Audit log

Every state-changing event for IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing: moderation decisions on community submissions, plus corrections and updates from the news pipeline. URL-based decisions are designed to carry three independent witnesses — the original source, an Internet Archive snapshot, and a Solana memo signed by our publicly-disclosed publisher key. Archive coverage is still being backfilled, so each decision below reports its own snapshot status rather than assuming one exists.

1. #1publishby system:backfill

   2026-08-05 17:19:44Z
   Score: ? → ? (no score change)
   anchoranchored

   chain

   ●mainnet-betaslot 443,504,261

   sig

   5fuqGjJh9roe…SrLL2Urocopyexplorer ↗

   hash

   47bn3LcBdTEt…hQCuchoycopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (18387 B) ▸

   {"actor":"system:backfill","investigation_id":"28191458-9347-477f-9415-a6f195dea827","kind":"publish","page_slug":"irs-fake-digital-asset-compliance-portal-physical-mail-phishing","published_at":"2026-08-05T17:19:43.955Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing","sections":[{"content":"The 'IRS Fake Digital Asset Compliance Portal' campaign is a physical mail phishing operation targeting holders of cryptocurrency in the United States. Victims receive letters formatted to resemble official IRS correspondence, asserting that they must enroll in a 'Digital Asset Compliance Portal' before a stated deadline or face penalties. The letters cite tax years spanning 2017 through 2026 to lend an appearance of legitimacy. IRS Criminal Investigation confirmed on July 30, 2026, that no such portal exists and that the agency was not responsible for the mailing. IRS-CI Chief Jarod Koopman described the operation as a 'professionalized international scam operation' that systematically exploits public trust in government agencies.","heading":"Overview","severity":"critical","sources":[{"credibility":1,"name":"IRS warns crypto holders about fake compliance portal scam — Journal of Accountancy","type":"news_article","url":"https://www.journalofaccountancy.com/news/2026/aug/irs-warns-crypto-holders-about-fake-compliance-portal-scam/"},{"credibility":2,"name":"IRS warns scammers are mailing fake letters to crypto holders — Northeast Times","type":"news_article","url":"https://northeasttimes.com/2026/07/31/irs-warns-scammers-are-mailing-fake-letters-to-crypto-holders/"},{"credibility":1,"name":"IRS warns crypto holders of fake letters — Accounting Today","type":"news_article","url":"https://www.accountingtoday.com/news/irs-ci-warns-of-fake-irs-letters-targeting-crypto-holders"}]},{"content":"The attack unfolds in multiple stages. Recipients first receive a physical letter bearing official-looking IRS formatting, including bureaucratic language and a government agency letterhead. The letter instructs them to scan an embedded QR code before a compliance deadline. Scanning the code redirects the victim to a spoofed website designed to mimic IRS.gov, including a banner reading 'official website of the United States government.' On the fraudulent site, victims are prompted to identify which cryptocurrency exchange or wallet they use — options include Coinbase, Binance, Ledger, and Trezor — and to estimate the value of their holdings in ranges up to $100,000 or more. They are then asked to submit a phone number, allegedly for verification by a support representative. According to Coinbase's consumer alert, the phone call that follows is the primary attack vector: impersonators posing as IRS or exchange support staff attempt to obtain one-time passwords, seed phrases, private keys, or to convince victims to transfer funds to attacker-controlled wallets — a technique known as voice phishing or vishing. DarkTower's testing found that the phishing site went inactive following phone number submission, consistent with either a delayed callback model or bulk data harvesting for future campaigns. The IRS has stated it does not send QR codes in official mail and never requests digital asset transfers as part of compliance procedures.","heading":"Attack Mechanics","severity":"critical","sources":[{"credibility":2,"name":"Fake IRS letters direct crypto holders to bogus compliance portal — Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/08/04/fake-irs-crypto-letters-compliance-portal-scam/"},{"credibility":2,"name":"Fake IRS letters target cryptocurrency holders — Bitdefender Hot for Security","type":"research","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/fake-irs-letters-cryptocurrency"},{"credibility":2,"name":"Consumer Protection Tuesday: A Fake IRS Digital Asset Compliance Portal Letter Is Targeting Crypto Holders — Coinbase