If you’re locked out of your CRA account, the quickest fix is usually to go through the CRA’s online registration again. Since early 2026 that works even if you’ve forgotten your user ID, password or security answers, and with photo ID you can be back in the same day. The exception is an account the CRA has locked or disabled for security: then you need to call the CRA or follow the instructions it sends you.
Which kind of lockout do you have?
| What happened | What it means | Fastest fix |
|---|---|---|
| Wrong one-time passcode entered too many times | Temporary lock for 30 minutes | Wait 30 minutes, or use another sign-in code method you set up. No need to call. |
| Passcode lockout happened 3 times | Locked until you act | Register again, or call the CRA |
| Too many wrong tries at your user ID, password, security questions, security code or ID check | Account locked | Register again, or call the CRA |
| Email saying your user ID and password were “revoked” | The CRA thinks your login may be at risk, for example from a data breach or phishing | Register again with a new user ID and password, or use a Sign-In Partner |
| Call or registered letter from the CRA about a security issue | The CRA has disabled your access to protect you | Follow the letter’s instructions. Registering again won’t work. |
| You just forgot your user ID or password | Not locked yet | Recover it online (see below) |
The CRA’s own help pages use the words “locked”, “revoked” and “disabled”. If you see the word “suspended” somewhere, treat it like a security lock and call the CRA.
How you can sign in to the CRA in 2026
There are three ways in. If one of them stops working, you may be able to use another.
- CRA user ID and password. A login you create with the CRA.
- Sign-In Partner. You sign in with your online banking login through Interac. About 25 banks and credit unions take part, including RBC, TD, BMO, Scotiabank and CIBC. If you forgot your banking password, your bank has to help with that, not the CRA.
- Provincial partner. People in British Columbia can use the BC Services Card, and people in Alberta can use an Alberta.ca Account. These give you access right away, without waiting for a security code. BC Services Card users don’t have to enroll in the CRA’s multi-factor authentication.
GCKey, the login used for some other federal services, is not one of the CRA’s sign-in options.
What changed in 2025 and 2026
- A backup sign-in code is now required. Since February 2026, the CRA asks you to add a backup multi-factor authentication (MFA) option before you can get into your account. The backup must be a passcode grid or an authenticator app. A phone number can’t be the backup, though you can still use it as your main method.
- You can fix a forgotten login yourself. If you’ve forgotten your sign-in details or security answers, you can now regain access by completing the online registration again instead of calling.
- Instant ID check. The document verification service lets you prove who you are with a photo of your ID and a selfie, instead of waiting for a code in the mail.
MFA is mandatory for everyone. Your options are a one-time passcode by text or automated phone call, an authenticator app that shows a new six-digit code every 30 seconds, or a printed passcode grid. A passcode grid expires after 18 months.
How to recover a forgotten user ID or password
On the CRA sign-in page, choose the option for a forgotten user ID or password.
- Forgot your user ID: you’ll need your social insurance number (SIN), your date of birth, the amount on line 15000 (total income) of your most recent tax return, and the answers to your security questions.
- Forgot your password: you’ll need your CRA user ID and the answers to your security questions.
- Forgot your security answers too: go through registration again (next section).
A new password must be 8 to 64 characters, with at least one capital letter, one lowercase letter and one number. It can’t contain spaces or accented letters, and the only symbols allowed are a period, dash, underscore or apostrophe.
How to get back in by registering again
- Gather your details: your SIN, your date of birth, and amounts from your most recent tax return. The return must have been assessed and filed in the last two years.
- Pick a sign-in method: a new CRA user ID and password, a Sign-In Partner, or a provincial partner.
- Set up MFA. First-time users need two options.
- Verify your identity. With the document verification service, you need to be 16 or older, have a Canadian passport, Canadian driver’s licence or provincial or territorial photo ID card, and a phone with a working camera. You get access right away. Otherwise, the CRA mails a security code to the address it has on file, which takes up to 10 business days.
Two things trip people up. The registration page times out after 18 minutes of inactivity and you lose your progress. And the postal code you enter must match the CRA’s records, so if you’ve moved, update your address first.
