Why official-looking notices work
Notices about "unclaimed refunds", overdue fines, or benefits that must be claimed borrow real agency names, seals, and formatting. The consequences of entering data are severe — identity theft, tax fraud, benefit theft — and urgency is used to pressure people into acting before they think.
A letter arrives announcing an "unclaimed refund" and tells you to scan a code within 24 hours. The page requests a Social Security number and bank details. The letter was never sent by the agency. This is a composite example to show how the scam works, not a report of a specific incident.
Red flags
- A code from an unsolicited letter, text, or email.
- Requests for a Social Security number or full bank details.
- A page that doesn't match the agency's official website.
- Pressure tactics such as "respond within 24 hours".
The safe approach
Go directly to the agency's official website by typing its address yourself, or call a number from a bill or your own records — never from the notice. Real agencies generally don't demand immediate payment or sensitive details through a code on an unexpected letter.
If you already scanned and entered something
Act quickly, but calmly:
- Close the page and do not re-enter anything.
- Change any password you typed, from a device you trust, and turn on two-factor authentication where you can.
- If a card or bank detail was involved, call your bank or card issuer and ask about disputing charges.
- Contact the agency using its official number, and report the notice at reportfraud.ftc.gov.
- Report the destination link to Google Safe Browsing and, if money or identity was involved, to the FTC at reportfraud.ftc.gov.
For a fuller walkthrough, see I scanned a malicious QR code — what now?
Related guides: how to spot a fake sticker, what quishing is, and how to check a QR code.
Check it before you act
CheckThisQR decodes the code in your browser and shows the real destination and a safety verdict before you visit it. No account needed.
Check a QR code now →