IRS Imposter Scams And QR Code Fraud: What You Must Know

Imposter scams have long been among the most lucrative for scammers. While there are many variations of this scam, the most common variations have involved scammers emailing or calling their victims posing as a popular company with which we all do business or as some governmental agency such as the IRS or the Social Security Administration. The scammer then, under a wide variety of pretenses, demands an immediate payment by gift cards, credit card or wired funds. In other instances, they will ask for personal information that will lead to identity theft. Being asked to pay by gift cards is a definite indication that the communication is a scam since no company or governmental agency requests or accepts payments by gift cards.

According to the FBI’s 2025 Internet Crime Complaint Center report, the number of complaints about government imposter scams almost doubled between 2024 and 2025 with losses as a result of these scams increasing from $405 million in 2024 to $797 million in 2025 and these figures are undoubtedly lower than the actual losses due to many people out of embarrassment or otherwise not reporting being scammed.

One reason that we are all susceptible to being scammed is that often scammers appeal to the amygdala, a part of the brain often called the reptilian brain. This part of the brain regulates many functions including instinctual behaviors related to survival and while humans have evolved more advanced brain regions such as the neocortex which is where sophisticated thinking and complex cognitive functions are performed, the reptilian brain still plays a critical role in behavior and decision making, particularly as it relates to emotional responses and scammers are particularly adept at appealing to emotional responses to manipulate their victims. Scammers encourage and exploit our tendency to act impulsively when confronted by perceived emergencies without taking the time to rationally consider what is going on.

Scammers create a sense of urgency targeting the reptilian brain such as when they pose as an IRS representative presenting a serious matter requiring our immediate attention. In addition, many people will trust communications that appear to come from a government agency such as the IRS.

For years scammers have posed as the IRS in emails, text messages and phone calls luring people to make payments or provide personal information that leads to identity theft. Often these emails and text messages would contain links or QR codes that when clicked on or scanned may download malware. These phishing and smishing (phishing done by text message) communications appear quite legitimate thanks to AI which makes it very simple to create convincing messages that contain the familiar IRS logo. Fortunately, there is an easy way to know immediately if that call, email or text message you receive is actually coming from the IRS. It isn’t. The IRS does not initiate contact with taxpayers by text messages, emails or phone call and does not ask you to submit bank account information via email, text message or by phone.

Recently, however, the IRS sent out over 1.4 million CP53E notices by snail mail to taxpayers advising them to update their bank account information with the IRS within 30 days for direct deposit of refunds. This notice is being sent out pursuant to an Executive Order regarding transitioning from paper checks to electronic payments and deposits. These new notices contain a QR code that takes you to the IRS website. The IRS has not used QR codes in the past and the use of a QR code in this notice is immediately suspicious. Complicating the situation even further is the fact that many people who are not owed refunds have received this letter by error which makes the letter appear even more suspicious.

Scammers are leaping at the opportunity provided by these notices and are sending phony letters that appear to come from the IRS with QR codes that when scanned will take you to an AI created, legitimate appearing, phony IRS website where you will be prompted to provide your banking information to the scammer, which, if done will lead to identity theft.