It's quite possible that some people will call saying that they are the agency. I would say, if you have a doubt, it's better not to divulge any information to those callers. If it happens—because sometimes we have to call taxpayers when we have identity theft—this is one of the exceptions where we would call someone.
If you don't feel good about that, if you have any doubts, don't take the call. Tell the person that you don't believe it's the CRA. If it's the agency, the person will explain to you the steps to validate that they are calling from there. They will give you a number. They will ask you to go on the website to find for yourself the 1-800 number that you should be calling. From there, someone will confirm to you that someone at CRA is trying to call you, and they could put you in contact with that person.
We have an identity protection service in the agency. There is a specific line for those cases. If you call the general inquiry line, when you listen to the message, you can press a number, and they will direct your call to the identity protection services. The wait there is quite short, and people will take care of your call.
If in doubt, call the agency. We are there, and we will be able to see if someone from CRA is really trying to reach you.