A fake tax letter QR code is the centre of a scam warning that French police issued this week: a letter dressed up as official tax-authority post, with a QR code that leads to a counterfeit website. The safe response for anyone who receives one is simple. Do not scan it, and go to the real tax website by typing the address yourself. This article walks through what was reported, why the format works so well, and what a dynamic QR platform can honestly do about it. The short version of the second part is that it cannot stop a criminal from printing their own code, but it can make life much harder for the organisations that send genuine ones to be impersonated.
Disclosure: we make D-QR, a dynamic QR code platform. This article is about a scam that no QR tool, ours included, can prevent. We say where our product helps and where it does not.
What was reported
According to The Connexion, which published the story on 6 November 2026, French police are warning about a letter that imitates the DGFiP, the French public finance directorate. The letter reportedly copies the look of an official notice, including the logo and layout, and carries a QR code. The example circulating was shared by the Police Nationale on its social media, according to the article.
The article reports that scanning the code leads to a fake site designed to look official. That site asks for the recipient's tax number and tax-account password. Because the letter appears aimed at people who hold cryptocurrency, it also reportedly asks for the wallet's recovery phrase, which is the secret that lets whoever holds it move the funds out.
The pretext is a claim that the authority is compiling a new list of every cryptocurrency wallet in France, and that people who do not comply will be fined. The Connexion states this is false and that no such plan has been announced. The article gives no victim numbers or loss figures, so we do not have any to report, and we will not guess at them.
Why the details matter
Three things make this a well-built scam. It arrives on paper, through the post, which many people still treat as more trustworthy than email. It threatens a penalty, which pushes people to act before they think. And the QR code hides the destination: on a printed page you cannot hover over a link to see where it goes. Reportedly, small typos in the letter are one giveaway, but a scammer who proofreads would remove that sign.
How to spot a fake tax letter QR code
The advice reported in the article is consistent with what security teams say about whether QR codes are safe in general. A few habits cover most cases:
- Do not use the code on the letter. Open your browser, type the official tax website address yourself, sign in, and check your secure messages there. A real request will also appear in your account.
- Read the full web address. The article notes that official French government sites end in .gouv.fr, and that scam sites may include that text without actually ending in it. What matters is the part just before the first single slash.
- Verify by phone using a number you found yourself. Never call a number printed on the letter.
- Never type a recovery phrase into a website. No genuine authority or wallet provider needs it. Anyone who has it can empty the wallet.
- If you already entered details, the reported advice is to move funds to a freshly created wallet straight away, change your tax-account password, and report it to the local police or gendarmerie.
If you are not sure how your phone shows a link before opening it, our guide on how to scan a QR code on iPhone and Android explains how to read the preview before you tap. For the underlying mechanics, our pillar guide, What Is a Dynamic QR Code?, explains why a printed code can point anywhere at all.
What a dynamic QR platform cannot fix
We want to be direct about this, because overselling is how security articles lose trust. A dynamic QR platform controls the codes that you create. It has no power over a code that someone else prints on their own forged letter. If a criminal generates a QR code with any free tool and posts it with a copy of an official logo, nothing in our system, or anyone else's, sees it or can switch it off. The same is true of a sticker placed over a real code: the genuine code underneath may be perfectly fine, and the fake one is outside your account entirely.
So the protection for the public is still education, careful reading of addresses, and the habit of going to a known website directly. Anyone who tells you software alone solves this is selling something.
What a dynamic QR code does give an honest sender
Where a platform does help is on the sender's side. If your organisation really does print QR codes on letters, invoices or notices, a dynamic QR code generator gives you several practical advantages. Here is what we can confirm in our own product.
A destination people can recognise
A code on a genuine letter should lead to an address the recipient already trusts. On Pro and higher plans, custom domains for QR codes let your codes use your own domain rather than a generic short-link domain. That does not stop forgeries, but it gives recipients and your own staff a clear, consistent rule to teach: our codes only ever open pages on this domain, and anything else is suspicious.
The ability to change or stop a code instantly
Because the code is dynamic, you can pause it or re-point it in seconds, and the change applies to every printed copy. If a mailing turns out to have gone wrong, or you need to redirect people to a warning page about an impersonation campaign, you do not reprint anything. Our guide on editing a QR code after printing explains how that works.
Evidence of what is happening
Each code keeps a scan log with country, city and device. Bot filtering separates automated link previews from people. Pro plans add scan alerts and webhooks. None of this will show you a scammer's code, but it will show unusual behaviour on your own codes, such as a burst of scans from a country you never mailed. Controls such as country restriction, a password and an expiry date can be set per code, and codes have no expiry unless you set one. You can export the logs as CSV on paid plans.
Safer defaults for the mailing itself
Beyond the technology, a few practices make your genuine letters easier to distinguish from fakes:
- Print the full destination address in plain text next to the code, so people can compare it with what their phone shows.
- Never ask for passwords, payment details or wallet phrases on a page reached from a code. Say so on the letter.
- Offer a second route, such as a short instruction to log in to your own website directly.
- Tell customers publicly which domain your codes use, and repeat it often.
The wider lesson
Paper QR scams are not new. We have covered the sticker variety before, for example a fake sticker on a car park meter in Oban and altered event posters. The French letter uses the same underlying trick with a different delivery method: it borrows the credibility of a trusted name and removes your ability to see the destination. The defence is the same in every case. Treat a QR code as a link, not as a credential, and check where it goes before you give anything away.
For organisations, the lesson is to make genuine codes boringly predictable. If recipients know exactly what a real code from you looks like, a fake one stands out. If you want to see what that takes in practice, you can make a QR code for free and look at how the destination, scan log and pause controls work before deciding whether you need the paid features.
The story is still developing, and the article we have relied on gives no loss figures. We will not add numbers we cannot source. If you have received a letter like this, report it to the police, keep the envelope, and do not scan the code.
Sources
The incident details come from The Connexion's report of 6 November 2026. Product statements reflect our own plan documentation at the time of writing.