Turn your mortgage into a wealth-building tool. Smith Manoeuvre strategies, tax-smart planning, and honest math from two Canadian mortgage strategists.
CRA Data Breach Settlement: Filing Deadlines, Eligibility Rules, and Exact Payment Amounts
You have until November 27, 2024, to file a claim in the Rice v. Attorney General of Canada settlement, and if you were locked out of your CRA account or GCKey in 2020, there's a real chance you qualify even if you never filed a formal complaint at the time.
The settlement covers anyone whose CRA or GCKey account was accessed without permission between March 1 and December 24, 2020. That window coincided with the early CERB rollout, when many Canadians relied on CRA portals to apply for emergency benefits. The breach was credential stuffing, hackers used passwords stolen from other sites to break into roughly 12,700 accounts. If you received a letter from CRA about "unauthorized access" or were forced to reset your GCKey that year, you're in the class.
What you'll actually receive
The base payout is $150. No proof of loss required. The settlement recognizes that the breach itself, the violation of privacy, the stress of being locked out during a crisis, has value. You don't need receipts showing you lost money. You just need to have been affected.
If you spent time or money fixing the mess, you can claim up to $1,000 more. Time is valued at $15 per hour. That's the government's implicit valuation of a citizen's administrative burden: an hourly rate for the hours you spent on hold with CRA, resetting your password, verifying your identity, or waiting for your refund to unfreeze. Out-of-pocket costs also count, fees for credit monitoring, notary charges if you had to prove your identity in person, mileage if you drove to a Service Canada office.
The catch: you have to document it. Phone logs showing CRA call times. Receipts for monitoring services. Employment records if you missed work. Most claimants will take the $150 and move on. The higher tier is real but requires paperwork most people won't have kept.
How the math works
The $13.17 million fund is split pro-rata after legal fees. If 50,000 people file and each takes the base amount, the $150 holds. If 100,000 file, the base shrinks to around $75. The settlement administrator, Ricepoint Administration Inc., will calculate the final per-person amount after the deadline closes. Early filers and late filers get the same treatment, no advantage to submitting today versus November 26.
Filing the claim
Go to the Ricepoint portal. You'll need your CRA user ID or GCKey username from 2020, or proof that your account was locked. If you don't have records, the portal lets you attest under penalty of perjury that you were affected. The form takes under ten minutes if you're claiming the base amount only.
For the higher-tier claim, upload everything. Scanned call logs, bank statements showing fees, a signed statement explaining the time cost. The administrator's job is to verify, not to help you build a case. Weak documentation gets rejected.
What this settlement isn't
It does not cover breaches outside the March, December 2020 window. If your account was compromised in 2021 or later, this isn't your payout. It also doesn't cover identity theft that happened elsewhere and then rippled into your CRA account. The settlement is narrow: accounts accessed during that nine-month period, full stop.
Why the deadline matters
November 27 is a hard cutoff. No extensions. If you miss it, you forfeit the claim. CRA won't remind you. The settlement notice went out as a single mailing earlier this year, and many Canadians threw it away thinking it was spam. If you were in the breach class, you're in whether you got the letter or not, but you still have to file.
Set a reminder for November 20. File then. The portal sometimes lags under load in the final week, and the administrator's help desk stops responding to technical questions three business days before the deadline.
You have until November 27, 2024, to file a claim in the Rice v. Attorney General of Canada settlement, and if you were locked out of your CRA account or GCKey in 2020, there's a real chance you qualify even if you never filed a formal complaint at the time.
The settlement covers anyone whose CRA or GCKey account was accessed without permission between March 1 and December 24, 2020. That window coincided with the early CERB rollout, when many Canadians relied on CRA portals to apply for emergency benefits. The breach was credential stuffing, hackers used passwords stolen from other sites to break into roughly 12,700 accounts. If you received a letter from CRA about "unauthorized access" or were forced to reset your GCKey that year, you're in the class.
What you'll actually receive
The base payout is $150. No proof of loss required. The settlement recognizes that the breach itself, the violation of privacy, the stress of being locked out during a crisis, has value. You don't need receipts showing you lost money. You just need to have been affected.
If you spent time or money fixing the mess, you can claim up to $1,000 more. Time is valued at $15 per hour. That's the government's implicit valuation of a citizen's administrative burden: an hourly rate for the hours you spent on hold with CRA, resetting your password, verifying your identity, or waiting for your refund to unfreeze. Out-of-pocket costs also count, fees for credit monitoring, notary charges if you had to prove your identity in person, mileage if you drove to a Service Canada office.
The catch: you have to document it. Phone logs showing CRA call times. Receipts for monitoring services. Employment records if you missed work. Most claimants will take the $150 and move on. The higher tier is real but requires paperwork most people won't have kept.
How the math works
The $13.17 million fund is split pro-rata after legal fees. If 50,000 people file and each takes the base amount, the $150 holds. If 100,000 file, the base shrinks to around $75. The settlement administrator, Ricepoint Administration Inc., will calculate the final per-person amount after the deadline closes. Early filers and late filers get the same treatment, no advantage to submitting today versus November 26.
Filing the claim
Go to the Ricepoint portal. You'll need your CRA user ID or GCKey username from 2020, or proof that your account was locked. If you don't have records, the portal lets you attest under penalty of perjury that you were affected. The form takes under ten minutes if you're claiming the base amount only.
For the higher-tier claim, upload everything. Scanned call logs, bank statements showing fees, a signed statement explaining the time cost. The administrator's job is to verify, not to help you build a case. Weak documentation gets rejected.
What this settlement isn't
It does not cover breaches outside the March, December 2020 window. If your account was compromised in 2021 or later, this isn't your payout. It also doesn't cover identity theft that happened elsewhere and then rippled into your CRA account. The settlement is narrow: accounts accessed during that nine-month period, full stop.
Why the deadline matters
November 27 is a hard cutoff. No extensions. If you miss it, you forfeit the claim. CRA won't remind you. The settlement notice went out as a single mailing earlier this year, and many Canadians threw it away thinking it was spam. If you were in the breach class, you're in whether you got the letter or not, but you still have to file.
Set a reminder for November 20. File then. The portal sometimes lags under load in the final week, and the administrator's help desk stops responding to technical questions three business days before the deadline.
Read Next
Wells Fargo Says Rising Bond Yields Should Force You to Rethink Your Stock Portfolio
At the Top Tax Bracket, Every Dollar of Rental Interest Returns 53 Cents: Why the Smith Manoeuvre™ Is a High-Income Play
China's Treasury retreat to record lows rewrites the rules for bond investors
GIC Rates Below 4.2% Flip the Smith Manoeuvre™ Math From Marginal to Compelling