Mortgage Fraud & Income Verification: Bootstrap Canada Revenue Agency

2024-11-13- Andrew Escobar

Mortgage Fraud & Income Verification: Bootstrap Canada Revenue Agency

Mortgage document fraud is a growing concern in Canada, but there is still no way directly verify the income of a mortgage applicant. Canada Revenue Agency (CRA) recently invited industry participants to roundtable discussions on an income verification tool, but there is no indication on when it will ship or how it might work.

In 2018, the Canada Mortgage and Housing Corporation (CMHC) asked the CRA to play a “direct and formal role” in verifying the income claimed by mortgage applicants. Six years later, some signs of progress:

Budget 2024 announces the government’s intention to consult with the mortgage industry on making available a tool through the Canada Revenue Agency […] to verify borrower income for mortgages.

A paragraph announcing your intention to consult an industry on building a thing — it does not inspire confidence. The federal service cannot simply “move fast and break things,” but endless government consultations are not innovation and they do not guarantee adoption. However, the CRA has built a strong foundation of digital services over the years, and during the immediate response to COVID-19, the federal service proved it could consult fast and build things.

Ideally, the CRA would already be able to share financial data, with a mortgage applicant’s consent, in an open banking ecosystem. Absent open banking, we should be encouraged by other progress toward secure and accessible financial data sharing.

Let’s not wait to combat mortgage fraud. The agency should be empowered to bootstrap a solution, quickly deliver income verification, and help fight mortgage fraud at scale, using one of its existing digital services.

1. Auto-fill My Return

Millions of Canadians already use Auto-fill My Return every year to simplify their income tax returns. Using either Interac sign-in service or their CRA credentials, Canadians can quickly import all the income-related tax slips and data the CRA has on file (for example, a common T4 slip). After submitting a return, Express Notice of Assessment can provide a summary, including the total income reported on line 15000.

The CRA could allow a these services to be embedded in the mortgage application process. While tax slips and tax returns are a trailing indicator that typically lag 3–16 months, they provide a verifiable long-term view of annual income.

The CRA currently limits the use of these and other services to EFILE certified tax software and online services, but it should expand eligibility to mortgage application software with access to a few services and a limited set of basic tax data: box 14 on all T4 slips and line 15000 on all tax returns.

2. Represent a Client

Many Canadians have used My Account to view and manage their taxes and benefits. Fewer are familiar with Represent a Client, which provides delegated access to multiple CRA accounts. An individual can authorize a single representative through their RepID, or all representatives covered under a GroupID or Business Number. (You do not have to be a professional accountant to use this service; I use it to manage the taxes and benefits for our extended household and businesses, using a single CRA account.)

The agency could use Represent a Client to bootstrap a new service for the mortgage industry, allowing loan processors and underwriters to verify income using a limited set of an applicant’s tax data. The mortgage industry would then have two options: use Represent a Client to manually review and verify reported income, or embed Client Data Enquiry within existing software or services to automate the process. (Most mortgage applications already list a SIN, but the CRA could alleviate privacy concerns by substituting it with a new ApplicantID.)

3. Digitally Signed PDF Statements

The most tedious aspect of a mortgage application is collecting PDF documents. Applicants are typically asked to collect online statements from banks, credit unions, wealth managers, and payroll providers, to share a complete set financial data over a 3-month period. (My spouse and I amassed 142 documents from 11 accounts at 6 financial institutions and 2 payrolls. This manual process that took hours could have taken minutes with open banking or private API access.)

PDF documents are not going away any time soon, despite their critical flaw: any determined individual can edit or manufacture a PDF document. This becomes a significant vector for fraud, because much of the mortgage industry relies on PDF statements for the application and underwriting processes. Simply put, “mortgage income document fraud must end.”

To combat mortgage fraud, financial institutions should digitally sign all monthly statements and other financial documents that are downloaded from their online services. These digitally signed PDF documents would allow loan processors and underwriters to verify authenticity in two ways:

  1. Source Verification: the signature cryptographically ties the PDF document to the signer (or a domain name) in a verifiable way.
  2. Data Integrity: the signature includes a hash of the original data (a unique fingerprint of the content at the time of signing).

OSFI and other regulators should require financial institutions to digitally sign PDF statements — but even a voluntary industry effort would take time, and it would arguably be an interim solution while we wait for open banking.

The CRA is best positioned to deliver an interim solution at scale. Among the three CRA services discussed, My Account would likely be the easiest to bootstrap for income verification: allow users to download a consolidated “Statement of Verified Income.” (The CRA could call it a T8 or T9 statement for easy reference!) This PDF document would be signed by the agency and then easily verified by mortgage professionals, all while maintaining existing processes, sharing specific financial data only, and preserving privacy .