Blog","type":"research","url":"https://www.coinbase.com/blog/consumer-protection-tuesday-fake-irs-scam"},{"credibility":1,"name":"IRS warns crypto holders about fake compliance portal scam — Journal of Accountancy","type":"news_article","url":"https://www.journalofaccountancy.com/news/2026/aug/irs-warns-crypto-holders-about-fake-compliance-portal-scam/"}]},{"content":"Coinbase and cybersecurity firm DarkTower identified the campaign's technical infrastructure. The fraudulent domain was registered through a Hong Kong-based registrar just days before the letters were mailed, a timing pattern consistent with disposable-infrastructure phishing operations designed to minimize detection windows. The site was hosted on servers in Romania on infrastructure that had previously been associated with phishing campaigns impersonating banks and delivery services such as FedEx. Both jurisdictions — Hong Kong for registration and Romania for hosting — have appeared repeatedly in prior phishing investigations and are allegedly selected deliberately to complicate cross-border law enforcement coordination. No arrests or formal charges had been reported as of early August 2026. IRS-CI issued a fraud alert and urged reporting to www.IRS.gov/SubmitATip. The threat actor's identity and organizational structure remain unconfirmed in public reporting.","heading":"Infrastructure and Attribution","severity":"high","sources":[{"credibility":2,"name":"Fake IRS letters direct crypto holders to bogus compliance portal — Help Net Security","type":"research","url":"https://www.helpnetsecurity.com/2026/08/04/fake-irs-crypto-letters-compliance-portal-scam/"},{"credibility":2,"name":"Fake IRS Letters Are Draining Crypto Wallets — Here's the Infrastructure Behind It — The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/crypto-exchanges/fake-irs-letters-are-draining-crypto-wallets-heres-the-infrastructure-behind-it-280720"},{"credibility":2,"name":"Scammers Are Trying to Trick Crypto Holders with Fake IRS Letters — CPA Practice Advisor","type":"news_article","url":"https://www.cpapracticeadvisor.com/2026/08/03/scammers-are-trying-to-trick-crypto-holders-with-fake-irs-letters/187890/"}]},{"content":"The campaign specifically targets holders of cryptocurrency in the United States. The letters' references to tax years spanning 2017 through 2026 suggest that the threat actors may be targeting individuals who began holding digital assets during early major market cycles and who would plausibly have a multi-year tax compliance history with the IRS. The IRS began issuing legitimate digital asset compliance letters to taxpayers in 2019 (CP2000, CP2501, and related notices), which may increase the credibility of the fraudulent correspondence among recipients familiar with that history. The letters' use of plain envelopes, bureaucratic formatting, and realistic design — noted by Coinbase and DarkTower as unusually convincing compared to typical phishing attempts that feature spelling errors and suspicious links — suggests a sophisticated targeting and production operation. No aggregate count of recipients or confirmed victims had been publicly disclosed as of early August 2026.","heading":"Target Profile","severity":"high","sources":[{"credibility":2,"name":"IRS warns counterfeit letters targeting crypto holders — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/irs-warns-counterfeit-letters-crypto-holders/"},{"credibility":2,"name":"IRS Warns Crypto Holders About Fake Tax Letter Scam — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/07/31/irs-warns-crypto-holders-about-fake-tax-letter-scam/"},{"credibility":2,"name":"Did You Get an IRS Crypto Compliance Letter? It Probably Isn't Real — Yahoo News","type":"news_article","url":"https://www.yahoo.com/news/us/articles/did-irs-crypto-compliance-letter-082951104.html"}]},{"content":"IRS Criminal Investigation issued a public fraud alert on July 30, 2026, the earliest recorded official government response to this campaign. IRS-CI Chief Jarod Koopman confirmed that the IRS does not operate any Digital Asset Compliance Portal and urged taxpayers to verify information sources before responding to unexpected requests. The official IRS statement read: 'If you receive a letter claiming to be from the IRS that instructs you to enroll in a Digital Asset Compliance Portal, don't respond. The IRS did not send it. The IRS does not operate a Digital Asset Compliance Portal. This is a scam.' The IRS noted that while it does use QR codes on some legitimate correspondence — including CP53E notices — it advises against scanning QR codes from unsolicited mail. The @IRSnews account on X also posted an alert. Victims are instructed to: cease all communication with the fraudulent parties; change