IRS Warns Cryptocurrency Investors of Phishing Scam Involving Fake Compliance Portal
The Internal Revenue Service and IRS Criminal Investigation have issued a warning regarding a scam targeting cryptocurrency holders through physical mail. Fraudsters are distributing letters that instruct recipients to register on a fraudulent website called the Digital Asset Compliance Portal before a set deadline. The revenue agency emphasized that no such portal exists within its official operations.
The physical letters prompt victims to scan an embedded QR code, which redirects users to a malicious web page created to imitate the official IRS website. The fraudulent portal attempts to extract sensitive personal identification, cryptocurrency wallet addresses, exchange account credentials, and other private financial information. Research conducted by cybersecurity firm DarkTower and cryptocurrency exchange Coinbase traced the web domain used in the scheme to a registrar based in Hong Kong and hosting infrastructure situated in Romania.
This fraudulent scheme directly impacts individuals who hold, trade, or transact in digital assets. While the agency occasionally includes QR codes on specific authentic correspondence, such as CP53E notices, agency representatives advise taxpayers to avoid scanning QR codes printed on unsolicited letters claiming to originate from government entities. Representatives for criminal investigation units declined to reveal the total scope of the scheme or how perpetrators acquired the physical mailing addresses of digital asset owners.
To maintain security and prevent unauthorized access to financial accounts, taxpayers should ignore links or QR codes embedded in unexpected tax correspondence. Individuals needing to check their filing status or verify official agency requests should directly navigate to the authentic agency website by manually typing IRS.gov into a web browser. Anyone who suspects they received fraudulent mail or surrendered credentials to an unauthorized site should immediately report the incident to law enforcement authorities.
Source: Journal of Accountancy
