Are Government QR Codes Safe to Scan?
It depends where the QR code came from. Here is the plain-language answer, the one real threat to watch for, and how to check any government QR code in seconds.
The short answer
QR codes on official .gov websites and in government buildings are safe. When you scan a QR code displayed on a page at irs.gov, ssa.gov, or your state's official DMV portal, the code was put there by the agency and points to a government-controlled destination. There is no meaningful risk from those codes.
The real danger is fake government QR codes — fraudulent letters, texts, and emails that impersonate agencies like the IRS, Social Security Administration, Medicare, or your state's DMV. Scammers replicate official-looking letterheads and branding, then include a QR code that leads to a phishing site rather than a real government portal.
In other words, the question is not “are government QR codes safe?” but “is this specific communication actually from the government?” The checklist below answers that in under a minute.
Safe vs. suspicious: what to look for
Generally safe
- QR code displayed directly on an official .gov website you navigated to yourself
- QR code on a sign, kiosk, or display inside a government building (courthouse, DMV office, passport agency)
- QR code on official physical mail that does not demand urgent action — and the URL resolves to a .gov domain
Treat with extreme caution
- QR code in an unsolicited text message claiming to be from the IRS, SSA, Medicare, or a state agency
- QR code in an email asking you to verify your identity, pay a balance, or claim a refund or benefit
- Mailed letter with urgent language (“Act within 48 hours or face penalties”) and a QR code
- URL that resembles a government domain but is not actually .gov (e.g., irs-payment.com, ssa-verify.net, dmv-renewal.org)
The one check that catches almost every fake
When you hold your camera over a QR code, your phone shows you the URL before opening it. Verify that URL ends in .gov — not .com, .net, .org, or any other extension, and not a .gov-lookalike domain with extra words or hyphens.
Legitimate U.S. federal agency URLs always end in .gov. State agencies use their state's official portal (for example, dmv.ca.gov or tax.ny.gov). If the URL your phone shows does not match that pattern, do not proceed.
A few examples of real vs. fake:
| Real URL | Fake lookalike |
|---|---|
| irs.gov | irs-payment.com, irs-gov.net |
| ssa.gov | ssa-verify.net, social-security-update.com |
| medicare.gov | medicare-card-renewal.com, cms-update.org |
| dmv.ca.gov | ca-dmv-renewal.com, california-dmv.net |
What real government agencies do — and do not — do with QR codes
Some agencies do include QR codes in official materials as a convenience. For example, the IRS has used QR codes in some printed publications to link to forms on irs.gov. Your state DMV may include a QR code on a renewal notice that links to the online renewal portal.
However, the IRS, SSA, Medicare, and most other federal and state agencies have publicly confirmed they do not:
- Initiate contact via text message with a QR code
- Send emails asking you to scan a QR code to verify your identity or make a payment
- Demand payment within hours or days via QR code under threat of arrest, license suspension, or benefit termination
- Ask for gift card, crypto, or wire payment via QR code
If a communication claims to be from a government agency and does any of those things, it is a scam — regardless of how convincing the letterhead looks.
What to do if you already scanned a suspicious government QR code
If you scanned a QR code from what turned out to be a fake government communication, your response depends on what you did next:
- You only scanned but did not enter anything: Close the browser tab. You are very likely fine — scanning alone does not transfer data. Run a malware scan on your device if you want peace of mind.
- You entered your Social Security number or other personal identifiers: Place a fraud alert with the three major credit bureaus (Equifax, Experian, TransUnion) and consider a credit freeze. Report to the FTC at identitytheft.gov.
- You made a payment: Contact your bank or card issuer immediately to dispute the charge and request a new card. Report to the FTC at reportfraud.ftc.gov.
- IRS impersonation: Report to the Treasury Inspector General at tigta.gov or call 1-800-366-4484.
- SSA impersonation: Report to the Social Security OIG at oig.ssa.gov.
Frequently asked questions
Are QR codes on government websites safe to scan?
Yes. QR codes displayed on pages you navigated to at an official .gov domain are safe — the code links to a government-controlled destination. The real threat is fake QR codes in unsolicited texts, emails, and mailers that impersonate government agencies. Before scanning anything claiming to be official, verify the URL resolves to a .gov domain, not a lookalike.
How can I tell if a government QR code is real or fake?
Check the URL your phone shows before tapping it open. Genuine government QR codes resolve to .gov domains (irs.gov, ssa.gov, medicare.gov, or a state .gov portal). Scammers use lookalike domains like irs-payment.com or ssa-verify.net — these are not government sites. Also consider the context: unsolicited messages demanding urgent action via QR code are almost always scams regardless of how official the branding appears.
Do real government agencies like the IRS or SSA use QR codes?
Occasionally, as a convenience — for example, a QR code on a printed publication linking to a form on irs.gov. But the IRS, SSA, and most other federal agencies have confirmed they do not initiate contact via text or email with QR codes demanding payment or identity verification. Any urgent, unsolicited message using a QR code for those purposes is a scam.
Know before you scan — every time
QRsafer checks the destination URL against threat intelligence databases before your browser opens it — giving you a Safe, Risky, or Dangerous verdict in real time. Whether the QR code claims to be from the IRS, the DMV, or your local courthouse, you will know in an instant if it is safe.