Crypto Holders Beware: Fake IRS Letters Are Making the Rounds
The IRS is warning taxpayers about a fraud scheme specifically targeting cryptocurrency holders. In this scam, criminals are mailing official-looking letters that appear to come from the IRS and claim that recipients must register with a so-called “Digital Asset Compliance Portal.”
There is just one problem: the IRS does not operate a Digital Asset Compliance Portal. Any letter directing taxpayers to enroll in one is fraudulent.
How the Scam Works
According to IRS Criminal Investigation, the fraudulent letters are designed to look legitimate and may include an urgent deadline requiring the recipient to take action. The letter instructs the taxpayer to scan a QR code, which directs them to a fraudulent website created to resemble IRS.gov.
Once on the fake website, victims may be asked to provide personal or financial information, including:
- Cryptocurrency wallet information
- Cryptocurrency exchange account credentials
- Other personal identifying information
- Financial account information
Criminals can then use this information to steal a taxpayer’s identity, gain access to cryptocurrency accounts, or steal digital assets.
The scheme is particularly concerning because scammers are increasingly using professional-looking websites, government-style correspondence, QR codes, and artificial deadlines to make fraudulent requests appear legitimate. IRS Criminal Investigation cautions taxpayers to slow down before responding to unexpected requests for sensitive information and to independently verify the source.
Red Flags to Watch For
An unexpected communication should raise concern when it pressures you to act quickly, directs you to a website through a QR code, or asks you to provide sensitive personal or financial information.
The IRS recommends that taxpayers:
- Do not scan QR codes contained in unsolicited letters, emails, or text messages, particularly those claiming to be from a government agency.
- Verify the request independently. Contact the agency using information obtained directly from its official website rather than relying on contact information contained in the communication.
- Be skeptical of urgent deadlines. Scammers often create a false sense of urgency to prevent victims from taking time to verify a request.
- Never share cryptocurrency wallet recovery phrases or private keys.
- Enable multifactor authentication on financial and cryptocurrency accounts whenever available.
- Monitor financial accounts regularly and investigate suspicious activity promptly.
What If You Already Responded?
If you believe you may have provided information to a fraudster, acting quickly can help limit potential damage.
The IRS recommends that victims stop communicating with the fraudster, change passwords for affected financial accounts, and immediately contact their financial institution or cryptocurrency exchange if account credentials were shared. Taxpayers should also preserve evidence such as letters, emails, screenshots, and other correspondence and report the incident to IRS Criminal Investigation at IRS.gov/SubmitATip.
The IRS noted that investigators and private-sector partners traced infrastructure associated with this particular campaign to a recently registered internet domain hosted on a network previously associated with phishing activity. The finding illustrates how sophisticated these schemes can be and why taxpayers should not rely solely on how professional a letter or website appears.
When in Doubt, Verify Before You Respond
Fraudulent IRS communications continue to become more convincing, and even an official-looking letter should be verified before sensitive information is provided.
Remember: the IRS does not have a “Digital Asset Compliance Portal.”
If you receive an IRS notice, letter, or other tax-related correspondence and are unsure whether it is legitimate, please contact DBMCPA before responding or providing any personal or financial information.
