Multi-factor authentication to access CRA sign-in services

If your CRA user ID and password have been revoked

Some taxpayers may have received a notification that their CRA user ID and password have been revoked. Visit CRA user ID and password have been revoked for more information.

What is multi-factor authentication?

Multi-factor authentication is a mandatory enhanced security measure that was implemented throughout our CRA sign-in services. When prompted to enroll in multi-factor authentication, users can select either option:

Users who choose to enroll with the telephone option will need to provide at least one cell or landline phone number. Users will then be sent a one-time passcode that is required to be entered when they sign in to our online services. This code is good for a single sign in session. A new one-time passcode will be sent via SMS or provided in an automated message to the telephone number selected each time the user signs in to the CRA sign-in services using this option in the future.

When enrolling with a passcode grid, the system will generate a unique passcode grid for the user, who  will be required to save or print it. The five-by-five grid includes twenty-five distinct cells each containing 3 random letters. With each sign in using this option, the user will be prompted to enter a different set of 3 groups of 3 letters that, together, make up the one-time passcode.

What is a one-time passcode?

Once enrolled in multi-factor authentication, users are required to enter a one-time passcode each time they sign in to our online services. This code is good for a single sign in session.

When users enroll with or add multi-factor authentication via telephone, a new one-time passcode will be sent via SMS or automated message to the telephone number provided, each time they attempt to sign in to our CRA sign-in services using this option in the future.

When users enroll with or add multi-factor authentication via a passcode grid, a new one-time passcode combination will be requested each time they attempt to sign in to our CRA sign-in services using this option, and the user will be advised what grid coordinates to enter.

What is a Passcode Grid?

A passcode grid is a table made up of numbered rows and lettered columns, similar to a Bingo card. The CRA will ask for combinations (i.e., B,1 ; A,3) and users will need to match the column and the row to provide the 3 letters that are shown in the square. The CRA will ask for three of these combinations each time a user signs in to CRA’s sign-in services. The passcode grid is an option upon enrollment and it can also be added later in the Manage my multi-factor authentication settings.

How do I add multi-factor authentication to my online services?

You can add multi-factor authentication to your CRA sign-in services by signing into My Account, My Business Account, or Represent a Client and following these instructions. Once you have enrolled in multi-factor authentication on one service, it will automatically be applied to all of your CRA sign-in services.

My Account

  1. Once signed in, select Personal profile from the top banner.
  2. On the Personal profile page, you will find the CRA security options section.
  3. Select Continue on the Multi-factor authentication settings.

My Business Account

  1. Once signed in, select Business profile from the top banner.
  2. On the Business profile page, you will find the CRA security options section.
  3. Select Continue on the Multi-factor authentication settings.

Represent a Client

  1. Once signed in, select Review and update from the left hand navigation bar or under the Administration heading.
  2. On the Review and update RepID page, select the RepID information tab.
  3. Then select Manage your multi-factor authenticate settings.

If you are unable to access our online services to update the telephone number you provided for multi-factor authentication, contact us.

How do I use the multi-factor authentication feature to access my CRA sign-in service?

CRA sign in

  1. Enter your user ID and password.
  2. If asked, go through the captcha security process. To help distinguish between human users and web robots, this security feature will require individuals to identify specific images, before being granted access to online services.
  3. Answer a security question (If you select ‘Do not ask me a security question each time I sign in using this device,’ you will not see this page in the future when using the same device or browser to sign in).
  4. Click ‘next’ when taken to the Last CRA sign in page.
  5. First you will be required to enroll in the multi-factor authentication process. To enroll, you will need to provide at least one cell or landline telephone number or generate a passcode grid
  6. If you enroll with the telephone option, once you receive your one-time passcode via SMS or automated message to the telephone number you provide, enter it. If you enroll with the passcode grid option, enter the combination of grid coordinates when prompted.  
  7. You are now signed in!

Sign-In Partner sign in

  1. Choose the Sign-In Partner option to sign in.
  2. On the Government Sign-In by Verified.Me page, select the financial institution you wish to use.
  3. At the financial institution’s site, enter the required sign-in information.
  4. You are returned to the CRA.
  5. First you will be required to enroll in the multi-factor authentication process. To enroll, you will need to provide at least one cell or landline telephone number.
  6. If you enroll with the telephone option, once you receive your one-time passcode via SMS or automated message to the number you provide, enter it. If you enroll with the passcode grid option, enter the combination of grid coordinates when prompted.
  7. You are now signed in!

