H&R Block QR Code Scam: What It Is and What to Do

H&R Block does not send unsolicited QR codes

This is the essential rule: H&R Block does not send unsolicited QR codes in emails, texts, or mailers to prompt you to log in, verify your return, submit your SSN, or claim a refund. When H&R Block communicates with you, it directs you to hrblock.com or the H&R Block Tax Prep app through standard text links — not through a QR code for you to scan.

H&R Block is an especially attractive impersonation target because it straddles two worlds: a national software brand and a physical office network with thousands of locations. That combination lets scammers craft convincing digital phishing messages and equally convincing paper mailers. Both channels carry the same risk, and both peak during tax season — January through April — when filing deadlines create urgency that makes people scan quickly without checking where a QR code leads.

The three variants of the H&R Block QR code scam

Attackers impersonate H&R Block through three distinct channels.

The "your return is ready — scan to file" email or text is the most common variant. It arrives during peak filing season and tells you that your H&R Block tax return is ready for final review, that a refund is waiting, or that a document needs your signature before the IRS deadline. The QR code leads to a cloned H&R Block or IRS login page that harvests your username, password, Social Security number, and sometimes bank routing details framed as refund-deposit confirmation.

The fake early-filer discount or returning-client mailer exploits H&R Block's physical presence. Scammers print professional-looking flyers or postcards mimicking H&R Block's branding and mail them to residential addresses, or post them on community bulletin boards near real H&R Block offices. The mailer promises a returning-client discount, a free state return, or a bonus for filing early — with a QR code to "activate the offer." The linked page collects personal and financial information under the guise of verifying your client record, sometimes adding a fake "preparation fee" to steal payment card details.

The fake MyBlock portal refund-status notification targets existing H&R Block customers specifically. MyBlock is H&R Block's client portal for tracking returns and accessing prior-year documents — a legitimate tool that scammers imitate with pixel-perfect login pages. The message claims your refund status has been updated or that a document in MyBlock requires your action. The QR code leads to a cloned MyBlock login page that steals your H&R Block credentials, giving attackers access to real tax documents and financial data stored in the actual portal.

What to do if you scanned it

Your response depends on how far you went after scanning.

If you only scanned and did not enter any information: Your risk is low. Close the page and do not return to it.

If you entered your H&R Block credentials, Social Security number, or financial details, act immediately:

1. Change your H&R Block MyBlock password now at hrblock.com and enable two-factor authentication. If you reuse that password on other accounts, change it everywhere.
2. File IRS Form 14039 (Identity Theft Affidavit) if you submitted your Social Security number. Download the form at irs.gov/form14039. This flags your IRS account so a fraudulent return filed in your name is caught before processing.
3. Place a fraud alert with the credit bureaus. Contact Equifax, Experian, or TransUnion — alerting one notifies all three. This makes it harder for an attacker to open credit accounts in your name.
4. Contact your bank or card issuer if you entered routing numbers, account numbers, or payment card details. Ask for a fraud hold and dispute any unauthorized transactions.
5. Report the phishing attempt to H&R Block by forwarding the message to their fraud team and reporting it through the H&R Block website.
6. Report to the FTC at reportfraud.ftc.gov. FTC reports help identify fraud networks and initiate enforcement actions.

For a broader recovery checklist after any suspicious scan, see what to do if you scanned a suspicious QR code.

How to protect yourself going forward

The simplest rule: any unsolicited message or mailer that contains a QR code and claims to be from H&R Block is a scam. Here is how to stay protected during tax season and beyond:

• Check QR codes with QRsafer before opening them. QRsafer analyzes the destination URL against threat intelligence databases and shows you a Safe, Risky, or Dangerous verdict before your browser loads anything. A cloned MyBlock or IRS login page will not pass a threat check.
• Access H&R Block directly. If you receive any message about your return, refund, or account, type hrblock.com directly into your browser or open the H&R Block Tax Prep app — never follow a QR code or link from an unsolicited message.
• Verify physical mailers by calling H&R Block. If a mailer arrives with a discount offer and a QR code, call the published H&R Block customer service number to confirm whether the offer is legitimate before scanning.

This scam operates on the same mechanics as the TurboTax QR code scam — scammers exploit tax-season urgency and brand familiarity to push people past normal caution. The defense is identical: never follow an unsolicited QR code to log in to a tax account or submit personal information.

Frequently asked questions