The IRS is warning cryptocurrency holders about fake letters directing them to a nonexistent “Digital Asset Compliance Portal.”
QR codes in the letters lead to a website that imitates IRS.gov and seeks wallet details, exchange credentials, and personal information.
Recipients should avoid responding, verify communications through IRS.gov, and report suspected fraud to IRS Criminal Investigation.
The IRS is alerting cryptocurrency holders to a mail-based phishing campaign designed to steal personal information and digital assets.
Fraudsters are sending official-looking letters claiming recipients must enroll in a “Digital Asset Compliance Portal” before a specified deadline. The letters contain QR codes that lead to a fraudulent website modeled after IRS.gov, according to an IRS Criminal Investigation fraud alert.
The IRS said it does not operate such a portal and did not send the letters.
Once on the fake website, victims may be asked to provide identifying information, cryptocurrency wallet details, exchange-account credentials, or other sensitive data. Criminals can use that information to steal identities, access accounts, or take control of digital assets.
“Criminals continue to exploit public trust in government agencies,” IRS-CI Chief Jarod Koopman said, urging taxpayers to verify unexpected requests before responding and report suspected fraud to law enforcement.
Social engineering tactics
The campaign uses several familiar social-engineering tactics, including government branding, urgent deadlines. and unsolicited QR codes. Although the IRS includes QR codes in some legitimate correspondence, taxpayers who receive an unexpected notice should independently visit IRS.gov or contact the agency using information published on its official website.
Coinbase and cybersecurity company DarkTower traced the scam’s infrastructure to a recently registered domain obtained through a Hong Kong registrar and hosted in Romania, TheJournal of Accountancy reported. The IRS has not disclosed how the perpetrators obtained cryptocurrency holders’ names and mailing addresses or how many people may have received the letters.
Anyone who shared information through the fraudulent site should stop communicating with the scammers, change passwords on affected accounts, and contact the relevant bank or cryptocurrency exchange immediately. The IRS also recommends enabling multifactor authentication and never disclosing private keys or wallet-recovery phrases.
Potential victims should preserve letters, screenshots, and emails as evidence and submit reports through the IRS-CI tip portal.