2023-2024 Credential and Authentication Qualitative Research Program

Executive Summary

Prepared for the Canada Revenue Agency

Supplier Name: Nanos Research
Contract Number: CW2355366
Contract Value: $117,836.40 (including HST)
Award Date: 2024-03-11
Delivery Date: September 2024

Registration Number: POR 141-23

For more information on this report, please contact the Canada Revenue Agency at:
cra-arc.media@cra-arc.gc.ca

Ce rapport est aussi disponible en français.

2023-2024 Credential and Authentication Qualitative Research Program – Executive Summary

Prepared for the Canada Revenue Agency
Supplier name: Nanos Research
September 2024

This public opinion research report presents the results from a qualitative study conducted by Nanos Research on behalf of the Canada Revenue Agency. The research featured a sample of adults from the general population, as well as tax intermediaries or those who are decision-makers for Small and Medium-sized Enterprises (SME). The focus groups were held from June 11th to July 4th, 2024.

Cette publication est aussi disponible en français sous le titre : Programme de recherche qualitative sur l'authentification et les justificatifs d'identité 2023-2024.

This publication may be reproduced for non-commercial purposes only. Prior written permission must be obtained from the Canada Revenue Agency.

For more information on this report, please contact the Canada Revenue Agency at:

cra-arc.media@cra-arc.gc.ca
101 Colonel by Drive
Ottawa, Ontario K1A 0K2
Canada

Catalogue Number: Rv4-207/2024E-PDF

International Standard Book Number (ISBN): 978-0-660-73719-5

Related publications (registration number)

Catalogue Number: Rv4-207/2024F-PDF (Final report, French)

ISBN: 978-0-660-73720-1

© His Majesty the King in Right of Canada, as represented by the Minister of the Canada Revenue Agency, 2024.

Executive summary

The Canada Revenue Agency (CRA) commissioned Nanos research to conduct a qualitative public opinion research (POR) to explore Canadians' perceptions surrounding the CRA's online portals and other service interactions.

A. Research purpose and objectives

The purpose of the research was to assess the perceptions and experiences of members of the general population, decision-makers of small businesses, and professionals involved in assisting individual and small business clients on tax-related or payroll matters in the following areas: registering for CRA online portals, signing into CRA online portals, experiences and challenges with the CRA call centre, concerns accessing CRA online portals and services, opinions related to identity validation options, and support for the implementation of biometric authentication.

B. Methodology

To meet the objectives, 16 focus groups were conducted across the country. All groups were conducted online. In total, 143 individuals participated in the research: 55 adults from the general public, 43 decision-makers of small businesses, and 45 tax intermediaries. There were 13 sessions conducted in English and three in French featuring adults from Québec. All participants received an honorarium. The fieldwork took place between June 11 and July 4, 2024.

C. Key findings by theme

Overall, participants across all three segments reported few issues with the registration or sign-in processes for the CRA online portals, with few exceptions such as the wait for the code in the mail or issues with two-factor authentication Two Factor Authentication (2FA).

Participants are open to the new document verification method and would be in favour of the CRA implementing biometric authentication to sign into CRA portals. However, for both items they emphasized the importance of it being a choice and not a mandatory replacement of current methods.

Experiences and challenges registering for CRA online portals

• For the most part participants said they found the registration process for their CRA account (whether MyAccount, My Business Account or Represent a Client) to be simple and straightforward, with the biggest pain point being having to wait for the code to arrive in the mail.
• Among those who registered a few years ago during COVID-19 pandemic, several reported that the biggest difficulty with registering was the additional layer of delays receiving the code and/or getting through to the CRA call centre if registration assistance was required, likely due to employment furloughs and the execution of The Canada Emergency Response Benefit(CERB) payments.
• In terms of challenges that are within the control of the CRA, participants found it challenging having to select security questions (i.e. too many of them or they were not relevant to the participant), as well as difficulties getting through to a call centre agent for assistance and being unable to register through their bank or via provincial verification.
  • SME participants also noted issues where they had more than one business they owned, and were unable to use the same bank account for these businesses in their CRA My Business Account or having difficulties adding different bank accounts to their portal account for each separate business.
  • Some challenges specific to tax intermediaries were the requirement to link their Represent a Client account to their My Account when they registered despite wanting to keep these accounts separate.
• Most participants said the registration process took a reasonable amount of time, aside from needing to wait for the mailed code. In terms of the difficulty level compared to other online portals, most participants said it is about the same, again with the exception of the wait time to receive the code by mail.
  • Rural participants in particular said the mailed code is a challenge, as it often takes even longer for them to receive, or it is inconvenient due to a lack of door-to-door mail delivery.
• Participants said the CRA portal requires more security steps and procedures than other portals, but that they understand why it is necessary.

