IRS Warns Crypto Holders: Fake Compliance Portal Scam Targets Your Wallet
The IRS has confirmed that fraudsters are mailing physical letters to cryptocurrency holders, directing them to a bogus "Digital Asset Compliance Portal" designed to steal personal information and crypto account credentials. The agency is unambiguous: no such portal exists, and anyone who receives one of these letters is looking at a scam. If you hold crypto and use any kind of crypto tax calculator or keep records on an exchange, your data could be what these criminals are after.
What the Scam Actually Looks Like
The attack is more sophisticated than a generic phishing email. Victims receive a physical letter that is formatted to look like official IRS correspondence. The letter claims the recipient must enroll in a "Digital Asset Compliance Portal" before a stated deadline, creating a false sense of urgency.
The QR Code Trap
Buried in the letter is a QR code. Scanning it takes the recipient to a fraudulent website built to mimic IRS.gov in appearance. Once there, the site attempts to harvest a range of sensitive data, including full name and address details, cryptocurrency wallet addresses or private keys, exchange account login credentials, and other personally identifiable information.
IRS Criminal Investigation (IRS-CI) Chief Jarod Koopman specifically urged holders to verify the source of any unexpected request for personal information before responding, and to report suspected fraud to law enforcement.
Where the Infrastructure Comes From
Coinbase and cybersecurity firm DarkTower traced the campaign to a domain registered through a Hong Kong registrar and hosted in Romania, according to the IRS. The cross-border infrastructure is a deliberate choice: it complicates takedown efforts and makes attribution harder for US law enforcement. The IRS has not disclosed how the fraudsters obtained the names and mailing addresses of crypto holders, and IRS-CI declined to answer questions on the scope of the campaign.
Why Crypto Holders Are Being Targeted
This scam is not random. It is specifically engineered around the IRS's well-publicised enforcement focus on digital assets. The agency has spent the last several years expanding its crypto reporting requirements, rolling out Form 1099-DA, and signalling that unreported crypto gains are a priority for its Criminal Investigation division. Fraudsters are exploiting that public pressure. A crypto holder who has been quietly unsure whether they've filed everything correctly is exactly the person most likely to panic when they see a letter claiming they must "enroll" in a compliance portal by a deadline.
The timing also matters. With Form 1099-DA now live for the 2026 tax year, many holders are receiving new broker-issued tax forms for the first time. Scammers are counting on that confusion. An official-looking letter about "digital asset compliance" lands differently when you've just received a genuine 1099-DA from your exchange.
What the IRS Actually Does and Does Not Do
The IRS was direct in its public statement: "The IRS does not operate a Digital Asset Compliance Portal. This is a scam." That is the clearest possible signal. But it's worth spelling out the broader rules so you can spot future variants of this kind of fraud.
How the IRS Makes Genuine Contact
The IRS initiates contact with taxpayers by postal mail in most circumstances. It does not send unsolicited emails, text messages, or social media messages asking for personal or financial information. When the agency does send a letter, it will never instruct you to scan a QR code to access a compliance system, submit wallet credentials, or hand over exchange login details. If you want to verify any IRS communication, the correct approach is to go directly to IRS.gov by typing the address into your browser, or to call the agency using a number published on that site. Do not use any contact information printed in a letter you did not expect.
Red Flags in This Campaign
Several features of this scam make it identifiable once you know what to look for. An artificial deadline is one of the most reliable warning signs: legitimate IRS letters about compliance do include deadlines, but they are tied to specific statutory processes, not a portal enrollment. A QR code in an unsolicited letter is another immediate red flag. IRS-CI has now explicitly said that taxpayers should not scan QR codes included in letters purporting to come from the IRS. The request for wallet information or exchange credentials is perhaps the most obvious tell: the IRS has no mechanism that requires you to submit private keys or account passwords to satisfy a tax obligation.
Practical Steps If You Receive One of These Letters
Do Not Engage With the Letter
Don't scan the QR code. Don't visit the URL printed in the letter. Don't call any phone number listed in it. Set the letter aside.
