VA Benefits QR Code Scam: What It Is and What to Do

The VA does not send QR codes to verify benefits or process payments

This is the most important thing to understand: the Department of Veterans Affairs does not initiate contact with veterans via QR codes — ever. It does not send QR codes in letters requesting benefit enrollment updates, in texts about payment verification, or in emails linking to your VA account. If you received any of those, it is a scam regardless of how official it looks.

The VA contacts veterans through official mail, the MyHealtheVet portal, VA.gov, or direct phone calls from VA representatives. When the VA sends a letter, it will include a direct phone number and a URL ending in va.gov — not a QR code. Any QR code in a message claiming to be from the VA was put there by an attacker.

The two main variants of the VA benefits QR code scam

Scammers targeting veterans run this fraud through two primary channels.

The impersonation letter or text variant is the most common. It arrives as a printed letter on fake VA letterhead — or as a text message — referencing real VA programs to establish credibility. Common lures include a "PACT Act enrollment confirmation," a "VA payment verification required," or a "VA benefit update." The letter or text includes a QR code to "verify your information" or "confirm your enrollment." The code leads to a phishing page that harvests your Social Security number, VA file number, date of birth, and banking details. This information is used to file fraudulent benefit claims or drain accounts linked to VA direct deposit.

The fake veterans' charity variant appears at community events, VFW and American Legion posts, and on social media around Veterans Day and Memorial Day. A flyer, table sign, or social post includes a QR code for what appears to be a donation to a veterans' charity or a benefit fund. The code routes donations directly to the scammer's account rather than to any legitimate organization. These scams exploit the goodwill of both veterans and civilians who want to support the veteran community — and they exploit quishing tactics because QR codes are harder to scrutinize than plain web links.

What to do if you scanned it

Your response depends on what you did after scanning.

If you only scanned and didn't enter anything: Your risk is low. Close the page, do not return to it, and report the scam to the VA OIG.

If you entered your Social Security number, VA file number, banking details, or other personal information, act immediately:

1. Report to the VA Office of Inspector General. Call the VA OIG hotline at 1-800-488-8244 (Monday–Friday, 8:30 a.m.–4 p.m. ET) or submit a report online at va.gov/oig. The OIG investigates benefits fraud and can flag your account to prevent fraudulent claims.
2. Contact the VA directly. Call 1-800-827-1000 or log in at VA.gov to review your benefit status and confirm no unauthorized changes were made to your direct-deposit information or contact details.
3. Place a fraud alert with the credit bureaus. Contact Equifax, Experian, or TransUnion — one call triggers an alert at all three. This makes it harder for an attacker to open new accounts in your name using your SSN.
4. Report to the FTC. File a report at reportfraud.ftc.gov. The FTC uses these reports to identify and prosecute fraud networks targeting veterans.
5. Contact your bank if you entered banking or payment information. Ask them to monitor for unauthorized transactions, update your direct-deposit details if necessary, and dispute any charges that appear.

For a full checklist of recovery steps after any suspicious scan, see what to do if you scanned a suspicious QR code.

How to protect yourself going forward

The simplest rule: if a message claims to be from the VA and contains a QR code, do not scan it. Verify through official channels first. Here is how to protect yourself more broadly:

• Check QR codes with QRsafer before opening them. QRsafer checks the destination URL against threat intelligence databases and shows you a Safe, Risky, or Dangerous verdict before your browser loads anything. A fake VA login page will not pass a threat check.
• Access your VA account directly. If you receive any message claiming there is an issue with your benefits or an enrollment update required, go to VA.gov yourself — do not follow any link or scan any code from the message.
• Verify charity QR codes before donating. If you want to donate to a veterans' organization, navigate to the charity's official website directly or look them up through the IRS Tax Exempt Organization Search at apps.irs.gov/app/eos/. Never donate via a QR code on a flyer or social media post without independently verifying the organization.

Veterans are frequent targets of government-impersonation scams. The same tactic used here — a message with a QR code impersonating a trusted federal agency — is also used by IRS QR code scammers and Social Security QR code scammers. The defense is always the same: never scan a QR code to log in to or verify a sensitive government account.

Frequently asked questions