You may receive an official-looking text about tax refunds, account issues or urgent deadlines, with a QR code or short link for quick verification. Such messages may falsely use the IRS name to create pressure.
The IRS states it never sends unsolicited texts, emails or social messages asking for financial data, nor sends unexpected QR codes linking to login or payment sites. Treat such messages as scams.
This article distinguishes genuine IRS communications from phishing, and tells you how to handle suspicious messages and safely check your tax status.
What the IRS Actually Does and Does Not Do
Initial contact almost always begins with a letter
The IRS reaches taxpayers first by mail sent to the address on file. Notices and letters are the primary method for starting a conversation about taxes, refunds, or account issues. If you have not received a paper notice, an unexpected electronic message claiming to be from the IRS already falls outside normal procedure and should be treated with caution.
Unsolicited texts requesting information are not used
The agency states that it does not send unexpected text messages or emails asking for personal or financial details. It does not request Social Security numbers, bank information, or login credentials through those channels. Any message that does so operates outside official practice and is almost certainly fraudulent.
QR codes in unsolicited messages are a clear warning
Scammers use QR codes, sometimes called quishing, to direct people to fake websites that look like official IRS pages. The code can hide the true destination until after it is scanned. Official guidance treats unsolicited QR codes that claim to be from the IRS as something to ignore rather than investigate by scanning.
How the Fake Messages Usually Arrive
Texts claiming a refund is ready or an account is locked
Common themes include a tax refund waiting to be claimed, a problem with a recent filing, or a suspended account that must be verified immediately. The language creates urgency and curiosity. The goal is to get the recipient to scan the QR code or click the link before thinking carefully about the source.
Messages that mix real-looking details with pressure
Some phishing texts include partial Social Security numbers, tax-year references, or other fragments that feel personal. These details can come from data breaches or public sources. Their presence does not prove legitimacy. The combination of a familiar detail and a demand for immediate action is the pattern worth noticing.
Links and codes that lead to look-alike sites
Once scanned or clicked, the destination often mimics the design of IRS.gov or an official portal. The page then asks for login credentials, bank information, or other sensitive data. In some cases the site installs malware or initiates further contact. The visual similarity is intentional and improves over time.
Immediate Steps When a Suspicious Message Arrives
Do not scan the QR code or click any link
The safest first action is to leave the code and the link untouched. Scanning or clicking can expose the device to malicious sites or confirm that the number is active. There is no legitimate reason to interact with an unsolicited IRS QR code or link that arrives by text.
Do not reply or provide any information
Responding, even to ask a clarifying question, can open a conversation the scammer controls. Do not supply a Social Security number, date of birth, bank details, or any other personal information. The IRS does not request those items through unsolicited electronic messages.
Forward the text details to the proper addresses
The IRS asks people who receive suspicious texts to send the sender’s number, the message content, the recipient’s number, and the date and time to [email protected] with the subject line “Text.” You can also forward the text to 7726 (SPAM) so the wireless carrier can help block similar messages.
Delete the original message after reporting
Once the information has been forwarded, delete the text from the device. Keeping it is unnecessary once the report is filed. The same principle applies to related emails: forward the full message with headers to [email protected] and then delete it.
How to Check Your Real Tax Situation Safely
Type the official address yourself
Open a browser and type irs.gov directly. Do not use search results that might be sponsored or manipulated, and do not use any link supplied in a suspicious message. From the official site you can access your IRS Online Account if you have one, or review general information about notices and refunds.
Review any paper notices you have already received
If the IRS has a legitimate issue to discuss, a letter will already be on the way or in your possession. Compare the details of any electronic claim against the paper correspondence. Real notices contain specific information that phishing messages rarely match accurately.
Use the official IRS app only after confirming authenticity
The IRS has an official mobile application. Download it only from the verified app stores and confirm the publisher. Do not install any app recommended by an unsolicited text or QR code. Once installed through the proper channel, the app can provide account information without relying on external links.
Contact the IRS through published channels if needed
If you believe there is a real problem with your account, use the phone numbers and contact methods published on irs.gov. Do not call a number supplied in a suspicious text or email. The official site lists the correct routes for different types of issues.
Reporting and Additional Protections
File a report with the Federal Trade Commission
In addition to the IRS phishing address, submit a report at ReportFraud.ftc.gov. The FTC uses these reports to track scam patterns and share information with law enforcement. Including the fact that a QR code or tax-related claim was involved helps the agencies see trends more clearly.
Consider a credit freeze if sensitive data may have been exposed
If you already scanned a code or entered information on a suspicious site, place a free credit freeze with Equifax, Experian, and TransUnion. A freeze makes it harder for anyone to open new accounts in your name. The process is free and can be completed online or by phone with each bureau.
Monitor tax transcripts and account activity
Through your IRS Online Account you can view transcripts and certain account details. Checking periodically helps you notice unexpected activity early. If something looks wrong, follow the identity-theft guidance on the IRS site rather than responding to unsolicited messages.
Share the basic rule with family members who handle taxes
Many households have one person who manages tax correspondence. Make sure that person and any others who might receive texts understand the simple rule: the IRS does not start contact by unexpected text or QR code. A short conversation reduces the chance that someone else will interact with a fake message.
Recognizing the Difference at a Glance
Feature | Real IRS Contact | Common Phishing Version |
|---|---|---|
First contact method | Paper letter or notice to address on file | Unsolicited text, email, or social message |
Request for personal data | Not through unexpected electronic channels | Asks for SSN, bank info, or login credentials |
QR codes or links | Not sent in unsolicited messages | Central to the message; pressure to scan or click |
Tone and urgency | Follows documented notice process | Threatens immediate consequences or offers quick refunds |
Verification path | Taxpayer types irs.gov or uses official app | Message supplies the link or code to follow |
This comparison covers the patterns that appear most often. When a message fails the real-contact column on multiple points, treat it as fraudulent and report it.
What to Do If You Already Interacted
Change passwords and enable stronger authentication
If you entered login credentials on a suspicious site, change the passwords for any accounts that used the same or similar credentials. Turn on multi-factor authentication where it is available. Assume the information may have been captured and act accordingly to limit further exposure.
Contact your bank or card issuer if financial details were shared
Provide the date and nature of the exposure. Ask the institution to monitor for unusual activity and to discuss any additional protections that apply. Early contact improves the chance of limiting damage from the incident.
Place fraud alerts or freezes as needed
A fraud alert notifies lenders to take extra steps before opening credit in your name. A full freeze is stronger and free. Both can be set through the credit bureaus. Choose the level that matches the information that may have been compromised.
File the necessary reports and keep records
Submit the details to [email protected], ReportFraud.ftc.gov, and, if identity theft is involved, the resources listed on the IRS identity-protection pages. Keep copies of what you sent and any confirmation numbers. Those records remain useful if questions arise later.
No comments yet — be the first to share a thought.