1. Get an authenticator app
   Search for and download a free third-party authenticator app from a reputable app store
   How to choose a reputable authenticator app

   Most reputable, standard authenticator apps should be able to read the QR code we provide. To make sure the app you are downloading is reputable:

   • Download only from official app stores (such as Google Play, the Microsoft Store, or the Apple App Store)
   • Read the privacy agreement before you download to make sure your data is handled securely
   • Read recent reviews to check for reported security concerns
   • Check the number of reviews or downloads (a low number may be a concern)

   You do not need to spend money to get a reputable authenticator app.

   Learn how to recognize a scam.

2. Set up the app to use with your CRA account (one time only)
   When you are setting up this MFA option for your CRA account, either:
   

   Scan the provided QR code with a mobile device when prompted Option 1 of 2

   Manually enter the setup key the CRA provides to you into the app Option 2 of 2

3. Get your passcode in the authenticator app
   Every time you sign in to your CRA account and are prompted for a passcode, open your authenticator app to get the 6-digit code. For security, the app will generate a new passcode every 30 seconds.

The passcode grid is a table made up of numbered rows and lettered columns, similar to a Bingo card.

1. Get your passcode grid
   When you enroll with this option, the CRA will generate a unique passcode grid for you
2. Save or print your grid
   You will use this same grid every time you sign in for the next 18 months
3. Use the grid to get your passcode
   Whenever you sign in to your CRA account, we will ask for row and column combinations from your grid (for example, B,1; A,3) to create your one-time passcode. We will ask for 3 of these combinations each time you sign in.
4. Generate a new grid every 18 months
   Your grid expires every 18 months. Before it expires, you can:
   1. Sign in to your CRA account
   2. On your Welcome page select Security settings
   3. Select Multi-factor authentication and generate a new grid
   4. Save or print your updated passcode grid

   If your passcode has already expired, you can still use it to sign in. You will then get a new one to save or print.

If you choose to enroll with the phone option, you will need to provide at least one cell or landline number.

Using VoIP

You can use a VoIP service with multi-factor authentication. However, some VoIP services may not be compatible with MFA. If you can’t get the one-time passcode by text, choose the “Call me” delivery method.

You can receive your passcode to phone numbers based within North American countries that participate in the North American Numbering Plan (countries that an individual can call from Canada by dialing 1 + 10 digits). The phone number must be supplied by telephone providers.

Phone numbers in the following countries can receive a passcode:

• American Samoa
• Anguilla
• Antigua and Barbuda
• Bahamas
• Barbados
• Bermuda
• British Virgin Islands
• Canada
• Cayman Islands
• Dominica
• Dominican Republic
• Grenada
• Guam
• Jamaica
• Montserrat
• Northern Mariana Islands
• Puerto Rico
• Saint Kitts and Nevis
• Saint Lucia
• Saint Vincent and the Grenadines
• Saint Maarten
• Trinidad and Tobago
• Turks and Caicos Islands
• United States
• United States Virgin Islands

Alternately, you can enroll with the passcode grid or third-party authenticator app options which do not need access to a phone at all.

When you sign in, you can choose to receive your one-time passcode by:

• Text message Option 1 of 2

  Open the text message first, then use the passcode from the body of the message.

  The CRA does not charge for this service, however your provider may charge standard message and data rates.

• Phone call Option 2 of 2

  Your passcode will be verbally told to you in an automated message from a toll-free number.

If you did not receive your one-time passcode, you can:

• Ask for it to be resent or sent to a different phone number that you have already enrolled with
• Try the Call me option instead of Text me if you are using a VoIP service
• Use one of the other two MFA options if you have them set up

If you still can't receive your one-time passcode, you will need to contact us.