CRA online tax filing authentication will become available on February 22, 2027, when Canadians begin filing their 2026 income tax and benefit returns. The new security step is optional during its first tax season. Choosing it will require you to sign in to your Canada Revenue Agency account, but Canadians who cannot use the step will still be able to file electronically.
That distinction matters most for first-time filers. They generally cannot open a CRA account before filing their first return, so they will not be able to authenticate this way. The CRA has confirmed that they can still use NETFILE or have an authorized representative file for them.
The change also applies to authorized representatives, professional tax preparers and volunteers who file returns electronically. What authentication confirms, however, depends on whether the return is transmitted through NETFILE or EFILE.
What CRA online tax filing authentication changes
The CRA announced the new authentication step on September 22, 2026. It is intended to reduce unauthorized filings and fraudulent returns by connecting an electronic filing transaction with a verified CRA account user.
When the 2027 filing season opens, eligible users will be able to sign in to their CRA account as part of filing or adjusting a return. The process applies to 2026 returns submitted through NETFILE and EFILE.
The CRA describes the step as optional for the 2026 return. This means you may choose whether to authenticate. It does not mean you can complete the authentication without signing in. If you select it, you must be able to access your CRA account.
Who can use the new authentication step?
| Filer | Filing service | What authentication confirms | Optional in 2027? |
|---|---|---|---|
| Individual filing their own return | NETFILE | The filer’s identity | Yes |
| Authorized representative using consumer tax software | NETFILE | The representative’s identity and authority to file for another person | Yes |
| Professional tax preparer | EFILE | The identity of the person initiating the filing transaction | Yes |
| Community Volunteer Income Tax Program volunteer | EFILE | The identity of the person initiating the filing transaction | Yes |
| First-time filer without a CRA account | NETFILE | Authentication is not available, but electronic filing remains available | Not applicable |
The distinction for EFILE users is important. Signing in confirms who initiated the transaction, but it does not make that person an authorized representative of the taxpayer. A preparer or representative must still follow the CRA’s separate authorization requirements when those requirements apply.
First-time filers can still use NETFILE
A first-time filer normally has no previous return on record and therefore may not yet have access to a CRA account. That creates an obvious problem if account authentication is part of electronic filing.
The CRA has addressed it directly: first-time filers can continue using NETFILE without completing the optional authentication step. An authorized representative may also submit the return and authenticate their own identity.
After the first return is assessed, the taxpayer can register for a CRA account and use the security feature in a later year. The new step therefore does not turn a CRA account into a universal requirement for filing a tax return online.
NETFILE and EFILE authentication do different jobs
NETFILE is the service used by individuals to transmit their own returns through certified tax software. It may also be used in certain circumstances by an authorized representative filing through the taxpayer-facing process.
EFILE is designed for registered tax preparers and approved volunteers. When an EFILE user authenticates, the CRA says the sign-in confirms the identity of the person sending the return. It does not establish that the preparer is authorized to manage the taxpayer’s CRA account.
An authenticated EFILE user will not have to repeat the step for every return while the session remains active. Authentication will be required again after that session ends.
This is separate from multi-factor authentication
The new filing step should not be confused with multi-factor authentication (MFA) for a CRA account.
MFA is part of signing in to the account itself. The new filing authentication connects that verified account sign-in with the NETFILE or EFILE transaction. Completing the filing step may therefore involve MFA, but the two controls serve different purposes.
CRA account users were already required to keep a backup MFA option on file beginning in 2026. Available backup methods include a passcode grid or a third-party authenticator app. A taxpayer who waits until filing day to fix an inaccessible account could face an avoidable delay, even though skipping the new authentication remains an option for the 2026 return.
What to check before February 22, 2027
- Confirm that you can sign in. Test your CRA account access well before filing season.
- Recover a locked account. The CRA says users can repeat the registration process or contact the agency to restore access. Its locked-account guidance lists the available options.
- Review your MFA methods. Make sure your primary and backup options still work, especially if your telephone number has changed.
- Update personal information. Check your mailing address, telephone number and direct-deposit details.
- Authorize your representative separately. Authentication does not replace the CRA’s representative authorization process.
These checks are useful even if you plan to skip authentication. CRA account access is increasingly important for viewing notices of assessment, tax slips, balances and correspondence.
What the announcement does not change
The September announcement changes the security process, not the tax calculation. It does not change the federal tax brackets, deductions, credits or the amount of tax owing on a 2026 return. PaycheckGuru’s guide to the 2026 federal tax brackets covers the rates that apply to income earned during the year.
The announcement also does not establish the general 2027 filing deadline or guarantee faster assessments and refunds. The only new date confirmed in this announcement is February 22, 2027, when the authentication feature is scheduled to begin.
Other CRA deadlines remain separate. For example, taxpayers required to make quarterly payments should follow the applicable CRA tax instalment rules, regardless of how they later file their annual return.
Why the CRA is adding authentication
The CRA says the change is intended to protect personal and financial information and reduce unauthorized or fraudulent returns. An authenticated transaction gives the agency another way to verify that a return was submitted by the taxpayer or by the person who claims to be filing it.
Introducing the step as optional lets taxpayers and preparers become familiar with the process before any possible future expansion. The CRA has not said in this announcement that authentication will become mandatory after the 2027 filing season. Until the agency confirms another status, it should be treated only as an optional feature for 2026 returns.
Frequently asked questions
Do I need a CRA account to file taxes online in 2027?
No. A CRA account is needed if you choose to complete the new authentication step. The CRA says the step is optional for 2026 returns, and first-time filers without accounts can still use NETFILE.
When does the new CRA authentication step begin?
It is scheduled to begin February 22, 2027, for the filing of 2026 income tax and benefit returns.
Will my accountant need access to my CRA account?
Not for this authentication step. EFILE preparers authenticate themselves through their own CRA access. Taxpayer authorization remains a separate process.
Can I file if my CRA account is locked?
Because authentication is optional for the 2026 return, a locked account does not automatically prevent electronic filing. The CRA nevertheless recommends restoring access before filing season.
Is this the same as the NETFILE access code?
No. The new step involves signing in to a CRA account to authenticate the user. It is separate from the access code that tax software may request when transmitting a return.
Last verified: September 25, 2026.
Sources: Canada Revenue Agency, The CRA is enhancing security for online income tax and benefit return filing, published September 22, 2026; and Canada Revenue Agency, CRA account help: Locked account. Details were checked September 25, 2026.