Verify a decision

{"actor":"system:backfill","investigation_id":"28191458-9347-477f-9415-a6f195dea827","kind":"publish","page_slug":"irs-fake-digital-asset-compliance-portal-physical-mail-phishing","published_at":"2026-08-05T17:19:43.955Z","sequence_num":1,"snapshot":{"content_type":"investigation","entity_name":"IRS Fake Digital Asset Compliance Portal — Physical Mail Phishing","sections":[{"content":"The 'IRS Fake Digital Asset Compliance Portal' campaign is a physical mail phishing operation targeting holders of cryptocurrency in the United States. Victims receive letters formatted to resemble official IRS correspondence, asserting that they must enroll in a 'Digital Asset Compliance Portal' before a stated deadline or face penalties. The letters cite tax years spanning 2017 through 2026 to lend an appearance of legitimacy. IRS Criminal Investigation confirmed on July 30, 2026, that no such portal exists and that the agency was not responsible for the mailing. IRS-CI Chief Jarod Koopman described the operation as a 'professionalized international scam operation' that systematically exploits public trust in government agencies.","heading":"Overview","severity":"critical","sources":[{"credibility":1,"name":"IRS warns crypto holders about fake compliance portal scam — Journal of Accountancy","type":"news_article","url":"https://www.journalofaccountancy.com/news/2026/aug/irs-warns-crypto-holders-about-fake-compliance-portal-scam/"},{"credibility":2,"name":"IRS warns scammers are mailing fake letters to crypto holders — Northeast Times","type":"news_article","url":"https://northeasttimes.com/2026/07/31/irs-warns-scammers-are-mailing-fake-letters-to-crypto-holders/"},{"credibility":1,"name":"IRS warns crypto holders of fake letters — Accounting Today","type":"news_article","url":"https://www.accountingtoday.com/news/irs-ci-warns-of-fake-irs-letters-targeting-crypto-holders"}]},{"content":"The attack unfolds in multiple stages. Recipients first receive a physical letter bearing official-looking IRS formatting, including bureaucratic language and a government agency letterhead. The letter instructs them to scan an embedded QR code before a compliance deadline. Scanning the code redirects the victim to a spoofed website designed to mimic IRS.gov, including a banner reading 'official website of the United States government.' On the fraudulent site, victims are prompted to identify which cryptocurrency exchange or wallet they use — options include Coinbase, Binance, Ledger, and Trezor — and to estimate the value of their holdings in ranges up to $100,000 or more. They are then asked to submit a phone number, allegedly for verification by a support representative. According to Coinbase's consumer alert, the phone call that follows is the primary attack vector: impersonators posing as IRS or exchange support staff attempt to obtain one-time passwords, seed phrases, private keys, or to convince victims to transfer funds to attacker-controlled wallets — a technique known as voice phishing or vishing. DarkTower's testing found that the phishing site went inactive following phone number submission, consistent with either a delayed callback model or bulk data harvesting for future campaigns. The IRS has stated it does not send QR codes in official mail and never requests digital asset transfers as part of compliance procedures.","heading":"Attack Mechanics","severity":"critical","sources":[{"credibility":2,"name":"Fake IRS letters direct crypto holders to bogus compliance portal — Help Net Security","type":"news_article","url":"https://www.helpnetsecurity.com/2026/08/04/fake-irs-crypto-letters-compliance-portal-scam/"},{"credibility":2,"name":"Fake IRS letters target cryptocurrency holders — Bitdefender Hot for Security","type":"research","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/fake-irs-letters-cryptocurrency"},{"credibility":2,"name":"Consumer Protection Tuesday: A Fake IRS Digital Asset Compliance Portal Letter Is Targeting Crypto Holders — Coinbase Blog","type":"research","url":"https://www.coinbase.com/blog/consumer-protection-tuesday-fake-irs-scam"},{"credibility":1,"name":"IRS warns crypto holders about fake compliance portal scam — Journal of Accountancy","type":"news_article","url":"https://www.journalofaccountancy.com/news/2026/aug/irs-warns-crypto-holders-about-fake-compliance-portal-scam/"}]},{"content":"Coinbase and cybersecurity firm DarkTower identified the campaign's technical infrastructure. The fraudulent domain was registered through a Hong Kong-based registrar just