Key Takeaways
- Fake IRS letters direct crypto holders toward a fraudulent portal.
- QR codes lead victims to websites built to resemble IRS.gov.
- Criminals seek wallet details, exchange logins, and personal data.
Counterfeit Letters Exploit Growing Crypto Tax Anxiety
The Internal Revenue Service (IRS) issued a fraud alert about fake letters targeting cryptocurrency holders on July 30, reflecting increasingly sophisticated impersonation schemes aimed at investors. Recipients are instructed to register through a nonexistent “Digital Asset Compliance Portal” before an urgent deadline, creating pressure to act before verifying the demand.
Each fraudulent letter contains a QR code directing recipients toward a website designed to resemble IRS.gov and collect valuable account information. The counterfeit portal may request personal details, cryptocurrency wallet information, exchange credentials, recovery phrases, private keys, or other data capable of enabling theft.
IRS Criminal Investigation (IRS-CI) Chief Jarod Koopman warned:
“Criminals continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence. Before responding to unexpected requests for personal information, stop, verify the source, and report potential fraud schemes to law enforcement.”
Crypto exchange Coinbase (Nasdaq: COIN) and cybersecurity firm Darktower traced the operation’s infrastructure to a domain registered through a Hong Kong registrar shortly before the letters circulated. Investigators found the website hosted in Romania on a network previously associated with phishing pages impersonating financial institutions, according to the agency.
IRS Guidance Helps Taxpayers Identify Fraudulent Demands
The IRS alert on fake letters targeting cryptocurrency holders warns that unsolicited QR codes and urgent deadlines are common signs of fraud. Official IRS guidance on tax scams also identifies unexpected messages, threats, financial pressure, and requests for personal information as warning signs of impersonation. The agency advises recipients not to scan unsolicited QR codes, open suspicious links, or share account credentials before verifying the correspondence through official IRS channels.
Taxpayers receiving suspicious letters can check their secure IRS Online Account, review recognized notice formats, or contact customer service directly for authentication. IRS guidance for determining whether a notice is legitimate explains these verification methods. Fraudulent letters, emails, texts, websites, social media accounts, and telephone calls can also be reported through the agency’s channels for reporting fake tax-related communications.
Identifying Legitimate Tax Notices and Crypto Impersonation Schemes
Impersonation scams have also targeted exchange customers through spoofed calls, texts, emails, fabricated security alerts, and false claims that assets require immediate protection. A separate alleged Coinbase impersonation scheme affecting about 100 victims allegedly stole nearly $16 million after users transferred funds into attacker-controlled wallets.
Anyone who disclosed credentials should immediately change affected passwords, notify the relevant financial institution or cryptocurrency exchange, preserve messages and letters, and monitor accounts. The IRS also recommends multifactor authentication, while wallet holders should never disclose recovery phrases or private keys under any claimed compliance requirement.
Other government agencies have issued similar warnings as criminals increasingly combine impersonation tactics with cryptocurrency fraud. The FBI has warned that unsolicited QR codes can direct users to phishing websites or prompt them to download malicious software. The Federal Trade Commission has also cautioned that scammers posing as government officials often demand cryptocurrency payments through QR codes or crypto ATMs.
