CRA Multi-Factor Authentication: What Small Businesses Must Know

ByInsight Accounting CPA — Tax Team

The Canada Revenue Agency (CRA) is tightening security around its online services. Beginning February2026, every CRA user—including smallbusiness owners—will be required to register a backup multifactor authentication (MFA) method in addition to their primary MFA. Failure to do so can result in account lockouts at a critical time in the tax cycle.

Why the Backup MFA Requirement?

  • Prevent Identity Theft — A secondary MFA option ensures a taxpayer can still access their account if their primary method is compromised.
  • Avoid Tax Season Delays — If a primary device is lost or out of service, a backup prevents the business from missing filing deadlines.
  • Strengthen Data Security — The CRA’s goal is to safeguard taxpayer data against increasingly sophisticated cyberthreats.

What Counts as a Backup MFA Option?

| Acceptable Method | Description |
|—|—|
| Passcode Grid | A series of numbers chosen from a 3×3 or 4×4 grid that the user selects as a secret. |
| ThirdParty Authenticator App | Apps like Microsoft Authenticator, Google Authenticator, or Authy that generate timebased codes. |

Phone calls or text messages remain valid for primary MFA but are not considered a backup.

How to Set It Up

  • Log In — Use your existing primary MFA to sign into your CRA My Business Account.
  • Navigate to Security Settings — Find the MFA section under Account Settings.
  • Add Backup Method — Follow the onscreen prompts to select either a passcode grid or authenticator app.
  • Verify — Enter the code generated by the backup method to confirm the setup.
  • Save — Confirm that the backup method is active; you should see a green checkmark.

Quick Tip

Set up the backup MFA before the February 2026 deadline. The CRA system will block new users from accessing the account if no backup is registered. A short 5minute setup now saves hours of potential confusion later.

Common Pitfalls and How to Avoid Them

  • Forgetting to Activate — The CRA will only flag the account if you log in and the backup is not registered. Verify after setup.
  • Using an Ineligible Method — Phone calls or SMS are not backups. Doublecheck the method type.
  • Multiple Devices — If you have several phones or computers, register the same backup MFA on all devices to prevent future lockouts.

What Happens If You Don’t Register?

The CRA’s system will display a warning the first time you log in without a backup method. If ignored, the account will be locked during the 2026 filing window, forcing the business owner to contact CRA support and potentially pay a fee or delay filing.

Need Assistance?

If you’re unsure how to add a backup MFA or encounter errors, contact the CRA’s help desk or consult with a CPA. Many accounting firms, including InsightSCPA, offer a quick MFAsetup service to ensure compliance.

For more detailed guidance on CRA online account security, see our Tax Planning resource. If you run a small business, also review our Small Business Accounting page for related security tips.

—

Prepared for InsightSCPA. 2026. All rights reserved.

Related Resources

Important — informational only, not advice. Do not use this article to make any decision.

This article is published by Insight Accounting CPA Professional Corporation for general educational purposes only. It is not tax, legal, accounting, financial, or investment advice, and nothing in this article should be relied upon — by anyone, for any purpose — to make a business, tax, financial, accounting, legal, or investment decision.

Tax law, CRA administrative positions, court interpretations, and Ontario provincial rules change frequently, sometimes retroactively, and the content of this article may be incomplete, simplified, out of date, or wrong by the time you read it. The right answer for your specific situation depends on facts this article does not know — your structure, history, jurisdiction, filings, contracts, and goals.

Before acting, engage your own Chartered Professional Accountant or qualified advisor who has reviewed your specific circumstances in writing. Insight Accounting CPA Professional Corporation, the author, and any contributors expressly disclaim all liability — direct, indirect, or consequential — for any action taken or not taken on the basis of this content.

Insight Accounting CPA Professional Corporation is led by Bader A. Chowdry, CPA, CA, LPA — licensed by CPA Ontario under the Public Accounting Act, 2004. To engage us for situation-specific advice, book a free 30-minute discovery call.

Similar Posts