RCMP Cyber Fraud Charges Laid in Federal Wage Subsidy Case

Community Safety Alert: Cyber-Enabled Wage Subsidy Fraud

Royal Canadian Mounted Police (RCMP) Federal Policing – Central Region has laid multiple criminal charges after uncovering a large-scale, cyber-enabled fraud scheme targeting the federal Canada Emergency Wage Subsidy (CEWS) program. The CEWS initiative, managed by the Canada Revenue Agency (CRA), was created to help Canadian employers retain staff during the COVID-19 pandemic.

The investigation determined that suspects allegedly used stolen and compromised online credentials belonging to legitimate Canadian businesses to submit unauthorized CEWS claims. According to investigators, these cyber intrusions and fraudulent applications resulted in approximately $5.7 million in illegitimate wage subsidy claims, while the affected businesses were reportedly unaware that their CRA accounts had been accessed or used in this way.

Official RCMP Investigation Details

In January 2021, the RCMP’s International Anticorruption Team within the Sensitive and International Investigations (SII) Unit, working jointly with the CRA Criminal Investigations Division, launched a coordinated operation into cyber intrusions linked to the CEWS program. The inquiry focused on unauthorized access to the CRA’s online systems, particularly the “Represent a Client” service, which allows authorized representatives to act on behalf of businesses.

Investigators concluded that a compromised “Represent a Client” (RepID) credential was used to submit CEWS applications on behalf of legitimate businesses whose CRA My Business Account (MyBA) access had been unlawfully obtained. These businesses reportedly did not know their accounts had been accessed or that wage subsidy applications were being filed in their name.

The Financial Transactions and Reports Analysis Centre of Canada (FINTRAC) assisted the RCMP during this complex financial and cybercrime investigation.

Accused Individuals and Criminal Charges

As a result of this federal policing investigation, the following individuals have been charged under the Criminal Code of Canada:

• Mohammed Ehteshamul Huq, 50 years old
• Robert Arthur Otto, 79 years old

Each accused faces the following charges:

• Fraud over $5,000 (section 380(1)(a))
• Laundering proceeds of crime (section 462.31(1)(a))
• Possession of identity information for the purpose of committing an indictable offence (section 402.2(1))
• Possession of property obtained by crime (section 354(1)(a))

The accused are scheduled to appear in court in Brampton, Ontario, on June 4, 2026.

CrimeCanada.ca Safety Perspective

From the perspective of CrimeCanada.ca, this case highlights how cybercrime and identity-based fraud can impact not only federal programs, but also legitimate businesses across Ontario and the rest of Canada. When business credentials are compromised, criminals can redirect government supports, distort financial records, and create serious legal and tax complications for unsuspecting owners. Incidents like this are part of broader national trends we monitor and report on through our National Crime News coverage.

Business owners in Ontario communities, including smaller areas such as New Credit (Part) 40A crime and safety statistics regions, should take extra care to protect CRA login information, regularly review My Business Account activity, and immediately report any suspicious or unknown transactions to the CRA and local police. Using strong, unique passwords, multi-factor authentication where available, and restricting who has access to “Represent a Client” credentials are critical steps in reducing the risk of this type of fraud. CrimeCanada.ca will continue to track and analyze cyber-enabled financial crime so communities can better understand evolving risks and reinforce local safety practices.

Official Source & Community Safety

This safety alert is based on an official release from the Royal Canadian Mounted Police (RCMP). CrimeCanada.ca aggregates and analyzes this data to keep the ontario community informed, aware, and safe. We are an independent safety data aggregator and not the original creators of the underlying incident report.

Read the full official release here: RCMP Official Statement.