passwords on financial and exchange accounts; contact their financial institutions and cryptocurrency exchanges immediately; preserve all evidence including screenshots, letters, and envelopes; and report to IRS-CI at www.IRS.gov/SubmitATip.","heading":"Official Response and Guidance","severity":"medium","sources":[{"credibility":1,"name":"IRSnews on X — official IRS warning post","type":"official","url":"https://x.com/IRSnews/status/2082866098567819444"},{"credibility":1,"name":"IRS warns crypto holders of fake letters — Accounting Today","type":"news_article","url":"https://www.accountingtoday.com/news/irs-ci-warns-of-fake-irs-letters-targeting-crypto-holders"},{"credibility":1,"name":"IRS Warns of Scam Using Fake Letters to Steal Crypto Wallets and Identities — Bloomberg","type":"news_article","url":"https://www.bloomberg.com/news/articles/2026-07-30/scam-artists-are-posing-as-irs-agents-to-drain-crypto-wallets"}]},{"content":"The use of physical mail in a phishing campaign is notable: most phishing operations rely on email, SMS, or social media, and the added production cost of printing and mailing letters reflects a calculated effort to bypass digital spam filters and exploit the heightened credibility recipients typically assign to physical government correspondence. The campaign exploits a specific regulatory moment: the IRS has been expanding its digital asset enforcement activity since 2019, issuing genuine compliance notices to hundreds of thousands of taxpayers. Recipients with real digital asset holdings are therefore primed to treat IRS communications on the subject as plausible. The campaign shares infrastructure ancestry with phishing operations that previously impersonated banks and delivery services, suggesting a threat actor with established phishing-as-a-service capabilities capable of pivoting across target demographics. IRS warnings about phishing campaigns targeting cryptocurrency holders have been issued in prior years but this is the first documented instance of a large-scale physical mail campaign deploying a fabricated IRS compliance portal name.","heading":"Broader Context","severity":"medium","sources":[{"credibility":2,"name":"Fake IRS Letters Are Draining Crypto Wallets — Here's the Infrastructure Behind It — The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/crypto-exchanges/fake-irs-letters-are-draining-crypto-wallets-heres-the-infrastructure-behind-it-280720"},{"credibility":2,"name":"IRS warns of phishing campaign targeting cryptocurrency holders — Digital Watch Observatory","type":"news_article","url":"https://dig.watch/updates/irs-letters-cryptocurrency-phishing-scam"},{"credibility":2,"name":"Crypto Scam Surge: Fraudsters Use Fake IRS Letters to Steal Investor Information — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/crypto-scam-surge-fraudsters-use-fake-irs-letters-to-steal-investor-information/"}]}],"sources_used":[{"credibility":1,"name":"IRS warns crypto holders about fake compliance portal scam — Journal of Accountancy","type":"news_article","url":"https://www.journalofaccountancy.com/news/2026/aug/irs-warns-crypto-holders-about-fake-compliance-portal-scam/"},{"credibility":1,"name":"IRS Warns of Scam Using Fake Letters to Steal Crypto Wallets and Identities — Bloomberg","type":"news_article","url":"https://www.bloomberg.com/news/articles/2026-07-30/scam-artists-are-posing-as-irs-agents-to-drain-crypto-wallets"},{"credibility":1,"name":"IRS warns crypto holders of fake letters — Accounting Today","type":"news_article","url":"https://www.accountingtoday.com/news/irs-ci-warns-of-fake-irs-letters-targeting-crypto-holders"},{"credibility":1,"name":"IRSnews on X — official IRS warning post","type":"official","url":"https://x.com/IRSnews/status/2082866098567819444"},{"credibility":2,"name":"Fake IRS letters direct crypto holders to bogus compliance portal — Help Net Security","type":"research","url":"https://www.helpnetsecurity.com/2026/08/04/fake-irs-crypto-letters-compliance-portal-scam/"},{"credibility":2,"name":"Fake IRS letters target cryptocurrency holders — Bitdefender Hot for Security","type":"research","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/fake-irs-letters-cryptocurrency"},{"credibility":2,"name":"Consumer Protection Tuesday: A Fake IRS Digital Asset Compliance Portal Letter Is Targeting Crypto Holders — Coinbase Blog","type":"research","url":"https://www.coinbase.com/blog/consumer-protection-tuesday-fake-irs-scam"},{"credibility":2,"name":"IRS warns counterfeit letters targeting crypto holders — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/irs-warns-counterfeit-letters-crypto-holders/"},{"credibility":2,"name":"Scammers Are Trying to Trick Crypto Holders with Fake IRS