The New Era of Tax Security

If you have tried to log in to your Canada Revenue Agency (CRA) My Account recently only to find yourself locked out, you are not alone. As of early 2026, the CRA has fully implemented a more aggressive security protocol. These changes are designed to combat the rising tide of sophisticated identity theft and phishing scams targeting Canadian taxpayers. While the added security is a win for data protection, it has left thousands of users facing the dreaded Account Locked message.

Why Your Account is Locked

The most common reason for a lockout in 2026 is a failure in the Multi-Factor Authentication (MFA) process. The CRA now requires more than just a password. If your phone number has changed, if you are using an unrecognized VPN, or if you failed to update your security questions during the 2025 transition period, the system may automatically freeze your access to protect your data.

Additionally, the CRA has integrated automated credential monitoring. If your login information was found in a third-party data breach elsewhere on the internet, the CRA will proactively lock your account as a preventative measure. You can find more details on how they handle these breaches on the official CRA Security Page.

The 2026 Multi-Factor Authentication (MFA) Rules

The updated rules for 2026 have moved away from simple email codes, which were deemed too vulnerable. Here is what is now mandatory:

• Passkey Integration: The CRA now strongly encourages the use of biometrics, such as Fingerprint or Face ID, through your smartphone or hardware security keys.
• App-Based Verification: While SMS codes are still available, they are being phased out in favor of authenticator apps which provide a time-based one-time password.
• Verified Contact Updates: Users are now forced to verify their contact information every six months to ensure that recovery codes are sent to the correct person.

How to Regain Access

Recovering a locked account has become a more formal process. Here are the steps you need to take:

1. Identity Validation: You will likely need to provide your Social Insurance Number, date of birth, and a specific line amount from your most recent assessed tax return.
2. The CRA Helpline: If the online recovery fails, you must call the CRA directly. Be prepared for high call volumes during tax season. You can check current wait times on the CRA Contact Page.
3. New Security Codes: In some cases of suspected fraud, the CRA will mail a physical security code to the address they have on file. This can take up to ten business days to arrive.

Proactive Tips for 2026

To avoid future lockouts, ensure your My Account profile is linked to a permanent personal email rather than a work email. Avoid using VPNs when accessing government services, as the CRA's security filters often flag non-Canadian IP addresses as suspicious. Most importantly, keep a physical or secure digital copy of your most recent Notice of Assessment, as it remains the primary tool for identity verification.