The IRS Criminal Investigation unit issued a fraud alert Thursday warning that scammers are mailing counterfeit letters to crypto holders. The letters contain a QR code that leads to a fake 'Digital Asset Compliance Portal' designed to steal personal information and digital assets. Coinbase and threat intelligence firm DarkTower flagged the campaign, which references tax years 2017 through 2026.
The fake portal and the vishing hook
The counterfeit letters direct recipients to scan a QR code and log into a website that mimics an official IRS portal. The IRS said it does not operate such a portal and is not sending these letters. The fake domain was registered through a Hong Kong registrar and hosted in Romania. After victims scan the code, scammers use vishing — voice phishing — posing as support to trick people into handing over account keys or moving funds to a 'safe' wallet.
Scam losses keep climbing
Chainalysis estimated that scams and fraud cost victims $17 billion in 2025. Impersonation scams alone surged 1,400% according to the firm. The IRS letters are part of a broader trend: attackers are pivoting from code exploits to targeting humans directly. TRM Labs recorded 207 hacks in the first half of 2026, more than double the 83 logged a year earlier, though total losses fell to roughly $972 million from about $2.3 billion in H1 2025.
Why the mailbox matters
The use of physical mail is a notable escalation. Most crypto scams live online — phishing emails, fake social media profiles, malicious apps. Sending a letter that looks official adds a layer of credibility that can bypass even cautious users. The IRS alert warns that the letters are designed to look authentic, complete with official-sounding language and references to real tax years. The agency urged anyone who receives such a letter to report it to the Treasury Inspector General for Tax Administration.
What to do if you get one
The IRS said recipients should not scan the QR code, visit the website, or call any number listed in the letter. Instead, forward the letter to [email protected] and file a complaint with the FBI's Internet Crime Complaint Center. The agency also reminded taxpayers that it never initiates contact via email, text, or social media — and never asks for cryptocurrency payments or account keys.
