Last Updated: September 4, 2026
How to Set Up Mandatory CRA Backup MFA & Prevent Portal Lockout
The Canada Revenue Agency (CRA) requires all taxpayers using My Account, My Business Account, and Represent a Client portals to have a secondary, backup Multi-Factor Authentication (MFA) option registered.
If you rely solely on SMS text messages or phone calls as your primary login security, you risk being permanently locked out during peak tax filing periods if you change phone numbers, travel outside Canada, or lose your mobile device. Adding a secondary MFA credential takes less than five minutes and secures your personal tax record against cyber threats.
Understanding the CRA Mandatory Backup MFA Requirement
For years, logging into CRA e-services required entering a password alongside a one-time passcode delivered via text message or telephone call. While effective, SMS and voice-based MFA present structural vulnerabilities—such as SIM-swapping fraud, mobile network outages, and carrier delays—that disrupt access when accessing notices of assessment, benefit statements, or income tax filings.
Following official policy rollouts by the CRA and security assessments from the Canadian Centre for Cyber Security, single-factor SMS authentication no longer meets federal identity assurance standards.
Key Policy Details:
- Scope: Applies to all registered users of CRA My Account, My Business Account, and Represent a Client portals.
- Exemptions: None. All personal and commercial accounts must maintain secondary access credentials.
- Login Prompts: While the CRA allows taxpayers to temporarily skip adding a backup method during active filing periods, unconfigured accounts encounter continuous verification prompts and risk full lockout if the primary device fails.
- Source Reference: Review primary policy guidelines directly on the Official Canada Revenue Agency Login Portal Services.
Authenticator App vs. Passcode Grid: Choosing Your Backup Method
The CRA accepts two secondary backup authentication mechanisms. Both methods operate offline, ensuring you can log in even when cellular coverage is unavailable.
| Backup Option | How It Works | Best For | Validity Period | Loss Recovery Risk |
|---|---|---|---|---|
| Third-Party Authenticator App | Generates a constantly updating, time-based 6-digit security code using standard TOTP algorithms. | Smartphone users, frequent international travelers, and taxpayers in low-reception areas. | Indefinite: Active as long as the application remains installed on your device. | High if device is lost without cloud backup; requires a manual CRA identity verification call. |
| CRA Passcode Grid | Generates a downloadable 10×10 alphanumeric matrix. The CRA prompts you to enter values from specific coordinates (e.g., Row C, Column 4). | Individuals without smartphones, offline users, and those seeking a paper-based physical copy. | Limited: Valid for approximately 18 months, requiring regeneration upon expiry. | High if paper/digital document is destroyed; requires regenerating via account or calling CRA. |
Step-by-Step Instructions: Setting Up Backup MFA on Your CRA Account
Follow this step-by-step walkthrough to configure your backup authentication method:
Step 1: Sign In to Your Official CRA Portal
Navigate to the CRA sign-in portal via CRA User ID or Sign-in Partner (Interac Verified System). Enter your primary login credentials and verify access with your current primary MFA (SMS or phone call).
Step 2: Access Security Settings
Once inside your personal dashboard, scroll to the navigation toolbar and click Security Settings. From the available sub-menus, choose Multi-factor authentication.
Step 3: Initiate Backup MFA Configuration
Select Add a backup multi-factor authentication option. The portal presents two selection pathways: Third-party authenticator app or Passcode grid.
Step 4: Complete Enrolment
- For Authenticator App: Open your chosen app (e.g., Google Authenticator, Microsoft Authenticator, 1Password), tap Add Account, and scan the QR code displayed on the CRA screen. Enter the resulting 6-digit passcode into the CRA verification field to activate.
- For Passcode Grid: Select the option to view your unique grid. Immediately save it as a secure PDF or print out a physical copy. Confirm setup by entering the coordinate entries requested by the portal screen.
Step 5: Save Confirmation and Recovery Details
Store your Passcode Grid or Authenticator App backup keys in a secure environment. Do not share these coordinates or secret keys with anyone. The CRA will never contact you via email or SMS asking for your MFA passcodes.
Emergency Steps: What to Do If You Are Locked Out of CRA My Account
If you lose access to your primary phone number and have not set up a backup MFA method, online self-serve password resets will fail. Take these steps to recover account access:
- Locate Essential Tax Documents: Gather your Social Insurance Number (SIN), date of birth, complete address on file, and your most recent Notice of Assessment (NOA) line entries (such as Line 15000).
- Contact the CRA General Enquiries Line: Call the official CRA phone line at 1-800-959-8281.
- Verify Identity via Agent: Complete telephone identity verification with the customer service representative to reset your authentication credentials.
- Authorize Professional Assistance (Alternative): If facing tight tax filing deadlines, authorize an accountant or tax preparer via Represent a Client. Authorized representatives can access critical tax slips and file returns on your behalf while your personal login issues are resolved.
Frequently Asked Questions (FAQ)
Does my regular mobile phone number count as a backup MFA option?
No. A mobile phone number registered to receive SMS or voice calls is classified as a primary factor. A valid backup MFA must be an independent secondary system, specifically a third-party authenticator app or a CRA passcode grid.
What happens if I keep clicking “Set up later” on the MFA prompt?
While the CRA permits users to defer setup temporarily during active tax filing seasons, skipping setup leaves your account vulnerable. If your mobile carrier loses service or you change your phone number, you will be locked out and forced to call the CRA contact center for manual account recovery.
Is the CRA Passcode Grid or an Authenticator App safer?
Both offer high levels of security compared to standard SMS codes. Authenticator apps protect against physical theft through biometric smartphone locks. Passcode grids provide an offline alternative that is immune to digital device failures or malware, but physical copies must be safeguarded against theft or destruction.
Can an authorized accountant help if I get locked out during tax season?
Yes. If an accountant holds active authorization through CRA’s Represent a Client service, they can access tax records, check account balances, and submit filings independently of your personal portal login.
Additional Read:Â 2026 CPP and OAS/GIS Monthly payment schedule
Suggest Reading: Canada’s FREE Dental Care Plan
Passport Canada Question:Â How to speak to a Passport Canada agent quickly
Saving in the wrong registered account can quietly destroy a low-income worker’s retirement setup. Read our guide on TFSA vs RRSP for Low Income Earners: Avoid the GIS Retirement Trap to discover why RRSP withdrawals trigger a hidden 50% benefit clawback—and how shifting to a TFSA protects your Guaranteed Income Supplement benefits.
* * * * Most viewed topics * * * *
FREE Canadian Dental Care Plan Coverage – Online Application*