Letters — CPA Practice Advisor","type":"news_article","url":"https://www.cpapracticeadvisor.com/2026/08/03/scammers-are-trying-to-trick-crypto-holders-with-fake-irs-letters/187890/"},{"credibility":2,"name":"Fake IRS Letters Are Draining Crypto Wallets — Here's the Infrastructure Behind It — The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/crypto-exchanges/fake-irs-letters-are-draining-crypto-wallets-heres-the-infrastructure-behind-it-280720"},{"credibility":2,"name":"IRS warns scammers are mailing fake letters to crypto holders — Northeast Times","type":"news_article","url":"https://northeasttimes.com/2026/07/31/irs-warns-scammers-are-mailing-fake-letters-to-crypto-holders/"},{"credibility":2,"name":"IRS Warns Crypto Holders About Fake Tax Letter Scam — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/07/31/irs-warns-crypto-holders-about-fake-tax-letter-scam/"},{"credibility":2,"name":"Did You Get an IRS Crypto Compliance Letter? It Probably Isn't Real — Yahoo News","type":"news_article","url":"https://www.yahoo.com/news/us/articles/did-irs-crypto-compliance-letter-082951104.html"},{"credibility":2,"name":"IRS Warns Fake Crypto Letters Target Wallets and Personal Data — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/regulation-and-legal/irs-warns-fake-crypto-letters-target-wallets-and-personal-data/"},{"credibility":2,"name":"IRS warns of phishing campaign targeting cryptocurrency holders — Digital Watch Observatory","type":"news_article","url":"https://dig.watch/updates/irs-letters-cryptocurrency-phishing-scam"},{"credibility":2,"name":"Crypto Scam Surge: Fraudsters Use Fake IRS Letters to Steal Investor Information — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/crypto-scam-surge-fraudsters-use-fake-irs-letters-to-steal-investor-information/"},{"credibility":2,"name":"IRS Warns: Impersonation Letters Include QR Codes, Forging a Digital Asset Compliance Portal — Gate News","type":"news_article","url":"https://www.gate.com/news/detail/us-irs-warns-impersonation-letters-contain-qr-codes-stealing-crypto-assets-23094072"}],"summary":"Beginning in late July 2026, an unidentified threat actor began mailing counterfeit IRS letters to cryptocurrency holders in the United States, directing recipients to a nonexistent 'Digital Asset Compliance Portal' via embedded QR codes. IRS Criminal Investigation (IRS-CI) publicly confirmed on July 30, 2026, that the portal does not exist and that the agency did not send the letters. Cybersecurity firms Coinbase and DarkTower traced the campaign's infrastructure to a domain registered through a Hong Kong registrar and hosted on Romanian servers previously associated with financial-institution phishing.","timeline":[{"date":"2026-07-28","event":"Coinbase and DarkTower jointly issue a consumer alert identifying the fraudulent 'Digital Asset Compliance Portal' campaign, flagging the domain infrastructure and attack mechanics.","source":"Crypto Briefing","source_url":"https://cryptobriefing.com/irs-warns-counterfeit-letters-crypto-holders/"},{"date":"2026-07-30","event":"IRS Criminal Investigation issues a public fraud alert confirming that the 'Digital Asset Compliance Portal' does not exist and that the agency did not send the letters. IRS-CI Chief Jarod Koopman characterizes it as a 'professionalized international scam operation.' Bloomberg reports on the campaign.","source":"Bloomberg / Accounting Today","source_url":"https://www.bloomberg.com/news/articles/2026-07-30/scam-artists-are-posing-as-irs-agents-to-drain-crypto-wallets"},{"date":"2026-07-31","event":"Additional mainstream crypto and financial media outlets including Northeast Times and Crypto Times report on the IRS warning. @IRSnews posts an alert on X.","source":"Northeast Times / IRSnews on X","source_url":"https://northeasttimes.com/2026/07/31/irs-warns-scammers-are-mailing-fake-letters-to-crypto-holders/"},{"date":"2026-08-03","event":"Journal of Accountancy and CPA Practice Advisor publish detailed analyses of the scam, including victim guidance and confirmation that no arrests have been made.","source":"Journal of Accountancy","source_url":"https://www.journalofaccountancy.com/news/2026/aug/irs-warns-crypto-holders-about-fake-compliance-portal-scam/"},{"date":"2026-08-04","event":"Help Net Security and Bitdefender publish technical analyses of the phishing infrastructure, confirming the Hong Kong registrar, Romanian hosting, and multi-stage vishing component.","source":"Help Net Security / Bitdefender","source_url":"https://www.helpnetsecurity.com/2026/08/04/fake-irs-crypto-letters-compliance-portal-scam/"}]},"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 48ab29a3-4231-4a71-9c4b-f7eecf724405copy
2. #2reviewby reviewerreviewer

