Stimulus Check QR Code Scam: What It Is and What to Do
You received a text, email, postcard, or letter telling you that a stimulus payment or government relief check is waiting — and it includes a QR code to "verify your identity and claim your money." Stop before you scan: this is a scam. The U.S. government never distributes stimulus funds through QR codes.
You cannot "claim" a stimulus payment with a QR code
This is the single most important fact: the IRS and U.S. Treasury do not send QR codes to unlock stimulus payments, COVID relief funds, state rebates, or any other government disbursement. Stimulus payments are calculated automatically based on your filed tax return and deposited directly to the bank account on file or mailed as a paper check or debit card — no scanning required.
The IRS does not contact taxpayers by text message or email to request personal information. It communicates by U.S. mail only, and even those letters never include a QR code directing you to an external website. If any message — physical or digital — tells you to scan a QR code to receive government money, it was written by a scammer.
How the scam works
Stimulus-themed QR code scams surge whenever economic news makes government payments plausible — during COVID-era relief programs, state tax rebate announcements, child tax credit discussions, or IRS "tax relief" headlines. Scammers monitor the news cycle and launch campaigns within days.
The message arrives in one of three forms. A physical mailer uses official-looking government seals, formal language, and a case number to appear legitimate. It may mimic a real Treasury or IRS notice style and include a QR code to "verify your identity and release your payment." A text message claims an unclaimed balance is expiring and includes a short QR code to act before the deadline. An email impersonates the IRS, the U.S. Treasury, or a state tax authority with a QR code embedded in an official-looking HTML template.
All three lead to the same outcome: a fake government website that collects your Social Security number, bank account routing number, and date of birth. That combination is enough to commit identity theft, file a fraudulent tax return in your name, and drain your bank account. This is also why entering your SSN after a QR scan is one of the most serious outcomes of a phishing attack.
What to do if you scanned it
Your response depends on what happened after the scan.
If you scanned but did not enter any information: Your risk is low. Close the page, do not return to it, and report the scam to the IRS at phishing@irs.gov or forward the text to 7726 (SPAM).
If you entered your Social Security number, bank details, or other personal information, act immediately:
- Call the IRS Identity Protection Specialized Unit at 1-800-908-4490. They can flag your tax account to prevent fraudulent returns from being filed in your name.
- Go to IdentityTheft.gov. This FTC site generates a personalized identity theft recovery plan and walks you through every step — disputing fraudulent accounts, notifying creditors, and more.
- Freeze your credit at all three bureaus. Contact Equifax, Experian, and TransUnion individually to place a freeze. This prevents new accounts from being opened in your name.
- Call your bank immediately if you provided routing or account numbers. Ask them to flag your account for fraud and dispute any unauthorized transactions that appear.
- File IRS Form 14039 (Identity Theft Affidavit) if you provided your SSN. This formally notifies the IRS that your number may be compromised. Download it at irs.gov/form14039.
How to tell a real government letter from a fake one
A real IRS letter always has a notice number (printed in the top right corner, like CP11 or LT11), instructs you to call a number that routes to irs.gov, and does not include a QR code pointing to an external site. If you are unsure whether a letter is real, call the IRS at 1-800-829-1040 and provide the notice number — an agent can confirm whether it is genuine. Never call a number printed in a suspicious letter.
To check whether you are owed any unclaimed tax refund or credit, go directly to irs.gov/refunds or irs.gov/account by typing those addresses into your browser — never by following a QR code or link from an unsolicited message.
This same pattern — official-looking message plus QR code — is the signature of an IRS QR code scam and a Social Security QR code scam. The defense is identical in all three cases: do not scan government QR codes sent to you unsolicited, and verify any government notice directly at the agency's official website.
Frequently asked questions
Does the government send QR codes to claim stimulus payments?
No. Stimulus payments are issued automatically based on your tax return — you never need to scan a QR code to claim one. Any QR code claiming to unlock a government payment is a scam designed to steal your personal information.
What does a stimulus check QR code scam look like?
It arrives as a physical mailer, text, or email bearing government seals and urgent language about unclaimed relief funds. The QR code leads to a fake IRS or Treasury site that asks for your SSN, bank routing number, and date of birth — enough to commit identity theft and bank fraud.
What should I do if I entered my information on a fake stimulus site?
Call the IRS Identity Protection Specialized Unit at 1-800-908-4490, go to IdentityTheft.gov for a personalized recovery plan, freeze your credit at all three bureaus, and call your bank immediately if you provided account numbers.
How can I tell if a government letter or text is real?
A real IRS letter has a printed notice number, refers you to irs.gov, and never includes a QR code pointing to an external site. To verify any government notice, call the IRS at 1-800-829-1040 using the number from irs.gov — not from the letter.
Check any QR code before it opens
QRsafer scans a QR code and shows you whether the destination is safe before your browser loads it. Free on iOS and Android.