Social Security QR Code Scam: What It Is and What to Do

The SSA does not send QR codes

This is the single most important thing to know: the Social Security Administration does not initiate contact with the public via QR codes — ever. It does not send QR codes in letters asking you to verify your identity, in robocalls warning of fraud on your account, or in text messages about suspended benefits. If you received any of those, it is a scam, regardless of how official it looks.

The SSA communicates through official U.S. mail, its website at ssa.gov, and its public helpline at 1-800-772-1213. When it does send a letter, that letter will direct you to ssa.gov or include a phone number — not a QR code. Any QR code in a message claiming to be from the SSA was placed there by an attacker.

The three variants of the Social Security QR code scam

Attackers run this scam through three channels, each designed to trigger fear and urgency.

The mailed-letter variant is the most convincing. It arrives as a printed letter on what looks like official SSA letterhead, often warning that your Social Security number has been "suspended due to suspicious activity" or that there is a legal matter requiring your immediate response. It includes a fake case number, a fake agent name and badge number, and a QR code to "verify your identity and restore your benefits." The code leads to a phishing page that collects your SSN, date of birth, and sometimes bank account details.

The robocall-to-QR funnel starts with an automated phone call claiming your Social Security number was used in criminal activity or that your benefits are about to be suspended. The recording instructs you to "press 1 to speak with an agent" — a live scammer who then texts or emails you a QR code to "secure your account." The urgency and the human voice on the line make this variant especially effective. This is also why quishing attacks pair so well with phone scams: the QR code bypasses any link-filtering the victim might use.

The text variant claims your benefits have been placed on hold, that your SSN was linked to money laundering, or that you must verify your account to receive a cost-of-living adjustment. The message is brief and frightening, and the QR code takes you to a cloned SSA login page or identity-verification form requesting your Social Security number and personal details.

What to do if you scanned it

Your response depends on what you did after scanning.

If you only scanned and didn't enter anything: Your risk is low. Close the page, do not return to it, and report the scam to the SSA Office of the Inspector General.

If you entered your Social Security number, date of birth, or financial information, act immediately:

1. Report to the SSA OIG. File a report at oig.ssa.gov/report or call 1-800-269-0271. The SSA OIG is the agency that investigates Social Security fraud and impersonation scams.
2. Place a fraud alert and freeze your credit. Contact Equifax, Experian, or TransUnion — one call triggers a fraud alert at all three. Given that your SSN may be exposed, a credit freeze (free at all three bureaus) is the stronger protection: it blocks new accounts from being opened in your name entirely.
3. Report to the FTC. File a report at reportfraud.ftc.gov and, if your SSN was compromised, at identitytheft.gov. The FTC's identity theft recovery plan walks you through every step.
4. Check your Social Security account. Create or review your account at ssa.gov/myaccount to confirm no unauthorized changes have been made to your benefits or direct deposit information.
5. Contact your bank immediately if you entered any financial information. Ask them to monitor your accounts for unauthorized transactions and dispute any charges that appear.

How to avoid the scam next time

The core rule: any message that claims to be from the SSA and contains a QR code is not from the SSA. Here is how to protect yourself more broadly:

• Check QR codes with QRsafer before opening them. QRsafer checks the destination URL against threat intelligence databases and shows you a Safe, Risky, or Dangerous verdict before your browser loads anything. A cloned SSA login page will not pass a threat check.
• Go directly to ssa.gov. If you receive any message claiming there is a problem with your Social Security benefits, go to ssa.gov yourself and log in to your account — do not follow any link or scan any code from the message.
• Call the SSA to verify. The SSA's public helpline is 1-800-772-1213. If a letter or call is real, an SSA representative can confirm the notice. If it is fake, you just avoided the scam.

This same tactic — impersonating a trusted government agency with a QR code — is also used in IRS QR code scams and bank QR code scams. The defense is always the same: never scan a QR code from an unsolicited message and never enter sensitive information on a page you reached by scanning one.

Frequently asked questions