The US Internal Revenue Service (IRS) warned that scammers are mailing counterfeit letters to crypto holders, directing them to a fake “Digital Asset Compliance Portal” built to steal digital assets and personal data.
The agency’s Criminal Investigation unit issued the fraud alert on Thursday. It said the letters carry QR codes that send recipients to a spoofed website.
How the Fake IRS Letters Work
The counterfeit notices tell recipients they must enroll in the portal before a deadline. The IRS stressed that it does not operate any such portal and is not sending the letters.
Once victims scan the QR code, the fraudulent site asks them to enter personal information. The agency urged taxpayers not to scan QR codes from unsolicited letters, emails, or texts. It also told people to hang up on callers demanding payment.
The use of physical mail marks a shift from typical crypto phishing. Coinbase and threat intelligence firm DarkTower flagged the campaign this week.
Their investigation found the letters reference tax years 2017 through 2026. Moreover, the look-alike domain was registered through a Hong Kong registrar and hosted in Romania.
“That phone call is the actual attack… a scammer posing as ‘support’ will try to talk you into handing over the keys to your account…to trick you into moving your funds to a ‘safe’ wallet they control. This is called vishing (voice phishing), and it is one of the most effective account-takeover techniques used against crypto holders today,” Coinbase said.
Follow us on X to get the latest news as it happens
Crypto Scams and Hacks Keep Draining the Sector
The scheme fits a broader pattern of impersonation-driven fraud. Chainalysis estimated in its report that scams and fraud cost victims $17 billion in 2025. Impersonation scams surged 1,400%.
Hacks remain equally persistent. TRM Labs recorded 207 hacks in the first half of 2026, more than double the 83 logged a year earlier.
That marked the firm’s highest six-month count on record. However, total losses fell to roughly $972 million from about $2.3 billion in H1 2025.
Together, the figures suggest attackers are pivoting from code exploits toward human targets. The IRS letters show that pivot now extends beyond inboxes and into physical mailboxes.
Subscribe to our YouTube channel to watch leaders and journalists provide expert insights
Bitrue