Use the recovery links on the CRA sign-in page first – you can retrieve a user ID or reset a password by answering security questions. If those answers are gone too, you are not stuck for good: the CRA now lets people who lost their credential register again with a new one and regain access to the same account.
Repeated wrong entries, wrong security answers or failed passcodes lock the account. The CRA locked account help page sets out the route, and in most cases you will need to phone them. Have your SIN and a recent return in front of you when you call.
Ask for it again, or send it to another enrolled number. Choose “Call me” instead of “Text me” if your number is a VoIP line. If you enrolled a passcode grid or authenticator app, use those. If none of that works, the CRA has to sort it out by phone.
Nine times out of ten it is an address the CRA has not been told about, or a return amount typed from the reassessment rather than the original filing. Check both. Newcomers without a Canadian filing history should follow the CRA separate path.