Key Takeaways
- • Fraudulent scheme targets cryptocurrency holders via fake IRS letters containing QR codes that direct victims to a bogus "Digital Asset Compliance Portal" mimicking IRS.gov to harvest personal information and digital asset credentials.
- • IRS Criminal Investigation confirms the scam is operational: Fake letters claim mandatory enrollment before a deadline and instruct recipients to scan QR codes linking to phishing portals designed to steal identities, wallet information, and exchange account credentials.
- • Infrastructure traced to Hong Kong and Romania: Coinbase and cybersecurity firm DarkTower identified the domain registered through a Hong Kong registrar days before letters were mailed, with hosting infrastructure in Romania on networks known for hosting phishing pages targeting financial institutions.
- • IRS explicitly denies operating any Digital Asset Compliance Portal: The agency states it "did not send it" and instructs recipients not to respond; IRS-CI Chief Jarod Koopman warns that "criminals continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence."
- • Heightened risk for cryptocurrency holders and tax professionals: The targeting of digital asset holders represents a direct threat to wallet security and personal data; CPA firms and advisors require clear client workflows to prevent credential exposure.
Summary
Fraudsters are conducting a coordinated phishing campaign targeting cryptocurrency holders through fake IRS letters that direct victims to a fraudulent website impersonating IRS.gov. The letters instruct recipients to enroll in a nonexistent "Digital Asset Compliance Portal" before a purported deadline, creating artificial urgency to compromise security protocols. The scheme employs QR codes embedded in the physical letters, which, when scanned, direct users to malicious websites designed to harvest sensitive information including personal data, cryptocurrency wallet details, and exchange account credentials. The IRS Criminal Investigation unit issued a formal fraud alert warning that the agency does not operate such a portal and did not send these letters.
According to the IRS and cybersecurity investigations, the operational infrastructure behind the scheme was traced to a domain registered through a Hong Kong registrar just days before the fraudulent letters were mailed. The malicious website is hosted on infrastructure in Romania operating on networks historically used for phishing attacks against financial institutions. Coinbase and cybersecurity firm DarkTower conducted the infrastructure analysis and identified the attack pattern, providing critical attribution details to law enforcement.
IRS-CI Chief Jarod Koopman emphasized the sophistication of the fraud, stating: "Criminals continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence." The targeting of cryptocurrency holders is particularly significant given regulatory scrutiny around digital assets and increased IRS enforcement activity in the crypto sector, which lends credibility to the fake letters and increases victim susceptibility.
For institutional investors, wealth managers, family offices, and tax advisory professionals, this campaign represents a material operational risk. Clients holding cryptocurrency assets may receive these letters and inadvertently compromise wallet security or personal data if proper verification protocols are not in place. The scheme underscores the need for clear client communication workflows, verification procedures, and education around IRS communication methods before sensitive information is disclosed.
According to the IRS and cybersecurity investigations, the operational infrastructure behind the scheme was traced to a domain registered through a Hong Kong registrar just days before the fraudulent letters were mailed. The malicious website is hosted on infrastructure in Romania operating on networks historically used for phishing attacks against financial institutions. Coinbase and cybersecurity firm DarkTower conducted the infrastructure analysis and identified the attack pattern, providing critical attribution details to law enforcement.
IRS-CI Chief Jarod Koopman emphasized the sophistication of the fraud, stating: "Criminals continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence." The targeting of cryptocurrency holders is particularly significant given regulatory scrutiny around digital assets and increased IRS enforcement activity in the crypto sector, which lends credibility to the fake letters and increases victim susceptibility.
For institutional investors, wealth managers, family offices, and tax advisory professionals, this campaign represents a material operational risk. Clients holding cryptocurrency assets may receive these letters and inadvertently compromise wallet security or personal data if proper verification protocols are not in place. The scheme underscores the need for clear client communication workflows, verification procedures, and education around IRS communication methods before sensitive information is disclosed.
Go deeper than the headline
Research every firm in this story, track the ones that matter and get the daily briefing — free for 7 days.