Advanced mortgage strategies from a twenty-year strategist. Written to help you pay off sooner, save more, and retire three to four times wealthier — without paying more each month.
CRA Breach Settlement: Eligible Canadians Can Claim Up to $1,300, Here's How
The deadline passed November 27. If you filed before then, you're waiting on a cheque. If you didn't, the window is closed.
The settlement came out of Rice v. Attorney General of Canada, a class action over credential-stuffing attacks that hit roughly 48,000 CRA accounts between March and August 2020. The federal government settled for $15.175 million without admitting fault. Rice Point Administration is handling the payouts.
Two Payout Tiers
The settlement works on a two-tier system. Most people qualify for the base tier: roughly $150 for the time you spent fixing the mess. That's 2-3 hours on hold with the CRA, resetting passwords, filing affidavits. The exact amount depends on how many people filed. If claims came in higher than expected, everyone's base payment drops proportionally. The fund is capped.
The second tier pays up to $5,000 for documented out-of-pocket losses or identity theft. This is where most claims fall apart. You need hard documentation: police reports, bank statements showing fraudulent transactions, receipts for credit monitoring services you purchased after the breach, copies of any correspondence with collection agencies if your identity was used to file false returns. If you can't prove the loss with paper, you don't get the higher tier.
A 2020 breach means you're trying to pull receipts from six years ago. Most people don't have them.
What Actually Happened in 2020
The attacks weren't a server breach. They were credential stuffing: hackers took passwords leaked from other websites and tried them against CRA login pages. It worked because people reused passwords. The attacks hit during CERB rollout, when everyone was logging into My Account to apply for emergency benefits. High traffic, high confusion, perfect cover.
Service Canada's GCKey system was hit too, roughly 9,000 accounts. If you used GCKey to access federal services beyond just CRA, you were exposed on both sides.
What the Government Changed
The CRA now forces multi-factor authentication on all new sign-ins. If you haven't logged in since 2020, expect mandatory password resets and SMS verification. The Treasury Board overhauled digital identity protocols for every federal department. None of this helps the 48,000 people whose accounts were already compromised, but it closes the door that was open.
Why the Payout Is Low
$15.175 million sounds large until you divide it by 48,000 people, then subtract legal fees. Canadian class actions typically reserve up to one-third of the settlement for legal costs and administration before a dollar reaches the victims. If 30% goes to lawyers and admin, you're left with roughly $10.6 million. Spread across 48,000 eligible claimants, that's $220 per person before the higher-tier claims are paid out. Once those $5,000 payouts go to the small group with full documentation, the base tier shrinks further.
The $150 base figure reflects "administrative hassle," which is a relatively new concept in Canadian privacy settlements. It's an acknowledgment that hours spent on hold have value, even if you didn't lose money directly.
What You Should Check Now
If you filed a claim before November 27, check your mailbox and your email. Rice Point sends status updates via both. Payments are being processed now, but don't expect same-day turnaround. The administrator has to validate every submission before issuing cheques.
If you didn't file, the claim window is closed. No extensions have been announced.
The bigger takeaway: check your CRA My Account login settings. If you're still using a password you use anywhere else, change it. The 2020 breach wasn't sophisticated. It was just effective.
The deadline passed November 27. If you filed before then, you're waiting on a cheque. If you didn't, the window is closed.
The settlement came out of Rice v. Attorney General of Canada, a class action over credential-stuffing attacks that hit roughly 48,000 CRA accounts between March and August 2020. The federal government settled for $15.175 million without admitting fault. Rice Point Administration is handling the payouts.
Two Payout Tiers
The settlement works on a two-tier system. Most people qualify for the base tier: roughly $150 for the time you spent fixing the mess. That's 2-3 hours on hold with the CRA, resetting passwords, filing affidavits. The exact amount depends on how many people filed. If claims came in higher than expected, everyone's base payment drops proportionally. The fund is capped.
The second tier pays up to $5,000 for documented out-of-pocket losses or identity theft. This is where most claims fall apart. You need hard documentation: police reports, bank statements showing fraudulent transactions, receipts for credit monitoring services you purchased after the breach, copies of any correspondence with collection agencies if your identity was used to file false returns. If you can't prove the loss with paper, you don't get the higher tier.
A 2020 breach means you're trying to pull receipts from six years ago. Most people don't have them.
What Actually Happened in 2020
The attacks weren't a server breach. They were credential stuffing: hackers took passwords leaked from other websites and tried them against CRA login pages. It worked because people reused passwords. The attacks hit during CERB rollout, when everyone was logging into My Account to apply for emergency benefits. High traffic, high confusion, perfect cover.
Service Canada's GCKey system was hit too, roughly 9,000 accounts. If you used GCKey to access federal services beyond just CRA, you were exposed on both sides.
What the Government Changed
The CRA now forces multi-factor authentication on all new sign-ins. If you haven't logged in since 2020, expect mandatory password resets and SMS verification. The Treasury Board overhauled digital identity protocols for every federal department. None of this helps the 48,000 people whose accounts were already compromised, but it closes the door that was open.
Why the Payout Is Low
$15.175 million sounds large until you divide it by 48,000 people, then subtract legal fees. Canadian class actions typically reserve up to one-third of the settlement for legal costs and administration before a dollar reaches the victims. If 30% goes to lawyers and admin, you're left with roughly $10.6 million. Spread across 48,000 eligible claimants, that's $220 per person before the higher-tier claims are paid out. Once those $5,000 payouts go to the small group with full documentation, the base tier shrinks further.
The $150 base figure reflects "administrative hassle," which is a relatively new concept in Canadian privacy settlements. It's an acknowledgment that hours spent on hold have value, even if you didn't lose money directly.
What You Should Check Now
If you filed a claim before November 27, check your mailbox and your email. Rice Point sends status updates via both. Payments are being processed now, but don't expect same-day turnaround. The administrator has to validate every submission before issuing cheques.
If you didn't file, the claim window is closed. No extensions have been announced.
The bigger takeaway: check your CRA My Account login settings. If you're still using a password you use anywhere else, change it. The 2020 breach wasn't sophisticated. It was just effective.
Read Next
7 Ways to Build a Cash Reserve Before Tariffs Hit Your Paycheque
Montreal Home Sales Fall 13% While Prices Climb: Why This Isn't a Buyer's Market Yet
When Your $480,000 Mortgage Renews at $3,100 Instead of $2,450
Your Partner Said No to the Offset Mortgage: How to Restart the Conversation Without the Defensiveness