Fake HMRC QR-Code Tax Payment Scam (Quishing)
Fraudsters send physical letters or printed cards bearing HMRC branding and a QR code, claiming the recipient owes tax and must scan the code to avoid a penalty. HMRC never directs taxpayers to pay through QR codes on unsolicited physical correspondence.
Part of: Quishing: Physical Payment Point QR Code Scams
Last reviewed: 8 June 2026
HMRC sends millions of letters each year about tax codes, self-assessment deadlines, and payment reminders. Scammers produce convincing physical replicas of HMRC letters that include a QR code prominently displayed above the instruction Scan to pay your outstanding balance or face a penalty charge.
The QR leads to a lookalike gov.uk payment page that captures Government Gateway credentials or direct bank-transfer details. Because the attack arrives as a physical letter rather than a digital message, many potential victims are less alert to fraud cues — they associate physical post with legitimacy.
HMRC's genuine payment process directs taxpayers to gov.uk/pay-self-assessment-tax-bill or gov.uk/pay-your-tax, accessed by typing those URLs into a browser. HMRC does not include QR codes in letters that lead to payment forms, and it does not threaten immediate penalties for non-payment within 24 or 48 hours without prior written notice.
How this scam works on the HMRC brand
A printed letter arrives styled to match HMRC correspondence — correct typeface, HMRC crest, and a plausible reference number. It states that the recipient owes a specific amount in unpaid self-assessment tax or a penalty, and that payment via the QR code will avoid further charges. The urgency framing states the matter must be resolved within 48 hours.
Scanning the QR opens a Government Gateway-lookalike portal that asks for login credentials, NI number, and bank details to process the payment. Some variants skip the login and go directly to a bank-transfer instruction with a fake HMRC sort code and account number.
Because the letters are posted in bulk to residential addresses, the attacker does not know whether the recipient actually owes tax. A percentage will assume the letter is genuine because they expect HMRC correspondence.
Common red flags
- Physical HMRC letter with a QR code that leads to a payment page
- The QR destination is not gov.uk
- Letter demands payment within 24 or 48 hours without a prior formal assessment or discussion
- No personal tax reference number you can verify against your own HMRC records
- Payment page asks for bank account details rather than directing you to pay through gov.uk
- The letter lacks a standard HMRC response address or the address given is a PO box you cannot verify at gov.uk
- Government Gateway login page URL does not begin with https://www.gov.uk/
How to protect yourself
- Do not scan QR codes on letters claiming to be from HMRC — type gov.uk/pay-self-assessment-tax-bill directly
- Log in to your HMRC account at gov.uk/log-in-register-hmrc-online-services to verify any claimed balance
- Call HMRC on 0300 200 3310 using the number from gov.uk/contact-hmrc to confirm any alleged debt
- HMRC always provides a statutory appeal period before taking enforcement action — immediate 48-hour demands are not how HMRC operates
- Report the letter to HMRC before discarding it
- If you scanned and paid, contact your bank immediately to dispute the transaction
How to report it
- Forward a description or photo of the letter to [email protected]
- Report to Action Fraud at actionfraud.police.uk or 0300 123 2040
- Report to the NCSC at report.ncsc.gov.uk
- If bank details were provided, contact your bank immediately
- Report to the Royal Mail if the letter appears to have been sent through the postal system under false pretences
Frequently asked questions
Does HMRC ever include QR codes in tax payment letters?
HMRC may include QR codes in some official communications that link to information pages, but it does not include QR codes in letters that lead directly to payment forms. All HMRC payment methods are accessed by navigating to gov.uk directly.
How do I verify whether I actually owe the amount stated in the letter?
Log in to your Personal Tax Account at gov.uk/personal-tax-account or call HMRC on 0300 200 3300 to check your current balance. Do not use any phone number or link provided in the suspicious letter.
Can HMRC really issue a penalty within 48 hours of a letter?
No. HMRC follows a structured process with statutory appeal rights before imposing penalties or taking enforcement action. A letter threatening immediate penalty or legal action within 48 hours is not consistent with HMRC's legal procedures.