days before the letters were mailed, a timing pattern consistent with disposable-infrastructure phishing operations designed to minimize detection windows. The site was hosted on servers in Romania on infrastructure that had previously been associated with phishing campaigns impersonating banks and delivery services such as FedEx. Both jurisdictions — Hong Kong for registration and Romania for hosting — have appeared repeatedly in prior phishing investigations and are allegedly selected deliberately to complicate cross-border law enforcement coordination. No arrests or formal charges had been reported as of early August 2026. IRS-CI issued a fraud alert and urged reporting to www.IRS.gov/SubmitATip. The threat actor's identity and organizational structure remain unconfirmed in public reporting.","heading":"Infrastructure and Attribution","severity":"high","sources":[{"credibility":2,"name":"Fake IRS letters direct crypto holders to bogus compliance portal — Help Net Security","type":"research","url":"https://www.helpnetsecurity.com/2026/08/04/fake-irs-crypto-letters-compliance-portal-scam/"},{"credibility":2,"name":"Fake IRS Letters Are Draining Crypto Wallets — Here's the Infrastructure Behind It — The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/crypto-exchanges/fake-irs-letters-are-draining-crypto-wallets-heres-the-infrastructure-behind-it-280720"},{"credibility":2,"name":"Scammers Are Trying to Trick Crypto Holders with Fake IRS Letters — CPA Practice Advisor","type":"news_article","url":"https://www.cpapracticeadvisor.com/2026/08/03/scammers-are-trying-to-trick-crypto-holders-with-fake-irs-letters/187890/"}]},{"content":"The campaign specifically targets holders of cryptocurrency in the United States. The letters' references to tax years spanning 2017 through 2026 suggest that the threat actors may be targeting individuals who began holding digital assets during early major market cycles and who would plausibly have a multi-year tax compliance history with the IRS. The IRS began issuing legitimate digital asset compliance letters to taxpayers in 2019 (CP2000, CP2501, and related notices), which may increase the credibility of the fraudulent correspondence among recipients familiar with that history. The letters' use of plain envelopes, bureaucratic formatting, and realistic design — noted by Coinbase and DarkTower as unusually convincing compared to typical phishing attempts that feature spelling errors and suspicious links — suggests a sophisticated targeting and production operation. No aggregate count of recipients or confirmed victims had been publicly disclosed as of early August 2026.","heading":"Target Profile","severity":"high","sources":[{"credibility":2,"name":"IRS warns counterfeit letters targeting crypto holders — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/irs-warns-counterfeit-letters-crypto-holders/"},{"credibility":2,"name":"IRS Warns Crypto Holders About Fake Tax Letter Scam — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/07/31/irs-warns-crypto-holders-about-fake-tax-letter-scam/"},{"credibility":2,"name":"Did You Get an IRS Crypto Compliance Letter? It Probably Isn't Real — Yahoo News","type":"news_article","url":"https://www.yahoo.com/news/us/articles/did-irs-crypto-compliance-letter-082951104.html"}]},{"content":"IRS Criminal Investigation issued a public fraud alert on July 30, 2026, the earliest recorded official government response to this campaign. IRS-CI Chief Jarod Koopman confirmed that the IRS does not operate any Digital Asset Compliance Portal and urged taxpayers to verify information sources before responding to unexpected requests. The official IRS statement read: 'If you receive a letter claiming to be from the IRS that instructs you to enroll in a Digital Asset Compliance Portal, don't respond. The IRS did not send it. The IRS does not operate a Digital Asset Compliance Portal. This is a scam.' The IRS noted that while it does use QR codes on some legitimate correspondence — including CP53E notices — it advises against scanning QR codes from unsolicited mail. The @IRSnews account on X also posted an alert. Victims are instructed to: cease all communication with the fraudulent parties; change passwords on financial and exchange accounts; contact their financial institutions and cryptocurrency exchanges immediately; preserve all evidence including screenshots, letters, and envelopes; and report to IRS-CI at www.IRS.gov/SubmitATip.","heading":"Official Response and Guidance","severity":"medium","sources":[{"credibility":1,"name":"IRSnews