   2026-08-25 22:56:54Z
   Score: 0 → 0 (no score change)
   The page's core factual scaffolding — campaign mechanics, timeline, infrastructure attribution, and IRS response — is well supported by IRS.gov's own fraud alert and multiple independent security/media outlets, and the IRS is consistently and correctly framed as the impersonated victim rather than an actor, with victim guidance that is accurate and non-inverted. However, a direct quotation attributed to IRS-CI Chief Jarod Koopman ('professionalized international scam operation') does not match his verifiable statements and appears to conflate his real quote with a separate Coinbase characterization of the hosting infrastructure, and the page contains an internal contradiction about whether the IRS ever uses QR codes in legitimate mail (the Attack Mechanics section says no, the Official Response section correctly says yes for CP53E notices).
   anchoranchored

   chain

   ●mainnet-betaslot 443,518,168

   sig

   4LozZstPXKam…WzvWha37copyexplorer ↗

   hash

   AJPyCcBouwCa…VeGZspSbcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (1249 B) ▸

   {"actor":"reviewer","decided_at":"2026-08-25T22:56:54.074Z","decision":"review","investigation_id":"28191458-9347-477f-9415-a6f195dea827","new_score":0,"page_slug":"irs-fake-digital-asset-compliance-portal-physical-mail-phishing","prev_score":0,"reason":"The page's core factual scaffolding — campaign mechanics, timeline, infrastructure attribution, and IRS response — is well supported by IRS.gov's own fraud alert and multiple independent security/media outlets, and the IRS is consistently and correctly framed as the impersonated victim rather than an actor, with victim guidance that is accurate and non-inverted. However, a direct quotation attributed to IRS-CI Chief Jarod Koopman ('professionalized international scam operation') does not match his verifiable statements and appears to conflate his real quote with a separate Coinbase characterization of the hosting infrastructure, and the page contains an internal contradiction about whether the IRS ever uses QR codes in legitimate mail (the Attack Mechanics section says no, the Official Response section correctly says yes for CP53E notices).","score_delta":0,"sequence_num":2,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 56879672-3af1-4ae4-bc2f-fe3427580ab0copy
3. #3review reviseby judgejudge

