Scammers Are Mailing Fake IRS Letters to Crypto Holders: How to Spot the QR-Code Phishing Scheme

What exactly is the fake IRS crypto letter scam?

The fake IRS crypto letter scam involves physical mail sent to cryptocurrency holders that closely copies the appearance of an official IRS notice. The IRS issued a fraud alert about these fake letters on July 30, 2026, describing a scheme that instructs recipients to register through a nonexistent “Digital Asset Compliance Portal” before an urgent deadline, creating pressure to act before verifying the demand. The use of physical mail is a deliberate tactic: unlike email phishing, a printed letter in an official-looking envelope is far less likely to be caught by spam filters or dismissed as an obvious digital scam.

One confirmed letter arrived in an unmarked envelope, imitated a real notification from the IRS, and claimed to come from the Department of the Treasury, Internal Revenue Service, Austin, TX. The use of an official-looking notice number (CP14-432RA) and a reference to the tax year range 2017–2026 would have made it appear plausible to many recipients. The criminals could easily vary these details from letter to letter, so no single notice number or date range definitively identifies every copy of this scheme.

IRS-CI Chief Jarod Koopman characterized the operation as a “professionalized international scam operation” and said the criminals are systematically using the public’s trust in government agencies to carry out scams. The practical implication for anyone who holds cryptocurrency is straightforward: a letter from the IRS demanding portal enrollment before a deadline is not legitimate, regardless of how official it looks.

What does the QR code actually do?

The QR code in the letter leads to a look-alike domain of the form irs.digitalcomplianceportal.com, not the real IRS.gov. Scanning it opens a fraudulent website engineered to look like an official government page. This is a meaningful distinction, because the URL in the browser address bar will not say IRS.gov even though the page may visually copy its design.

The counterfeit portal may request personal details, cryptocurrency wallet information, exchange credentials, recovery phrases, private keys, or other data capable of enabling theft. Handing over a wallet recovery phrase or a private key gives an attacker permanent, irrevocable access to the funds in that wallet. Coinbase also warned that victims may later receive phone calls from individuals posing as customer support representatives who attempt to convince them to transfer funds into fraudulent “safe” wallets, a tactic known as voice phishing, or vishing. That secondary phone call is a continuation of the attack, not a separate coincidence.

For broader context on how voice phishing campaigns operate alongside digital credential theft, see TechJournal’s coverage of how vishing gangs impersonate IT helpdesks to extract sensitive information from victims.

Who is behind the campaign, and how did they target crypto holders?

Coinbase and cybersecurity firm DarkTower traced the campaign to a domain registered through a Hong Kong registrar and hosted in Romania, the IRS said. Investigators found the website hosted in Romania on a network previously associated with phishing pages impersonating financial institutions. The infrastructure pattern suggests an organized group with experience running impersonation campaigns rather than an opportunistic one-off scheme.

The IRS fraud alert does not identify how fraudsters obtained the names and addresses of cryptocurrency holders, and an IRS-CI representative declined to answer questions about the scope of the scam. One plausible explanation is that the criminals exploited publicly available blockchain data, past data breach records, or court documents from prior crypto enforcement actions to build a mailing list. The campaign appears to exploit the growing number of legitimate IRS communications related to cryptocurrency reporting as digital asset tax compliance becomes more common in the United States.

The IRS has been sending legitimate educational compliance letters since 2019 to individuals suspected of underreporting digital asset activity, and at that time more than 10,000 taxpayers had already received letters from the agency about their crypto transactions. Receiving IRS mail about cryptocurrency is therefore no longer unusual, which is exactly what the scammers are counting on.

How do the fake letters compare to real IRS notices?

Understanding the differences between genuine IRS correspondence and the counterfeit version is the most reliable way to protect yourself. The table below summarizes the key distinctions confirmed by IRS-CI and Coinbase’s investigation.

The IRS has been direct about this: it does not send QR codes in official correspondence directing taxpayers to enroll in any portal. That said, the IRS does use QR codes on some legitimate correspondence, including recent CP53E notices, but an IRS-CI representative confirmed that taxpayers should not scan QR codes included in letters from the IRS, and should instead go to IRS.gov or contact the agency using information found on that site.

What should you do if you receive one of these letters?

Do not scan the QR code and do not visit any website printed in the letter. The practical risk of scanning even once is that the site may attempt to load malicious content on your device before you enter any information. Never click any unsolicited communication claiming to be from the IRS, as it may install malware on a taxpayer’s personal device, potentially preventing access to their files or personal information.

Follow these steps if you receive the letter:

1. Set the letter aside without scanning the QR code or typing the printed URL into any browser.
2. Verify your actual IRS account status independently by visiting IRS.gov directly, typed into your browser, or by logging into your IRS Online Account at IRS.gov/account.
3. Report the letter by submitting a tip at IRS.gov/SubmitATip, which the IRS describes as its consolidated fraud-reporting tool that routes information to the appropriate IRS office.
4. Preserve the letter and envelope as evidence. Do not discard them before reporting.
5. Contact a tax professional or attorney if you are uncertain whether you have any genuine outstanding IRS obligation related to digital assets.

Slow down and verify the situation; scammers create false urgency to push victims into quick decisions. The August 10, 2026 deadline printed in confirmed copies of the letter has now passed, which means any letter still arriving with that date is demonstrably fraudulent.

What if you already scanned the QR code or entered information?

If you scanned the code or submitted any data through the fake portal, treat your credentials as compromised and act immediately. The risk is not theoretical: the site was designed specifically to harvest exchange login details, wallet recovery phrases, and private keys, any one of which gives an attacker full control over your digital assets.

