Cryptocurrency holders are being targeted by a sophisticated scam involving counterfeit IRS letters. These fake notices instruct recipients to register on a bogus "Digital Asset Compliance Portal." The IRS does not operate such a portal and has confirmed these letters are fraudulent.
How the Scam Works and Its Risks
The counterfeit letters arrive in plain envelopes but mimic official government correspondence, complete with a Department of the Treasury header, notice numbers, and tax year ranges covering 2017 2026. Each letter includes a QR code linking to a fraudulent website designed to look like irs.gov. The IRS clarifies it never sends QR codes or requests crypto wallet or exchange registrations. The fake site prompts users to disclose details about their crypto holdings and provides a phone number for a supposed verification call. Scammers then try to extract sensitive information such as one-time codes, passwords, or recovery phrases. Victims may even be coaxed into transferring funds to attacker-controlled wallets.
Tracing the Origins and Growing Threat
Investigations revealed the fake domains were registered just days before the letters were sent, through a Hong Kong registrar, with hosting based in Romania. This network has links to prior phishing schemes targeting major services like FedEx and banks. The scam preys on the increasing familiarity among crypto users with genuine IRS crypto tax correspondence. Since 2019, the IRS has mailed over 10,000 educational compliance letters to virtual currency holders suspected of underreporting, with volumes rising as new 1099-DA reporting rules came into effect.
IRS Criminal Investigation Chief Jarod Koopman urges taxpayers to verify unexpected requests and report suspicious activity to both the IRS and the Federal Trade Commission. This alert shows the ongoing risks for crypto investors amid a backdrop of regulatory scrutiny and fraud attempts.
This material is for informational purposes only and does not constitute financial advice.
