In an email spoofing attack, an employee of a business might share important financial information with, or send money to a, a fraudster because the employee has received an email from the fraudster masquerading as the employee’s boss. In a ransomware attack, a business might make payments to criminals to recover data.
The CRA confirmed that a business can deduct losses relating to these kind of scams
but only if the payments made to the criminals were within the parameters of subsection 9(1), paragraphs 18(1)(a) and (b), and section 67 of the Income Tax Act (the “Act”). The CRA noted, however, that the expense had to be reasonable compared to the income-earning activities of the taxpayer’s business.
Wolters Kluwer Tax Topics no 2695 (January 2, 2024) summarizing CRA technical interpretation 2023-0984251E5 dated September 21, 2023.