on X — official IRS warning post","type":"official","url":"https://x.com/IRSnews/status/2082866098567819444"},{"credibility":1,"name":"IRS warns crypto holders of fake letters — Accounting Today","type":"news_article","url":"https://www.accountingtoday.com/news/irs-ci-warns-of-fake-irs-letters-targeting-crypto-holders"},{"credibility":1,"name":"IRS Warns of Scam Using Fake Letters to Steal Crypto Wallets and Identities — Bloomberg","type":"news_article","url":"https://www.bloomberg.com/news/articles/2026-07-30/scam-artists-are-posing-as-irs-agents-to-drain-crypto-wallets"}]},{"content":"The use of physical mail in a phishing campaign is notable: most phishing operations rely on email, SMS, or social media, and the added production cost of printing and mailing letters reflects a calculated effort to bypass digital spam filters and exploit the heightened credibility recipients typically assign to physical government correspondence. The campaign exploits a specific regulatory moment: the IRS has been expanding its digital asset enforcement activity since 2019, issuing genuine compliance notices to hundreds of thousands of taxpayers. Recipients with real digital asset holdings are therefore primed to treat IRS communications on the subject as plausible. The campaign shares infrastructure ancestry with phishing operations that previously impersonated banks and delivery services, suggesting a threat actor with established phishing-as-a-service capabilities capable of pivoting across target demographics. IRS warnings about phishing campaigns targeting cryptocurrency holders have been issued in prior years but this is the first documented instance of a large-scale physical mail campaign deploying a fabricated IRS compliance portal name.","heading":"Broader Context","severity":"medium","sources":[{"credibility":2,"name":"Fake IRS Letters Are Draining Crypto Wallets — Here's the Infrastructure Behind It — The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/crypto-exchanges/fake-irs-letters-are-draining-crypto-wallets-heres-the-infrastructure-behind-it-280720"},{"credibility":2,"name":"IRS warns of phishing campaign targeting cryptocurrency holders — Digital Watch Observatory","type":"news_article","url":"https://dig.watch/updates/irs-letters-cryptocurrency-phishing-scam"},{"credibility":2,"name":"Crypto Scam Surge: Fraudsters Use Fake IRS Letters to Steal Investor Information — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/crypto-scam-surge-fraudsters-use-fake-irs-letters-to-steal-investor-information/"}]}],"sources_used":[{"credibility":1,"name":"IRS warns crypto holders about fake compliance portal scam — Journal of Accountancy","type":"news_article","url":"https://www.journalofaccountancy.com/news/2026/aug/irs-warns-crypto-holders-about-fake-compliance-portal-scam/"},{"credibility":1,"name":"IRS Warns of Scam Using Fake Letters to Steal Crypto Wallets and Identities — Bloomberg","type":"news_article","url":"https://www.bloomberg.com/news/articles/2026-07-30/scam-artists-are-posing-as-irs-agents-to-drain-crypto-wallets"},{"credibility":1,"name":"IRS warns crypto holders of fake letters — Accounting Today","type":"news_article","url":"https://www.accountingtoday.com/news/irs-ci-warns-of-fake-irs-letters-targeting-crypto-holders"},{"credibility":1,"name":"IRSnews on X — official IRS warning post","type":"official","url":"https://x.com/IRSnews/status/2082866098567819444"},{"credibility":2,"name":"Fake IRS letters direct crypto holders to bogus compliance portal — Help Net Security","type":"research","url":"https://www.helpnetsecurity.com/2026/08/04/fake-irs-crypto-letters-compliance-portal-scam/"},{"credibility":2,"name":"Fake IRS letters target cryptocurrency holders — Bitdefender Hot for Security","type":"research","url":"https://www.bitdefender.com/en-us/blog/hotforsecurity/fake-irs-letters-cryptocurrency"},{"credibility":2,"name":"Consumer Protection Tuesday: A Fake IRS Digital Asset Compliance Portal Letter Is Targeting Crypto Holders — Coinbase Blog","type":"research","url":"https://www.coinbase.com/blog/consumer-protection-tuesday-fake-irs-scam"},{"credibility":2,"name":"IRS warns counterfeit letters targeting crypto holders — Crypto Briefing","type":"news_article","url":"https://cryptobriefing.com/irs-warns-counterfeit-letters-crypto-holders/"},{"credibility":2,"name":"Scammers Are Trying to Trick Crypto Holders with Fake IRS Letters — CPA Practice Advisor","type":"news_article","url":"https://www.cpapracticeadvisor.com/2026/08/03/scammers-are-trying-to-trick-crypto-holders-with-fake-irs-letters/187890/"},{"credibility":2,"name":"Fake