Anyone who disclosed credentials should immediately change affected passwords, notify the relevant financial institution or cryptocurrency exchange, preserve messages and letters, and monitor accounts. Contact your exchange’s fraud or security team directly using the phone number or email address listed on its official website, not any number provided in the suspicious letter or a follow-up phone call.

Never share your password, two-factor authentication codes, one-time codes, or your recovery or seed phrase with anyone for any reason. Never move your crypto to a “new” or “safe” wallet because someone told you to by phone or message after you received the letter. That instruction is the theft itself, not a protective measure. If your private keys or recovery phrase were exposed, stop using those wallets and consult a cybersecurity professional about next steps, because the risk to those assets is permanent as long as the exposed credentials remain in use.

Readers concerned about the broader risk of credential theft targeting their digital accounts may find it useful to understand how modern malware can extract authentication credentials even without the user’s direct participation.

Why is the IRS a credible-sounding cover for this type of scam?

The IRS is an effective impersonation target for several reasons that have nothing to do with the agency’s own security practices. The IRS has been sending legitimate educational compliance letters since 2019 to individuals suspected of underreporting digital asset activity, and at that time more than 10,000 taxpayers had already received letters from the agency about their crypto transactions. That history means a letter about crypto holdings does not immediately seem implausible to someone who has followed news about IRS crypto enforcement.

Using physical mail to carry out crypto scams is a new attack method; by comparison, phishing and digital scams have long been common in the cryptocurrency industry. Physical mail bypasses every technical spam filter and email security gateway an organization or individual might have in place. A printed letter also carries an implicit authority that an email from an unfamiliar address does not. The urgency framing reinforces the psychological pressure: the counterfeit physical letters ask taxpayers to enroll in the fake Digital Asset Compliance Portal before a stated deadline and submit personal information.

The scam also benefits from a general increase in IRS scrutiny of digital asset reporting. The IRS has increased its scrutiny of digital asset reporting, making the compliance portal feel entirely plausible to someone who is not aware of the fake scheme. That context is precisely why clear public awareness of the specific fraud is important: the scam works because the surrounding environment makes it believable. The FTC has documented how crypto-related scam losses have grown sharply, providing additional context for why impersonation campaigns targeting digital asset holders have become so prevalent. Readers tracking the broader landscape of AI-assisted and technically sophisticated fraud schemes may also want to review recent developments in AI-enabled cyberattack risks to understand how these tools are increasingly available to criminal actors.

How does the IRS actually contact taxpayers about crypto obligations?

The IRS contacts taxpayers about tax obligations primarily through official postal mail, and that mail directs recipients to IRS.gov or to a toll-free number listed at IRS.gov for follow-up. The IRS emphasized that legitimate tax notices do not require taxpayers to use unofficial websites, scan QR codes, or provide cryptocurrency wallet credentials. If you receive a notice that demands any of those three things, the notice is not from the IRS.

An IRS-CI representative confirmed that taxpayers should not scan QR codes included in any letter claiming to be from the IRS; instead, they should go to IRS.gov or contact the agency using contact information found on that site. The IRS also maintains a dedicated online account portal at IRS.gov/account where taxpayers can check their actual filing status, balance due, and any pending notices. Confirming through that channel before responding to any unexpected letter is the most reliable way to determine whether the correspondence is genuine.

The IRS recommends multifactor authentication, and wallet holders should never disclose recovery phrases or private keys under any claimed compliance requirement. No legitimate government compliance program will ever ask for a wallet recovery phrase, a seed phrase, or a private key. Those items are internal security controls for the wallet holder, and no external entity needs them to verify a tax obligation. The Cybersecurity and Infrastructure Security Agency (CISA) maintains guidance on recognizing and reporting phishing schemes of exactly this type, including impersonation of government agencies. Separately, readers who want to understand how scam apps impersonate trusted platforms may want to review how to identify fake AI apps that use similar brand-impersonation tactics.

FAQ

Does the IRS actually send letters about cryptocurrency to taxpayers?

The IRS does send legitimate educational compliance letters to individuals suspected of underreporting digital asset activity, and since 2019 more than 10,000 taxpayers have received such letters from the agency about their crypto transactions. However, legitimate IRS letters direct recipients to IRS.gov for follow-up, not to third-party portals accessed by QR code.

Is there any safe reason to scan a QR code in a letter claiming to be from the IRS?

An IRS-CI representative stated that taxpayers should not scan QR codes included in letters from the IRS, and should instead go to IRS.gov directly or contact the agency using official contact information found on that site. The safest practice is to type IRS.gov into your browser manually rather than follow any link or QR code in a letter, regardless of how official the letter appears.

How do I report one of these fake IRS letters?

The IRS encourages taxpayers to report suspected tax fraud, scams, and identity theft by visiting IRS.gov/SubmitATip, an online tool that allows individuals to confidentially submit information using a smartphone, tablet, or computer and routes tips to the appropriate IRS office. You can also report physical scam letters to the Treasury Inspector General for Tax Administration at 1-800-366-4484.

What information could scammers steal through the fake portal?

The counterfeit portal may request personal details, cryptocurrency wallet information, exchange credentials, recovery phrases, private keys, or other data capable of enabling theft. Recovery phrases and private keys are the most dangerous items to expose because they grant permanent access to a wallet’s full contents without any further authentication.

Could there be follow-up phone calls after someone engages with the fake letter?

Coinbase warned that victims may later receive phone calls from individuals posing as customer support representatives who attempt to convince them to transfer funds into fraudulent “safe” wallets, a tactic known as voice phishing, or vishing. If someone calls claiming to be from the IRS, your exchange, or a “compliance portal,” hang up. Contact your exchange directly using the number on its official website to verify your account status.