Experiences and challenges signing into CRA online portals

• Similar to experiences with the registration process, most participants across the three audiences said they found the process to be generally easy and straightforward, with some saying they did find it confusing initially, but after signing in once or twice they now know what to do.
• Participants did mention some challenges with two-factor authentication (2FA), including having difficulties receiving the code, having the code expire before they could use it or having to re-do 2FA despite selecting the option for not needing to re-authenticate for the eight-hour period. This last challenge was mentioned often by tax intermediaries, who emphasized the need to remain logged in for longer period without having to re-verify themselves throughout the day. They noted that they need to be signed into their Represent a Client accounts for long periods of time, and they find it frustrating and a waste of time to have to re-verify, when they are timed out of the application. Some participants also mentioning that when they click the "Remember Me" functionality to avoid having to do 2FA within an eight hour window while using the same browser, it does not seem to work. A few rural participants noted they found the text option inconvenient, as they do not always have cell service to receive the text before it expires.
• Most participants said they have not had any issues signing in, though some expressed issues related to forgetting their password or security question responses, or having changed their phone number that is tied to their account and two-Factor authentication , all of which are outside the control of the CRA. In these situations, it was common for participants to report they ultimately had to call the CRA to resolve these issues, as they couldn't fix them on their own.
• Compared to the sign-in process of other portals, most participants say the difficulty level is about the same. They often mentioned CRA requires more security steps, but again noted they understand why that is necessary and said if you keep your information nearby (for example, your user name/password, answers to security questions), then it is not an issue. A few participants said the sign-in process for CRA portals is more difficult, only because they can sign in to other portals with Face ID or using an authenticator app.
• When asked about the ideal way to sign into an online portal, most participants either said the current method is fine as is, or they could sign in with biometrics, such as a fingerprint scan or Face ID. Also mentioned were being able to choose how to receive the 2FA code, including choosing from multiple phone numbers, a longer pause for 2FA being required again once signed in, being able to link the CRA portal to an authenticator app, having a CRA portal app, or being able to reset their password via email or another method and not needing to call the CRA.

Experiences and challenges with CRA online portal call centre

• Experiences with CRA's call centre to resolve issues with the sign-in process were mixed, with many participants noting the long wait times to get through to an agent depending on when they call, although most said once they did get through, the agent was helpful and resolved their issue.
• Participants said that the queue for callbacks fills up quickly and they are not usually able to request one, while others said the line often disconnects either while they are holding or as soon as the agent picks up, meaning they have to start from the back of the line.
  • Tax intermediaries said the lack of clarity over which line to call and the lack of their own designated line is a pain point for them, since they are often dealing with time sensitive client issues that require a fast response.
• Participants had a number of recommendations to improve the call centre experience, including: implementing a call back system with a larger capacity, having an option to request to speak to an agent immediately instead of listening to all the options, adding a separate line for "quick issues" such as resetting a password, offering other self-serve options for resetting a password aside from calling (chat bot or email a secure link) to free up phone lines for other issues, providing the actual estimated hold time so individuals can decide whether to stay on the line, among others.

Concerns accessing CRA portals and services

• Most participants said they have no concerns about accessing CRA digital portals and services, and mentioned they feel security is adequate and similar to other portals like online banking apps. A few participants mentioned concerns about hacking or security breaches, but noted that this is not CRA specific, while others said they would like more information on how their data is stored.
• Several tax intermediaries mentioned they are not comfortable with their SIN number or banking information being linked to their Represent a Client account and their work, reporting that they would prefer being able to keep these things separate.

Additional verification step in portal

• Views were mixed on having an additional identity verification process being required while already in the portal, with some saying this is unnecessary and would be overkill. Others said they have no issue with it and the more security provisions, the better, while a few participants said it would depend on what the extra process entailed and how intrusive it was.
• A few participants said they would be okay with the extra process if there was a reason for doing so, such as concerns about suspicious activity in the account or if they were trying to make a significant change, such as changing their direct deposit information or mailing address. Several said that while they would find the extra step annoying, they understand that the security processes are necessary due to the sensitivity of the information.