BC Services Card

  1. Choose the BC Services Card option to sign in.
  2. Consent to let BC share information with the CRA.
  3. On the BC Services Card sign in page, complete the sign in process.
  4. You are returned to the CRA.
  5. First you will be required to enroll in the multi-factor authentication process. To enroll, you will need to provide at least one cell or landline telephone number.
  6. If you enroll with the telephone option, once you receive your one-time passcode via SMS or automated message to the number you provide, enter it. If you enroll with the passcode grid option, enter the combination of grid coordinates when prompted.
  7. You are now signed in!

Why do I now need to enter a one-time passcode to access my online account?

The CRA has introduced a multi-factor authentication process to enhance the security of its online services, and ensure the safety and protection of taxpayer information.

What if I didn’t receive my one-time passcode?

If you enrolled with the telephone option, have not added the passcode grid option and did not receive your one-time passcode, you can ask for it to be resent or sent to a different telephone number if you have one on file. If issues persist, please contact us.

If you enrolled with the passcode grid, have not added the telephone option and can’t provide the one time passcode requested, please contact us.

If you have both options on file, and are having issues with the one-time passcode (e.g., not receiving one-time passcode to your telephone, misplaced your passcode grid) you can select to use the other option by choosing “different option” when prompted to enter your one-time passcode.

Can I receive my one-time passcode by email for multi-factor authentication?

There is not an option to receive your one-time passcode by email. Once you’ve enrolled, it will be sent by SMS or automated message to the cell phone or landline number you provide, or you’ll be asked to enter a combination of grid coordinates if you enrolled with the passcode grid option.

Can I use an international telephone number to receive one-time passcode with multi-factor authentication?

Yes. However, at this time you can only use telephone numbers based within North American countries that participate in the North American Numbering Plan (i.e., countries that an individual can call from Canada by dialing 1 + 10 digits).

Telephone numbers in the following countries that can receive an OTP: American Samoa, Anguilla, Antigua and Barbuda, Bahamas, Barbados, Bermuda, British Virgin Islands, Canada, Cayman Islands, Dominica, Dominican Republic, Grenada, Guam, Jamaica, Montserrat, Northern Mariana Islands, Puerto Rico, Saint Kitts and Nevis, Saint Lucia, Saint Vincent and the Grenadines, Saint Maarten, Trinidad and Tobago, Turks and Caicos Islands, United States, and the United States Virgin Islands.

The telephone numbers must be supplied by telephone providers (i.e. landline or mobile phone). Additionally, you can enroll with a passcode grid option and you do not need access to a telephone at all.

Can I disable the multi-factor authentication feature?

No. Multi-factor authentication is mandatory for all users who wish to use the CRA sign-in services. If you are unable to use a telephone to receive a one-time passcode sent via SMS or automated message, you may choose the passcode grid option we have provided.

What if I don’t have access to text message or a landline?

If you do not have access to text message or a landline, you may use the passcode grid option to sign in.

Will I need to keep a copy of the Passcode Grid?

Yes. You will be advised when generating the passcode grid to keep a copy for future sign in attempts. You must save the grid in PDF format on your device and/or print a copy to keep in your records. We recommend that you do not email your passcode grid to yourself or anyone else.

Can I use a VoIP service with multi-factor authentication?

Yes, however some VoIP services may not be compatible with the CRA’s multi-factor authentication service. If you experience difficulty receiving the one-time passcode, please choose the ”Call me” delivery method.

How do I update the telephone number I provided when I enrolled in multi-factor authentication?

You can manage the telephone number you provided by selecting the multi-factor authentication settings within My Account, My Business Account and Represent a Client.

What should I do if I have been locked out of my account?

If your account becomes locked due to entering the wrong passcode too many times, contact us to have your account unlocked.

What if my lose my Passcode Grid?

If you lose your passcode grid, you will still be able to sign in if you have added the telephone option for multi-factor authentication. If you have not, you will need to contact us.

What does it mean when I see 'Standard message or data rates may be charged by your telephone service provider'? Is there a charge to receive the one-time passcode?

The CRA does not charge for this service, however your provider may charge standard message and data rates. Check with your provider if you have questions about your plan and costs.

As an authorized representative, how will multi-factor authentication affect my day-to-day job?

We understand that authorized representatives have different needs and limitations than individuals. As we progress with implementing multi-factor authentication for representatives, we are working to ensure that your feedback is addressed and questions are answered.

Will the CRA ever call and ask me to provide my one-time passcode over the telephone?

No. The CRA will only request that you enter your one-time passcode on your device when signing in. Users should never share their one-time passcode with anyone, including anyone calling or texting to request it.

Report a problem or mistake on this page
Please select all that apply:

Thank you for your help!

You will not receive a reply. For enquiries, contact us.

Date modified: