The IRS Criminal Investigation division is warning cryptocurrency holders of a phishing scam involving counterfeit letters. The letters direct recipients via a QR code to a fake "Digital Asset Compliance Portal" designed to steal personal data and crypto. The IRS confirms it does not operate such a portal, use QR codes, or ask for wallet registration, and advises verifying all notices on irs.gov. The scam's plausibility is heightened by an increase in legitimate IRS crypto correspondence since 2019.
Phishing scam mechanics
- ▪The counterfeit letters include a notice number and a tax year range spanning from 2017 to 2026
- ▪The letters contain QR codes that direct recipients to a fake website designed to look like irs.gov.
- ▪The IRS Criminal Investigation (IRS-CI) division issued a fraud alert on July 30, 2026, about a phishing scam targeting crypto holders
- ▪The fake letters, arriving in plain envelopes, imitate official notices from the Department of the Treasury
- ▪Scammers are mailing counterfeit letters to cryptocurrency holders in an attempt to steal their digital assets and personal data
Fake compliance portal operation
- ▪A scammer then calls the victim, posing as support, to steal passwords, recovery phrases, or convince them to transfer funds
- ▪The fake website is named the "Digital Asset Compliance Portal," which the IRS has confirmed it does not operate
- ▪The fake portal asks visitors for their crypto exchange or hardware wallet, estimated holdings, and a phone number for a "verification" call
IRS verification guidance
- ▪Taxpayers can confirm the authenticity of any real IRS notice through their online account at irs.gov.
- ▪IRS-CI Chief Jarod Koopman advised taxpayers to stop and verify the source before responding to unexpected requests for personal information
- ▪The IRS advises reporting suspected fraud to both the agency and the Federal Trade Commission (FTC)
- ▪The IRS stated it does not use QR codes in official correspondence and will never ask taxpayers to register their exchanges or wallets
Attacker infrastructure
- ▪The Romanian hosting network used by the scammers is already known for hosting FedEx and banking phishing pages
- ▪The fake portal's look-alike domains were registered through a Hong Kong registrar and are hosted in Romania
Legitimate IRS crypto correspondence
- ▪The volume of real IRS crypto correspondence has increased due to new 1099-DA broker reporting rules
- ▪The IRS began sending legitimate educational compliance letters to suspected crypto under-reporters in 2019
- ▪In 2019, the IRS mailed more than 10,000 notices to virtual currency owners
Story comments
Loading comments…