on canada.ca or ontario.ca. Never use a number the caller gave you, or one shown in the message.
Same for email: if a message claims your CRA account needs attention, sign in to CRA My Account yourself and look for a secure message there. Real notifications appear inside the account.
Rule 5 — pressure is the signal
Every one of these scams runs on urgency, because urgency prevents verification.
"Your SIN has been suspended." "There is a warrant." "Your application will be cancelled today." "You must pay within the hour."
Real government processes move slowly, send letters, and give you time to respond. Urgency plus a demand for payment or personal information is the tell, and it is more reliable than any detail of the message itself.
Checking a site quickly
| Check | Real | Fake |
|---|---|---|
| Domain | canada.ca, ontario.ca | Anything else, however it is dressed up |
| HTTPS | Present | Also frequently present — this proves encryption, not identity |
| Language quality | Consistent, bilingual, professionally edited | Odd phrasing, mixed formatting, missing French |
| Contact details | Official numbers listed on canada.ca | A form only, or a mobile number |
| Payment method | Government portal, card | Gift cards, crypto, e-transfer to a person |
| Urgency | Deadlines with notice | "Act within 24 hours" |
| How you arrived | You typed the address | You clicked a link in a message or an ad |
Note the HTTPS row. A padlock means the connection is encrypted. It says nothing about who is at the other end — scam sites obtain certificates as easily as anyone else.
If you already entered your details
Move quickly, in this order:
- Change the password you entered — immediately, and everywhere you reused it.
- If you gave a SIN or ID details, place a fraud alert with both Canadian credit bureaus. See What to do if your SIN or ID is stolen.
- If you paid, call your bank or card issuer at once — some transactions can be stopped.
- If you installed anything or granted remote access, disconnect the device from the internet and get it checked.
- Report it to the Canadian Anti-Fraud Centre and to your local police.
- Tell the real agency, so your account can be flagged.
There is nothing embarrassing about this. These operations are professionally run and specifically designed to work on careful people under time pressure.
How my-id.ca helps
Two habits reduce this risk more than any checklist, and both are things the product makes easier.
Reaching official sites through your own trusted path rather than through links. Our Ontario and federal form guides link to the official government page for each form, so you can navigate from a source you chose rather than from a search advertisement.
Not retyping your details into whatever form is in front of you. my-id.ca fills forms from your saved profile, and autofill is off on every site until you turn it on for that site — which means nothing is offered to a page you did not deliberately trust.
Your own my-id.ca account can be secured with passkeys, which cannot be phished, because there is no password for a fake page to capture.
Next steps
- What to do if your SIN or ID is stolen
- Your data was in a breach — what to do now
- Sign in with a passkey
- Keeping your immigration documents safe
Important: this is general information, not legal advice
This article is general information — it is not legal, security, or financial advice, and my-id.ca does not provide legal or professional consultation. my-id.ca is not a government agency, law firm, lawyer, police service, or licensed advisor, and is not affiliated with or endorsed by the Government of Canada, the Government of Ontario, the Canada Revenue Agency, IRCC, Service Canada, ServiceOntario, the RCMP, or the Canadian Anti-Fraud Centre.
Scam techniques, official domains and agency contact practices change over time. Always confirm the current guidance on the official sources — canada.ca, ontario.ca, and the Canadian Anti-Fraud Centre — and report suspected crimes to your local police. For advice about your individual circumstances, consult a qualified professional. If anything in this guide differs from an official source, the official source is correct.
Frequently asked questions
- How do I know if a Canadian government website is real?
- Read the domain immediately before the first single slash. Real federal pages are on canada.ca and real Ontario pages on ontario.ca. Addresses like canada.ca.forms-secure.net or cra-canada-refund.com are not government sites, no matter what appears elsewhere in the address.
- Does the CRA send text messages with links?
- The CRA does not text links asking you to claim a refund or verify your identity. It communicates through mail and through secure messages inside My Account. If a message worries you, sign in to My Account yourself rather than following any link.
- Are paid websites that fill government forms legitimate?
- Some are legitimate paid services; many are designed to look official and charge for something the government provides free. Government applications are free or carry an official fee paid directly to the government. If you are paying a third party, know that you are paying for their service, not for the application.
- Will a government agency ever call and demand immediate payment?
- No. The CRA, IRCC and Service Canada do not demand payment in gift cards, cryptocurrency or e-transfer, do not threaten arrest or deportation over the phone, and do not ask for passwords or codes sent to your phone.
- What should I do if I already entered my details on a fake site?
- Change any password you entered, immediately and everywhere you reused it. If you gave a SIN or ID details, place a fraud alert with both Canadian credit bureaus. If you paid, contact your bank or card issuer. Then report it to the Canadian Anti-Fraud Centre.
- How do I verify a phone number that claims to be from the government?
- Hang up and call back on a number you look up yourself on canada.ca or ontario.ca. Never use a number provided by the caller or shown in the message. Caller ID can be spoofed and routinely is.