IRS Warns Crypto Holders About Fake Letters with QR Code Scam
A new phishing operation is targeting cryptocurrency holders, sending fake letters from the IRS that direct recipients to a non-existent 'Digital Asset Compliance Portal'. The letters use official-looking IRS letterhead and design, include a fabricated enrollment deadline to create urgency, and rely on a QR code to push users past their instinct to manually type and verify a URL. Coinbase and its partner DarkTower traced the operation's infrastructure to a domain registered through a Hong Kong registrar, hosted in Romania on a network with a documented history of hosting financial phishing operations.
The letters use a QR code that redirects to a fake IRS.gov lookalike site, where users may be asked for their crypto wallet credentials, exchange account login information, and personal identifying data. The IRS does not initiate contact by asking users to enroll in a compliance portal via QR code, and instead uses specific notice numbers and instructs recipients to call or respond in writing.
The IRS warns that scanning the QR code is enough to steal your identity and drain your digital assets. To avoid falling victim to this scam, follow these rules: do not scan QR codes from unsolicited letters, never send crypto in response to an unexpected request, and never share your wallet recovery phrase or private keys.