FAFSA QR Code Scam: What It Is and What to Do

The Department of Education does not send QR codes

This is the essential fact: the U.S. Department of Education, its Federal Student Aid office, and the official studentaid.gov portal do not send unsolicited QR codes asking students or parents to log in, complete a verification step, or provide banking details. Legitimate communications from Federal Student Aid direct you to studentaid.gov through a plain-text link — they do not send a QR code for you to scan.

Scammers target FAFSA applicants because the stakes are high and the timeline is stressful. Students awaiting financial aid awards are anxious about deadlines and conditioned to respond quickly to anything that looks like an official notice. That anxiety is exactly what scammers exploit. Peak attack season runs October through April, tracking closely with the FAFSA application cycle.

The three variants of the FAFSA QR code scam

Attackers impersonate FAFSA and the Department of Education through three main channels.

The "FAFSA error" phishing message is the most common variant. It arrives by text or email and reads something like: "Action required: your FAFSA application has an unresolved issue. Scan the QR code below to complete verification and avoid a processing delay." The QR code leads to a near-perfect clone of the studentaid.gov login page. Once a victim enters their FSA ID username, password, and Social Security number, the attacker has everything needed to take over the account, redirect any financial aid disbursement, and commit identity fraud.

The fake financial aid award notification arrives after awards season opens and tells recipients their package is ready. The message says something like: "Your financial aid award for the upcoming semester has been finalized. Scan the QR code to accept your award and confirm your bank account for direct deposit." The QR code leads to a fraudulent disbursement form that collects the victim's bank routing number and account number — enabling an ACH transfer out of the account rather than into it.

The physical scholarship matching flyer appears in high school guidance offices, community centers, college fairs, and public libraries. It promises to match students with scholarships they qualify for and includes a QR code to "start your free profile." The form on the other end collects a student's SSN, date of birth, expected family contribution, and sometimes parental financial information — none of which goes anywhere near a legitimate scholarship database.

What to do if you scanned it

Your response depends on what you did after scanning.

If you only scanned and did not enter any information: Your risk is low. Close the page and do not return to it.

If you entered your FSA ID credentials, Social Security number, or bank account details, act immediately:

1. Change your FSA ID password immediately at studentaid.gov on a device you trust. Enable two-factor authentication if it is not already active. If you use the same password on other accounts, change those too.
2. Contact your school's financial aid office. Alert them that your account may have been compromised. They can flag your account, verify that your banking details and enrollment status have not been changed, and help you file a correction with the Department of Education if needed.
3. File IRS Form 14039 (Identity Theft Affidavit) if you submitted your Social Security number. Download it at irs.gov/form14039. This flags your IRS account so a fraudulent return filed in your name is caught before processing.
4. Place a fraud alert with the credit bureaus. Contact Equifax, Experian, or TransUnion — one call notifies all three. This makes it harder for an attacker to open new credit accounts using your information.
5. Contact your bank immediately if you entered a routing number or account number. Ask your bank to monitor for unauthorized ACH transfers and request new account numbers if necessary. ACH fraud can process within 24 hours, so speed matters.
6. Report to the FTC at ReportFraud.ftc.gov. The FTC uses consumer reports to identify and investigate fraud networks.

For a broader recovery checklist after any suspicious scan, see what to do if you scanned a suspicious QR code.

How to protect yourself going forward

The core rule is simple: the Department of Education contacts students through studentaid.gov and official mail — never through an unsolicited QR code. Here is how to stay protected during the application season:

• Check QR codes with QRsafer before opening them. QRsafer analyzes the destination URL before your browser loads anything. A fake studentaid.gov login page will not pass a threat check.
• Access studentaid.gov directly. If you receive any message about a FAFSA issue, type studentaid.gov directly into your browser or open the Federal Student Aid app — do not follow a link or scan a QR code from the message.
• Verify scholarship resources through your school. Legitimate scholarship matching is available through your school's financial aid office and through verified free tools like Scholarships.com, Fastweb, and College Board's Big Future — none of which require your SSN via a QR code on a flyer.
• Enable FSA ID account alerts. Log into studentaid.gov and turn on email and text notifications for any account changes, including banking detail updates. This gives you an early warning if an attacker attempts to redirect your disbursement.

This scam shares its identity-theft risk profile with the IRS QR code scam — in both cases, scammers use a government impersonation to collect SSNs and financial data under time pressure. The defense is the same: never follow an unsolicited QR code to log in to a government or financial account.

Frequently asked questions