Scammers are now sending fake IRS letters to crypto holders, and they went all out on this one. We’re talking official-looking paper notices, fake deadlines, and even a QR code leading to a spoofed IRS website. It’s a full production. The IRS has confirmed these letters are fraudulent and issued a public fraud alert through its Criminal Investigation unit.
The letters tell recipients they need to enroll in something called the “Digital Asset Compliance Portal.” Sounds official, right? It’s not. The IRS says that portal does not exist. Period. The whole thing is fabricated to look like a real government compliance requirement, complete with tax years listed — 2017 through 2026 — to make it feel legit.
The “Digital Asset Compliance Portal” doesn’t exist. The IRS confirmed it. The entire thing was invented.
Here’s how the trap works. The letter includes a QR code. Scan it, and it takes you to a fake website built to look exactly like IRS.gov. Once there, the site may ask for personal information, cryptocurrency wallet details, recovery phrases, private keys, or exchange login credentials. Some versions reportedly try to get victims to transfer crypto directly to the scammers. And yes, once that crypto is gone, it’s gone. No reversals. No refunds.
The scam was designed to exploit a specific anxiety — crypto tax compliance. People who hold digital assets already know the IRS has been cracking down. Scammers know that too. Throw in a deadline, a government letterhead, and a QR code, and suddenly people are panicking instead of thinking. That’s exactly what the fraudsters are counting on. Experts consistently warn that emotional discipline in investing is critical, as panic-driven reactions are precisely the vulnerability these schemes are engineered to exploit.
The technical details are telling. According to Bloomberg, the fake domain was registered through a Hong Kong registrar and hosted in Romania. So whoever pulled this together wasn’t exactly a small-time operation. This is coordinated, deliberate, and targeted.
If someone hands over their wallet recovery phrase or private key, criminals get full access to their crypto. Not partial access. All of it. Identity theft is also on the table if personal information is exposed. The risks are serious and in some cases irreversible. This broader surge in fraud is reflected in the numbers — Chainalysis reports that crypto scams cost victims $17 billion in 2025 alone.
Anyone who believes they have already been targeted should report suspicious activity to IRS-CI immediately at IRS.gov/submitatip, while also preserving any evidence such as the letter itself, screenshots, or emails. The IRS has been clear — do not respond to these letters, do not scan the QR codes, and do not call any number printed inside. Verify anything crypto-tax-related by going directly to the real IRS website and contacting the agency through official channels only. Slow down. Think. Because these scammers are betting that recipients won’t.
