Security

1. What is a cookie?
2. I don't want to set my cookies to "on". Can I still use the CRA login services?
3. What happens when I select the radio button "Do not ask me a security question each time I login."?
4. How do I login to the CRA without having to answer a security question?
5. What can I do to ensure my security after an online session?
6. What happens if I clear my cache?
7. What can I do to protect my personal information?
8. How do I block access to my information on the CRA login services?
9. Why can I bookmark some pages and not others?
10. Why can't I receive my CRA security code by email?
11. Why do I need a CRA security code?

---

1. What is a cookie?

A cookie is a small piece of information that is sent to your computer by a Web site and used by your browser. It contains settings to help you use our services. There are two types of cookies: session cookies and persistent cookies.

A session cookie is used only during the browser session. It expires when the user closes the browser and it is not stored on your hard drive.

A persistent cookie is placed on your computer and will remain on your hard drive for a specific period of time, unless you remove it. The CRA login services use persistent cookies, which will not store any identifying data.

2. I don't want to set my cookies to "on". Can I still use the CRA login services?

One of the ways we ensure that you continue to be identified and that we send the correct information during your online session is by using cookies. Right now, we have no other session management method for users who prefer not to accept browser cookies. If you don't accept cookies, you won't be able to use the CRA login services.

3. What happens when I select the radio button "Do not ask me a security question each time I login."?

If you select the radio button labeled "Do not ask me a security question each time I login." a persistent cookie will be added to your browser and you will be remembered on this computer. Consequently, each time you login, you will not have to answer one of the questions you have chosen.

If you select "Ask me a security question each time I login.", then each time you login you will be asked to provide the answer to one of the questions you have chosen.

Note: We recommend that you only select "Do not ask me a security question each time I login." for your personal computer and not one that is shared by others; for example, in Internet cafés or public libraries.

4. How do I login to the CRA without having to answer a security question?

To login to the CRA without having to answer a security question you must first login to a CRA login service. Once you have logged in you will have the option of selecting "Do not ask me a security question each time I login."

5. What can I do to ensure my security after an online session?

The CRA takes the confidentiality of your information very seriously. We use sophisticated security techniques to protect our site and your privacy. Powerful encryption technology and security procedures protect your personal information at all times. That's why you have to use approved security protocols to view your personal information or manage your personal income tax and benefit account online. Don't forget to click "Logout" once you are finished accessing our services. For more information, see Important security information.

6. What happens if I clear my cache?

Clearing your cache will remove any cookies that are stored on your computer's browser. This means that each time you login using that computer, you will have to answer one of the security questions you have chosen. If you do not want to answer one of the questions you already chose, do not clear your cache.

Note: If you are using a computer available in a public location (e.g., Internet café or library), you should clear the browser's cache or close and reopen the browser. Information stored in the browser's cache is not encrypted, so clearing the cache helps to ensure the security of your information.

7. What can I do to protect my personal information?

You can contribute to the security of your personal information by:

• Making sure you keep your personal information confidential. Do not share your SIN, personal tax information, CRA security code or your CRA user ID and password with anyone. All pieces of information should be kept confidential. The person to whom the SIN belongs must be the one using the online service, since the required information can be used to change personal information on file with the CRA.
• Clearing your browser's cache. Note: Clearing your cache will remove any cookies that are stored on your computer's browser. This means that each time you login using that computer, you will have to answer one of the security questions you already chose.
• Not sending confidential information to the CRA by email. Our email does not have secure transmission capabilities.

8. How do I block access to my personal information on the CRA login services?

To ask to have online access to your information on the CRA login services disabled, call the e-Services Helpdesk. After access to your information is disabled, you may change your mind and want access again. If so, you can call the e-Services Helpdesk and ask that your access be re-activated.

9. Why can I bookmark some pages and not others?

You cannot bookmark pages that are in a secure part of our Web server.

10. Why can't I receive my CRA security code by email?

Although email is common and widely used today, it is not secure. It can be intercepted and the name of the originator can be changed. You should also be aware of Important security information regarding email fraud. The CRA will never ask you to provide us with personal information by email. If you receive such a request, do not respond and contact our e-Services Helpdesk immediately.

11. Why do I need a CRA security code?

For My Account for individuals and My Business Account, you will need a CRA security code in order to complete the registration process. The separate mailing of the CRA security code is an added security measure. The letter provides you with your CRA security code but it also serves to alert you in the event someone else has tried to register online using your personal tax information. If you have received a CRA security code and have not recently registered for the My Account for individuals or My Business Account services, contact our e-Services Helpdesk immediately.