   2026-08-25 22:56:54Z
   Score: 0 → 0 (-12)
   The reviewer confirmed 13 of 19 claims outright and found the page's core account of the scam — the fake letters, the spoofed portal, the vishing follow-up, the infrastructure, and the IRS's own July 30 fraud alert — well supported by primary and independent sources (claim_findings[0-3], [5-6], [8-9], [12-13], [15-16], [18]). Two problems keep it out of the approve band. First, the page attributes a direct quote to IRS-CI Chief Jarod Koopman ('professionalized international scam operation') that does not appear in his verifiable statements and appears to have been assembled from a separate description of hosting infrastructure (claim_findings[4] and its duplicate at [17]); presenting invented words as a named official's direct quote is a more serious defect than a misstated statistic. Second, the page contradicts itself on whether the IRS ever sends QR codes in official mail — the Attack Mechanics section says never, while the Official Response section correctly notes the IRS uses QR codes on legitimate CP53E notices (claim_findings[7], corroborated by claim_findings[13]) — a contradiction that, on a page meant to help readers tell real IRS mail from fake, could lead someone to wrongly dismiss a genuine notice as fraudulent. Two smaller issues round out the disputed set: the 2019 letter numbers cited (CP2000/CP2501) appear to be the wrong ones for that campaign (claim_findings[10]), and a claim that 'hundreds of thousands' of taxpayers received genuine compliance notices could not be confirmed, with only a figure near 10,000 substantiated for the original 2019 campaign (claim_findings[14]). Weighed against this, the reviewer confirmed that the IRS is consistently and correctly framed as the impersonated party throughout and that all victim mitigation advice is accurate and never points readers toward the fraudulent portal or QR code (claim_findings[13]) — the one defect that would have been disqualifying is absent. With disputed-or-unverifiable claims at 4 of 19 (21%), no high-priority coverage gaps, and a reasonably confident review (0.78), this falls in the lower-to-middle revise band: correctable defects, not a page that misleads on its central facts or protective purpose.
   anchoranchored

   chain

   ●mainnet-betaslot 443,518,172

   sig

   3Pv7cwVWpmDU…xqGvtkkWcopyexplorer ↗

   hash

   3jS5ggwX7e5D…WKHNNxLEcopysha256 → base58

   verifying row…full verify ↗

   canonical bytes (2617 B) ▸

   {"actor":"judge","decided_at":"2026-08-25T22:56:54.074Z","decision":"review_revise","investigation_id":"28191458-9347-477f-9415-a6f195dea827","new_score":0,"page_slug":"irs-fake-digital-asset-compliance-portal-physical-mail-phishing","prev_score":0,"reason":"The reviewer confirmed 13 of 19 claims outright and found the page's core account of the scam — the fake letters, the spoofed portal, the vishing follow-up, the infrastructure, and the IRS's own July 30 fraud alert — well supported by primary and independent sources (claim_findings[0-3], [5-6], [8-9], [12-13], [15-16], [18]). Two problems keep it out of the approve band. First, the page attributes a direct quote to IRS-CI Chief Jarod Koopman ('professionalized international scam operation') that does not appear in his verifiable statements and appears to have been assembled from a separate description of hosting infrastructure (claim_findings[4] and its duplicate at [17]); presenting invented words as a named official's direct quote is a more serious defect than a misstated statistic. Second, the page contradicts itself on whether the IRS ever sends QR codes in official mail — the Attack Mechanics section says never, while the Official Response section correctly notes the IRS uses QR codes on legitimate CP53E notices (claim_findings[7], corroborated by claim_findings[13]) — a contradiction that, on a page meant to help readers tell real IRS mail from fake, could lead someone to wrongly dismiss a genuine notice as fraudulent. Two smaller issues round out the disputed set: the 2019 letter numbers cited (CP2000/CP2501) appear to be the wrong ones for that campaign (claim_findings[10]), and a claim that 'hundreds of thousands' of taxpayers received genuine compliance notices could not be confirmed, with only a figure near 10,000 substantiated for the original 2019 campaign (claim_findings[14]). Weighed against this, the reviewer confirmed that the IRS is consistently and correctly framed as the impersonated party throughout and that all victim mitigation advice is accurate and never points readers toward the fraudulent portal or QR code (claim_findings[13]) — the one defect that would have been disqualifying is absent. With disputed-or-unverifiable claims at 4 of 19 (21%), no high-priority coverage gaps, and a reasonably confident review (0.78), this falls in the lower-to-middle revise band: correctable defects, not a page that misleads on its central facts or protective purpose.","score_delta":-12,"sequence_num":3,"submission_content_hash":null,"submission_id":null,"submission_kind":null,"submission_valence":null,"v":1}

   Verify offline (run on your own machine)

   python -m src.verify_decision 94a42cfa-b15f-47f2-9018-2d75956ad9ffcopy