Identity validation options for registration

• Many participants said they would prefer to use a government issued photo ID to register for their CRA account, a new identity validation option, known as the document verification service. They often said they would prefer this as it would be quicker and more convenient than having to wait for the code to arrive by mail. Furthermore, participants felt that given they already use their ID to access other services, and/or that they typically have it nearby, it would be a simple process for them. Some participants said it would depend what type of ID is required, or that they would want more information on how it would work and what information is needed. Participants also mentioned that they would still want the mailed code to be an option for those who are not comfortable using the ID, don't know how to, or do not have a valid ID.
• Those who would prefer to receive the code by mail cited concerns as to how the ID was stored or used, or worried the data could be stolen if there was a security breach. Some said they would use the government issued ID if they needed to register quickly and it was time sensitive, but otherwise they would prefer to just receive the code by mail.
• In terms of potential concerns about using the document verification service, participants mentioned concerns about how the ID would be stored, or whether it could be susceptible to being hacked or stolen and misused. Some participants mentioned concerns related to AI being able to forge or replicate ID's and suggested registrants be required to hold the ID next to their face to avoid this. Generally, participants said they would want more information, including how the ID would be scanned and stored, what kinds of ID would be valid and what would happen when or if their ID was expired. Others mentioned concerns about this new method replacing the mailed code option, as not everyone can or would want to use this service. Often these participants felt that as long as they still had the option to register with the mailed code, they would not have any concerns.

Comfort using biometrics when accessing online accounts and services

• For the most part participants expressed they are comfortable using biometrics for digital portals and services generally. These authentication methods are often used for other online apps and services such as online banking, or just to unlock their smartphone, so participants were familiar with it. However, some would prefer to be able to select which type of biometric they could use or would want a backup option if biometric authentication failed. Several participants mentioned concerns around the biometrics not working or potential hacking, noting that they would be potentially concerned about their biometric data being stolen in a breach.
• Many participants said they would be comfortable using biometrics to sign into CRA portals or services, again saying they already use biometrics for other apps and services, and often said they would prefer this method for the CRA and think it would be more convenient and would speed up the sign in process. Several participants said they would be comfortable if this was part of the process, but that it should not be mandatory or the only step, noting that not everyone will be able or willing to use biometrics, including seniors or less technologically savvy individuals, or those without access to a smartphone. They also often noted that biometrics do not always work and there should be a backup method without being automatically locked out.
• A few participants were less comfortable using biometrics for their CRA portal and said they would want more information on the type of method and how it would work, as well as how biometric data would be stored by the CRA. Some said they are not comfortable with the CRA having a stored scan of their face or fingerprint which could be stolen or misused, or expressed concerns that AI could be used to simulate their image and be used to authenticate via Face ID.

Support for CRA introducing biometric authentication

• Most participants were in favour of the CRA introducing biometrics, however many said this should remain optional only and not a replacement of all other security measures.
• Several said they support the implementation and that this is where technology is headed, while others said they believe this will be more convenient and faster in terms of the sign-in process. Another positive mention was that biometrics was seen to mean people do not need to remember passwords or security responses. A few participants said they are not in favour of this, as to them it seemed complicated and not necessary, while a few more questioned what the cost would be to implement this and whether or not it would be worth it.
• Many participants said they do trust the CRA to implement biometrics, often noting that this is not a new technology, and that the CRA is a large department and has the resources and technology needed to do so. Several participants said while they trust the CRA to implement biometric technology, they wonder how long it would take, and how many issues and glitches would occur while being implemented. These participants said any new biometric authentication methods would need to be thoroughly beta-tested and that it would be important to still rely on other authentication methods in case of problems.
• Others said they would need more information before they could make a decision as to whether they support or oppose this type of authentication, saying it depends on how the biometric data would be stored, what would be stored, and who would have access to it. A few said they don't trust the technology would work and/or don't trust the human beings working on it not to make mistakes. Some said that while they trust the CRA to do so, they questioned if this is necessary and whether it is worth the cost compared to other competing priorities the CRA may have.
• A few said they do not trust the CRA (or anyone) with their biometric information, and some stated concerns related to previous security breaches or hacks at the CRA, and said they are not sure their data would be safe, and that transparency would be extremely important.

D. Limitations and use of the findings

Qualitative research is designed to reveal a rich range of opinions and generate directional insights rather than to measure what percentage of the target population holds a given opinion. The results of these focus groups and in-depth interviews provide an indication of participants' views about the issues explored, but they cannot be quantified nor generalized to the full population of taxpayers, small businesses, and tax professionals. As such, the results may be used by the CRA for the following: to gauge satisfaction with the Agency's online portal registration and sign-in processes; to provide evidence-based information for strategic decision-making; and to provide information for reporting on credential and authentication considerations.

E. Contract value

The total contract value was $117,836.40 (HST included).

F. Political neutrality statement and contact information

This certification is to be submitted with the final report to the Project Authority.

I hereby certify, as a Representative of Nanos Research, that the deliverables fully comply with the Government of Canada political neutrality requirements outlined in the Government of Canada's Policy on Communications and Federal Identity and Directive on the Management of Communications. Specifically, the deliverables do not include information on electoral voting intentions, political party preferences, party standings with the electorate, or ratings of the performance of a political party or its leaders.

Nik Nanos
Chief Data Scientist and President
Nanos Research
nik@nanos.co
(613) 234-4666 x237