Important: registering again does not reopen an account the CRA has locked for security or other reasons. For that, call.
How to unlock your CRA account by phone
Call the CRA’s individual line and ask to have your CRA account unlocked. Have your SIN, date of birth, current address and your latest notice of assessment or tax return in front of you.
| Where you are | Number |
|---|---|
| Anywhere in Canada except the territories | 1-800-959-8281 |
| Yukon, Northwest Territories, Nunavut | 1-866-426-1527 |
| Outside Canada and the U.S. (collect calls accepted) | 1-613-940-8495 |
| TTY | 1-800-267-7622 |
These lines are open Monday to Friday, 8 am to 8 pm Eastern time, and closed on weekends. The CRA doesn’t publish wait times, and calls can be sent to the automated service when lines are busy, so try early in the day.
The CRA will never call you and ask for your one-time passcode. If you call the CRA, an agent may ask for one to confirm it’s really you.
When the CRA locks your account for security
The CRA watches for signs that someone else is using your login. When it finds them, it may:
- revoke your user ID and password and send you an email explaining how to get back in
- temporarily disable your online access and contact you by phone or registered letter
- pause benefit and credit payments until it confirms who you are
- ask for a copy of government ID, proof of address such as a utility bill, and bank statements or a letter from your bank
Because scammers copy these messages, don’t click links or call numbers in them. Sign in or call the CRA yourself using a number from canada.ca to check that it’s real.
If you think someone has already got into your account, call the CRA at 1-833-995-2336 (Monday to Friday, 6:30 am to 7 pm Eastern time). Then contact your bank, Equifax and TransUnion, and your local police. If your SIN was exposed, report it to Service Canada at 1-866-274-6627.
Don’t fall for “account locked” scams
Fake texts and emails often say your CRA account is locked or your refund is on hold, with a link to “restore access”. The CRA says its emails will never ask you to reply, and will never include a link asking you to enter personal or financial information. It also won’t send refunds by text or e-transfer. See our guide to benefit scams for more warning signs.
Other ways to get what you need while you’re locked out
- Benefit information by phone: the CRA’s automated benefits line, 1-800-387-1193, runs every day from 6 am to 3 am Eastern time. Agents answer weekdays.
- Refund and tax account status: call 1-800-959-8281 and choose option 4 for the automated service.
- CPP, OAS, EI and the Canada Disability Benefit are in My Service Canada Account, not your CRA account. It’s a separate login: you can use a Sign-In Partner, a GCKey or a BC or Alberta sign-in, and new users need a Personal Access Code to register.
- A payment is late: see where is my payment? for how long to wait and who to call.
How to avoid getting locked out again
- Set up at least two MFA methods, including a passcode grid or authenticator app as your backup.
- Print a new passcode grid before the old one expires.
- Keep your email, phone number and mailing address current with the CRA, so its messages and security codes reach you.
- Don’t let a shared computer save your password, and sign out when you’re done.
Common questions
How long is a CRA account locked for?
A lock from wrong one-time passcodes lasts 30 minutes. If it happens three times, or you’re locked for other wrong entries, it stays locked until you register again or call the CRA.
What is the CRA phone number for a locked account?
Call 1-800-959-8281, Monday to Friday, 8 am to 8 pm Eastern time. In the territories, call 1-866-426-1527.
Why was my CRA user ID and password revoked?
The CRA revokes logins it believes are at risk, for example after a data breach or phishing attack. Register again with a new user ID and password, or sign in with a Sign-In Partner or provincial partner.
Can I get into my CRA account without waiting for a code in the mail?
Yes. Use the document verification service with your photo ID and phone camera, or sign in with a BC Services Card or Alberta.ca Account if you live in those provinces.
Is My Service Canada Account the same as my CRA account?
No. My Service Canada Account covers CPP, OAS, EI and the Canada Disability Benefit, and has its own sign-in. Your CRA account covers taxes and CRA benefits such as the Canada Child Benefit.
Does the CRA send texts saying my account is locked?
Treat any text with a link to unlock your account as a scam. The CRA contacts people about security problems by email, phone or registered letter, its emails never include a link asking for personal information, and it will never call and ask for your one-time passcode.
