TurboTax QR Code Scam: What It Is and What to Do

TurboTax does not send QR codes

This is the critical point: Intuit and TurboTax do not send QR codes in messages asking you to log in, verify your identity, or claim a refund. When TurboTax communicates with you, it sends text links to turbotax.intuit.com or directs you to open the TurboTax app directly — it does not send a QR code for you to scan.

Scammers exploit this channel precisely because tax season (January through April) is a period of peak anxiety. Taxpayers are waiting on refunds, worried about audits, and conditioned to respond quickly to anything that looks like an official filing notice. An unsolicited QR code arriving during that window feels urgent in a way that bypasses normal skepticism.

The three variants of the TurboTax QR code scam

Attackers impersonate TurboTax through three main channels.

The "return issue" text or email is the most common variant. It typically reads: "Your TurboTax return has been flagged for review. Scan the QR code below to verify your identity and avoid a filing delay." The urgency — a threatened delay during tax season — pushes many people to scan without hesitation. The destination is a pixel-perfect clone of the TurboTax login page that harvests your username, password, Social Security number, and sometimes your bank routing details.

The fake refund-status notification tells you a refund is ready and a QR code will take you to a status page or direct-deposit form. This variant is effective because everyone waiting on a refund wants to know when it arrives. The QR code leads to a fake IRS or TurboTax page that collects financial account information under the guise of confirming where to send the refund.

The physical "Free File" flyer targets people who do not file online. Scammers place printed flyers in libraries, post offices, community centers, and laundromats during tax season. The flyer mimics IRS Free File or TurboTax Free Edition branding and includes a QR code to "start your free return." The linked page collects a full tax profile — SSN, date of birth, income, and bank account — framed as a filing form, with none of that data ever going to the IRS.

What to do if you scanned it

Your response depends on what you did after scanning.

If you only scanned and did not enter any information: Your risk is low. Close the page and do not return to it.

If you entered your TurboTax credentials, Social Security number, or financial details, act immediately:

1. Change your TurboTax password now at turbotax.intuit.com and enable two-factor authentication. If you use the same password elsewhere, change it on those accounts too.
2. Report to Intuit. Forward phishing emails to security@intuit.com. Intuit's security team actively monitors this address and can flag the campaign.
3. File IRS Form 14039 (Identity Theft Affidavit) if you submitted your Social Security number. Download the form at irs.gov/form14039. This flags your IRS account so a fraudulent return filed in your name is caught before processing.
4. Place a fraud alert with the credit bureaus. Contact Equifax, Experian, or TransUnion — one call alerts all three. This makes it harder for an attacker to open new credit accounts in your name.
5. Contact your bank or card issuer if you entered routing or account numbers. Ask for a fraud hold and dispute any unauthorized transactions.
6. Report to the FTC at reportfraud.ftc.gov. The FTC uses these reports to identify and pursue fraud networks.

For a broader recovery checklist after any suspicious scan, see what to do if you scanned a suspicious QR code.

How to protect yourself going forward

The simplest rule: any unsolicited message containing a QR code and claiming to be from TurboTax, the IRS, or a tax preparer is a scam. Here is how to stay protected more broadly during tax season:

• Check QR codes with QRsafer before opening them. QRsafer analyzes the destination URL against threat intelligence databases and shows you a Safe, Risky, or Dangerous verdict before your browser loads anything. A cloned TurboTax or IRS login page will not pass a threat check.
• Access TurboTax directly. If you receive any message about an issue with your return, type turbotax.intuit.com directly into your browser or open the TurboTax app — do not follow a link or scan a code from the message.
• Verify Free File programs through the IRS website. Legitimate IRS Free File partners are listed at irs.gov/freefile. Any QR code on a physical flyer pointing to a tax-filing site should be verified against that list before you enter any personal data.

This scam is closely related to the IRS QR code scam — scammers often combine TurboTax and IRS branding in the same attack. The defense is identical: never follow an unsolicited QR code to log in to a tax account.

Frequently asked questions