IRS QR Code Scam: How Fake QR Codes Impersonate Tax Notices

What it is

Got a text, email, or letter claiming to be from the IRS that wants you to scan a QR code? Be careful. The IRS's 2026 Dirty Dozen list calls out fraudsters sending emails, DMs, and texts designed to look like official IRS correspondence — each one carrying a QR code that leads to a counterfeit IRS.gov look-alike site. The fake site tries to harvest your personal and financial information, or talks you into "claiming" a refund that doesn't exist. More than 600 social media accounts impersonated the agency in fiscal year 2025, by the IRS's own count. This isn't a one-off. It's a pattern at scale.

How the scam actually works

The lure follows a familiar script: alarming language, a tight deadline, a QR code positioned as the fastest fix for whatever the message claims is wrong. That urgency is the tell across nearly every quishing attempt — an IRS-shaped version is no different, just the same mechanic wrapped in a scarier subject line.

Here's what makes it genuinely tricky, though: a QR code by itself isn't proof of anything. Some real IRS notices — the CP53E refund notice is one confirmed example — legitimately include a QR code linking to a page on IRS.gov. So the code itself tells you nothing either way. What matters is everything around it. The IRS will never ask for banking details by email, text, or phone. It won't demand payment via prepaid cards or wire transfer, and it won't threaten arrest without giving you a chance to respond. Real notices also arrive by mail, full stop — if a "notice" only exists as a text or DM, that's the giveaway.

Where you'll see it

One confirmed version of this scam targets cryptocurrency holders directly. The IRS has issued a fraud alert describing mailed letters that instruct recipients to scan a QR code and enroll in a "Digital Asset Compliance Portal" before a stated deadline. The code opens a phishing page built to collect wallet addresses, exchange login credentials, and other sensitive account data. The IRS has been blunt about this one: it doesn't operate a Digital Asset Compliance Portal, and if a letter tells you to enroll in one, don't respond. It's a scam, no exceptions.

It's not limited to paper mail either. The same approach shows up over email and text, including the kind of inbox-based quishing that slips past spam filters because the link is hidden inside an image rather than typed as text a filter can scan.

Tips, gotchas, and a quick check with QRDock

The single best habit here: never scan a QR code from a letter, email, text, or DM you weren't expecting, especially one pushing you to act right now. If a message claims to be from the IRS, verify it through a channel you already trust — log into your IRS Online Account, use Where's My Refund? on IRS.gov, or call 1-800-829-1040.

Before you act on wherever a QR code points, it helps to see the destination first. QRDock previews the URL a code leads to and flags links that look off before you open them — a best-effort check, not a guarantee, so pair it with the same skepticism you'd apply to any unexpected link. Look for a real irs.gov address rather than a domain with a swapped letter or an extra word bolted on, a pattern the FTC has documented across QR scams generally. For more, see our guide on checking a QR code before you scan it.

Frequently Asked Questions

Does the IRS really put QR codes on real notices?

Yes — some legitimate IRS notices do include a QR code that links to a page on IRS.gov, which is exactly why scammers imitate the format. A QR code alone doesn't confirm a notice is real or fake.

What does the fake "Digital Asset Compliance Portal" letter scam do?

It's a mailed letter impersonating the IRS that tells cryptocurrency holders they must scan a QR code to enroll in a compliance portal before a deadline. The IRS has confirmed it does not operate any such portal — the QR code leads to a phishing site built to harvest wallet and account credentials.

What should I do if I already scanned a suspicious IRS QR code?

Don't enter any information on the site it opened. Close the tab, run a malware scan on your device, and if you entered personal or financial data, contact your bank and monitor your accounts. Report it to phishing@irs.gov or IRS.gov/SubmitATip.

How can I check where an IRS QR code leads before scanning it?

Use a scanner that previews the destination URL first, and confirm it points to a real irs.gov address rather than a lookalike domain. If the notice pressures you to act immediately, verify through your IRS Online Account or by calling 1-800-829-1040 instead of using the QR code at all.

Conclusion

A QR code on something claiming to be from the IRS isn't automatically suspicious — real notices use them too. What matters is how the message arrived, what it's asking for, and whether it's pushing you to act before you've verified anything. QR codes are becoming a normal part of official mail. That verify-first habit is worth keeping, not skipping.