The Canada Revenue Agency is asking Canadians to check their CRA account before the next tax-filing period, saying early action can help prevent delays and account-access problems.
In an update published October 29, 2026, the agency said it has expanded the list of government-issued photo IDs accepted through its document-verification service for people registering for a CRA account.
Table of Contents
Why the CRA account matters
A CRA account gives users access to tax information and several online services, including benefit and credit payment details, document submissions, refund information, deduction limits and contribution room.
The account is also used to access certain digital tax-filing tools, manage authorized representatives and use Auto-fill My Return with compatible tax software.
The CRA said users filing a 2026 tax return through NETFILE or EFILE will need to authenticate their identity, making it useful to confirm account access before filing begins.
What changed for identity verification
The CRA’s document-verification service allows eligible users to prove their identity in real time with a mobile device instead of waiting for a security code to arrive by mail.
The service provides full and immediate access once verification is completed.
The current accepted-document list includes Canadian driver’s licences, Canadian permanent resident cards, provincial or territorial photo identification cards and Canadian passports.
It also includes Australian, British and New Zealand passports, as well as Secure Certificates of Indian Status issued as of February 2019.
Applicants must use an original, valid document and take a real-time photograph of themselves and the identification document.
Expired, damaged, photocopied or reported-lost documents are not accepted, and provincial health cards are excluded from the service.
People who cannot use the document-verification service can still request a CRA security code by mail.
The agency says mailed codes generally arrive within 10 business days, provided the address on file is current.
CRA urges users to add backup MFA
The CRA is also encouraging account holders to set up a backup multi-factor-authentication option.
The agency says users may be prompted to do this before they can access their account.
Multi-factor authentication is mandatory for CRA account users.
Available options include a third-party authenticator app, a CRA passcode grid or passcodes delivered by phone or text message.
Only one MFA option is currently mandatory, but the CRA recommends enrolling in more than one method.
A backup can help people regain access if they change phone numbers, lose a passcode grid, lose access to text messages or remove an authenticator app.
After signing in, users can manage their MFA settings from the account’s Security settings area.
The agency says they can add, remove or change phone numbers, passcode grids and authenticator apps from that section.
What Canadians should do now
The CRA is recommending that users take several steps before tax filing becomes urgent.
- Confirm that the CRA account login works.
- Check that the email address, phone number, mailing address and other personal details are current.
- Add a backup MFA method if only one option is registered.
- Review benefit and credit payment information.
- Use a strong, unique password and monitor the account for unexpected activity.
- Be alert for scams and never share a one-time passcode with someone who contacts you unexpectedly.
The CRA says people who have forgotten their sign-in information or security-question answers may be able to regain access by completing the online registration process again.
Users who have lost access to a phone number and do not have another MFA method registered may need to contact the CRA.
The agency also warns that repeated incorrect MFA passcodes can lead to temporary or permanent account lockouts.
Limited access may be available before verification
People who have registered but have not completed identity verification can still access some limited services, including tax-return status, notices of assessment, RRSP deduction limits and TFSA contribution room.
Full access is required for additional services, such as applying for benefits and updating personal information.
The CRA’s message is aimed at reducing last-minute account problems, particularly for people who rely on the online portal to check payments, submit documents or complete digital tax-filing steps.
Frequently Asked Questions
What is changing for CRA account registration?
The CRA says it has expanded the government-issued photo IDs accepted through its document-verification service for account registration.
Which IDs can be used for CRA identity verification?
Accepted documents include Canadian driver’s licences, permanent resident cards, provincial or territorial photo ID cards, Canadian passports, certain Secure Certificates of Indian Status and passports from Australia, Britain and New Zealand.
Is multi-factor authentication mandatory for a CRA account?
Yes. The CRA says users must have at least one MFA option, such as an authenticator app, passcode grid or phone-based passcodes.
Why should I add a backup MFA option?
A backup method can help you access your account if you lose your phone, change your number, lose a passcode grid or cannot use your primary authentication method.
What if I cannot use the document-verification service?
You can request a CRA security code by mail. The CRA says it generally arrives within 10 business days if your mailing address is up to date.
Fact-Checked: Key details were checked against the Canada Revenue Agency’s October 29, 2026 update and its current identity-verification and multi-factor-authentication guidance.
Disclaimer: CRA account features and verification requirements can change, so readers should confirm current instructions on Canada.ca before submitting sensitive information.