IRS Letters Are Draining Crypto Wallets — Here's the Infrastructure Behind It — The Currency Analytics","type":"news_article","url":"https://thecurrencyanalytics.com/crypto-exchanges/fake-irs-letters-are-draining-crypto-wallets-heres-the-infrastructure-behind-it-280720"},{"credibility":2,"name":"IRS warns scammers are mailing fake letters to crypto holders — Northeast Times","type":"news_article","url":"https://northeasttimes.com/2026/07/31/irs-warns-scammers-are-mailing-fake-letters-to-crypto-holders/"},{"credibility":2,"name":"IRS Warns Crypto Holders About Fake Tax Letter Scam — Crypto Times","type":"news_article","url":"https://www.cryptotimes.io/2026/07/31/irs-warns-crypto-holders-about-fake-tax-letter-scam/"},{"credibility":2,"name":"Did You Get an IRS Crypto Compliance Letter? It Probably Isn't Real — Yahoo News","type":"news_article","url":"https://www.yahoo.com/news/us/articles/did-irs-crypto-compliance-letter-082951104.html"},{"credibility":2,"name":"IRS Warns Fake Crypto Letters Target Wallets and Personal Data — Bitcoin.com News","type":"news_article","url":"https://news.bitcoin.com/regulation-and-legal/irs-warns-fake-crypto-letters-target-wallets-and-personal-data/"},{"credibility":2,"name":"IRS warns of phishing campaign targeting cryptocurrency holders — Digital Watch Observatory","type":"news_article","url":"https://dig.watch/updates/irs-letters-cryptocurrency-phishing-scam"},{"credibility":2,"name":"Crypto Scam Surge: Fraudsters Use Fake IRS Letters to Steal Investor Information — Crypto Economy","type":"news_article","url":"https://crypto-economy.com/crypto-scam-surge-fraudsters-use-fake-irs-letters-to-steal-investor-information/"},{"credibility":2,"name":"IRS Warns: Impersonation Letters Include QR Codes, Forging a Digital Asset Compliance Portal — Gate News","type":"news_article","url":"https://www.gate.com/news/detail/us-irs-warns-impersonation-letters-contain-qr-codes-stealing-crypto-assets-23094072"}],"summary":"Beginning in late July 2026, an unidentified threat actor began mailing counterfeit IRS letters to cryptocurrency holders in the United States, directing recipients to a nonexistent 'Digital Asset Compliance Portal' via embedded QR codes. IRS Criminal Investigation (IRS-CI) publicly confirmed on July 30, 2026, that the portal does not exist and that the agency did not send the letters. Cybersecurity firms Coinbase and DarkTower traced the campaign's infrastructure to a domain registered through a Hong Kong registrar and hosted on Romanian servers previously associated with financial-institution phishing.","timeline":[{"date":"2026-07-28","event":"Coinbase and DarkTower jointly issue a consumer alert identifying the fraudulent 'Digital Asset Compliance Portal' campaign, flagging the domain infrastructure and attack mechanics.","source":"Crypto Briefing","source_url":"https://cryptobriefing.com/irs-warns-counterfeit-letters-crypto-holders/"},{"date":"2026-07-30","event":"IRS Criminal Investigation issues a public fraud alert confirming that the 'Digital Asset Compliance Portal' does not exist and that the agency did not send the letters. IRS-CI Chief Jarod Koopman characterizes it as a 'professionalized international scam operation.' Bloomberg reports on the campaign.","source":"Bloomberg / Accounting Today","source_url":"https://www.bloomberg.com/news/articles/2026-07-30/scam-artists-are-posing-as-irs-agents-to-drain-crypto-wallets"},{"date":"2026-07-31","event":"Additional mainstream crypto and financial media outlets including Northeast Times and Crypto Times report on the IRS warning. @IRSnews posts an alert on X.","source":"Northeast Times / IRSnews on X","source_url":"https://northeasttimes.com/2026/07/31/irs-warns-scammers-are-mailing-fake-letters-to-crypto-holders/"},{"date":"2026-08-03","event":"Journal of Accountancy and CPA Practice Advisor publish detailed analyses of the scam, including victim guidance and confirmation that no arrests have been made.","source":"Journal of Accountancy","source_url":"https://www.journalofaccountancy.com/news/2026/aug/irs-warns-crypto-holders-about-fake-compliance-portal-scam/"},{"date":"2026-08-04","event":"Help Net Security and Bitdefender publish technical analyses of the phishing infrastructure, confirming the Hong Kong registrar, Romanian hosting, and multi-stage vishing component.","source":"Help Net Security / Bitdefender","source_url":"https://www.helpnetsecurity.com/2026/08/04/fake-irs-crypto-letters-compliance-portal-scam/"}]},"v":1}