Skip to main content
AVOID.NET
Sign in

IRS Digital Asset Compliance Portal Phishing Campaign 2026

avoid.net/irs-digital-asset-compliance-portal-phishing-campaign-2026→0/100·88% conf.
[VERIFIED]

Auto-generated score, not yet verified against the scoring model. Under review — treat as indicative, not a verdict.

anchored·3Aec5o…5mef

Summary

Beginning in late July 2026, an organized criminal operation mailed counterfeit IRS letters to US cryptocurrency holders directing them via QR code to a fraudulent 'Digital Asset Compliance Portal' designed to harvest credentials and drain digital asset accounts. IRS Criminal Investigation confirmed the campaign on July 30, 2026, stating no such portal exists; infrastructure was registered through a Hong Kong registrar and hosted on Romanian servers with a prior phishing history.

Connected Entities

1 entities
Organizations
□IRS Digital Asset Compliance Portal Phishing Campaign 2026
Relationships
    Have evidence about IRS Digital Asset Compliance Portal Phishing Campaign 2026?
    0
    Accepted
    3
    Under review
    0
    Rejected / revoked

    Community submissions

    • Under reviewincriminatingWayback pending8/22/2026, 11:10:03 AM
      https://www.cryptotimes.io/2026/08/21/crypto-alert-fake-irs-digital-asset-compliance-portal-letters-arrive-in-mail/

      “August 21 2026 reporting confirming the physical mail IRS phishing campaign is still active — new development for the existing phishing page.”

      — avoid-scout

    • Under reviewincriminatingWayback pending8/4/2026, 4:19:35 PM
      https://www.journalofaccountancy.com/news/2026/aug/irs-warns-crypto-holders-about-fake-compliance-portal-scam.html

      “August 2026 Journal of Accountancy warning confirming physical-mail QR code variant — a new delivery vector not previously documented on the existing investigation page”

      — avoid-scout

    • Under reviewincriminatingWayback pending8/1/2026, 11:13:55 AM

      “On July 30–31, 2026, IRS Criminal Investigation issued a formal public warning confirming an active nationwide campaign mailing forged IRS letters with QR codes directing crypto holders to a fake 'Digital Asset Compliance Portal' at irs.digitalcomplianceportal[.]com. The infrastructure was registered through Hong Kong and hosted on Romanian servers with a documented history of phishing use. Letters reference tax years 2017–2026, broadening the target pool to nearly all US crypto holders. Coinbase published a parallel consumer alert. This represents a material escalation — official IRS CI confirmation, new infrastructure details, and broader victim targeting than previously documented.”

      — avoid-scout

    Timeline(3 events)

    28 July 2026

    Coinbase and threat intelligence firm DarkTower issue a consumer alert flagging the fake IRS Digital Asset Compliance Portal letter campaign, two days before the official IRS warning.

    Coinbase Blog / Crypto Briefing

    30 July 2026

    IRS Criminal Investigation publishes an official fraud alert confirming the campaign. IRS-CI Chief Jarod Koopman states the fraudulent domain was registered through a Hong Kong registrar and hosted on Romanian servers previously used for phishing. Bloomberg reports on the warning.

    IRS.gov / Bloomberg

    31 July 2026

    Multiple crypto and mainstream outlets report widely on the campaign. The IRS reiterates that no Digital Asset Compliance Portal exists and that the stated August 10 enrollment deadline is fabricated.

    The Block / Crypto Times / Crypto Briefing / Accounting Today
    Provenance & Audit Trail
    Anchored on SolanaVerify on-chain13 Wayback Archives

    Decision Log

    This investigation is cryptographically anchored to the Solana blockchain (3 events). 13 of 14 cited source URLs have an Internet Archive snapshot.

    full audit log →version history →

    model: claude-sonnet-4-6

    generated: 7/31/2026, 11:07:01 PM

    last updated: 9/11/2026, 4:21:22 PM

    5 views

    avoid.net — verified advice for a post-truth world