Verify Through Official Channels
Go to IRS.gov directly to check whether there is any genuine outstanding notice on your account. You can also call the IRS using the number on their official site to confirm whether any correspondence has been sent to you. If you have a tax professional, contact them first and share a photo of the letter.
Report the Fraud
IRS-CI asks that potential fraud be reported. You can forward phishing emails or report scam letters to phishing@irs.gov. The Treasury Inspector General for Tax Administration (TIGTA) also accepts reports at 1-800-366-4484 or through their online portal at tigta.gov. Filing a report helps the agency track the scope of the campaign even if it does not immediately resolve your individual situation.
Check Whether Your Data Was Exposed
If you did scan the QR code or enter any information on the fraudulent site, treat it as a breach. Change your exchange account passwords immediately, enable two-factor authentication if you haven't already, and consider placing a fraud alert with the major credit bureaus. Contact your exchange directly to flag potential unauthorized access. If you entered wallet seed phrases or private keys, those wallets should be considered compromised and funds should be moved to new addresses without delay.
The Crypto Tax Filing Connection
Scams like this thrive on the anxiety that many crypto holders feel about their tax position. If you've traded, staked, received airdrops, or used DeFi protocols over the past few years, working out what you owe using a reliable crypto tax calculator and filing an accurate return is the most effective way to reduce your exposure to this kind of pressure. A holder who is confident their crypto tax report is accurate and up to date has no reason to panic when a letter arrives claiming they owe something to a "compliance portal."
The IRS's own guidance on how to file crypto taxes is clear: gains and losses from digital asset disposals go on Schedule D, income from staking or mining is ordinary income, and brokers are now required to report transactions via 1099-DA. None of that process involves scanning a QR code or submitting wallet credentials to any portal. Understanding how to calculate crypto taxes through legitimate means is your best defence against scams that exploit confusion about those obligations.
It's also worth noting that the IRS has been aggressive about crypto enforcement through legitimate channels. The agency has sent genuine compliance letters to holders with unreported gains, and those letters follow a specific legal process. If you're uncertain whether a letter is real, the answer is always to verify through IRS.gov, not to comply first and ask questions later. For a broader look at how enforcement letters targeting crypto holders are being deployed, our coverage of fake IRS letters targeting crypto holders has additional context on identifying genuine versus fraudulent correspondence.
Scammers targeting crypto holders aren't limited to the US. Similar impersonation campaigns have emerged wherever regulators are increasing their crypto scrutiny. The pattern is consistent: fraudsters exploit the fear that taxpayers feel around compliance to extract credentials or payments. Staying informed about how legitimate agencies communicate is the clearest protection available.
Frequently Asked Questions
Is there a real IRS Digital Asset Compliance Portal?
No. The IRS has stated clearly that it does not operate a Digital Asset Compliance Portal. Any letter directing you to such a portal is fraudulent.
How did scammers get my name and address?
The IRS has not disclosed the source and IRS-CI declined to comment on how fraudsters obtained the personal details of crypto holders. Data breaches, publicly available blockchain data, and purchased data lists are all possible vectors, but no specific source has been confirmed.
If I scanned the QR code, what should I do?
Treat it as a potential data breach. Change your exchange passwords, enable two-factor authentication, move funds from any wallet whose seed phrase or private key you may have entered, and report the incident to phishing@irs.gov and to TIGTA. Contact your exchange directly to flag potential unauthorized access.
Does using a crypto tax calculator or crypto tax software put my data at risk from this scam?
This scam targets people through physical mail and QR codes, not through legitimate tax tools. Your data held in reputable services is not what this campaign is harvesting. The risk here is responding to the fraudulent letter itself.
What does a genuine IRS letter about crypto look like?
A genuine IRS letter will reference a specific notice number, cite the relevant Internal Revenue Code section, and direct you to IRS.gov for information. It will not ask you to scan a QR code, submit wallet credentials, or enroll in any portal. When in doubt, verify by going to IRS.gov directly or calling the number listed there.
Source: Journal of Accountancy