The IRS issued a public warning on July 30 about a scam that should make every crypto holder check their mailbox twice. Fraudsters are sending counterfeit letters designed to look like official IRS correspondence, complete with references to real tax years and urgent-sounding deadlines, all directing recipients to a “Digital Asset Compliance Portal” that doesn’t exist.

Here’s the thing: the IRS does not operate any such portal. The entire scheme is built to harvest personal data and, in some cases, trick people into transferring their digital assets directly to scammers.

How the scam works

The counterfeit letters arrive in plain envelopes. They reference tax years spanning 2017 through 2026, giving them the appearance of a legitimate compliance notice covering a taxpayer’s full digital asset history.

Each letter includes a QR code. Scanning it takes the recipient to a phishing site masquerading as an official IRS enrollment page. From there, victims are prompted to enter sensitive personal information or, worse, initiate transfers of their crypto holdings.

Coinbase flagged the threat two days before the IRS announcement. On July 28, the exchange published a consumer alert in collaboration with security firm DarkTower, detailing how the letters use realistic formatting to bypass skepticism.

Why the timing makes this worse

Since 2019, the IRS has been sending legitimate educational compliance letters to individuals suspected of underreporting their digital asset activities. The agency has steadily ramped up its scrutiny of digital asset reporting, and receiving mail from the IRS about your crypto is no longer unusual.

Scammers are banking on that familiarity. If you’ve already received one real letter from the IRS about your Bitcoin holdings, a second one asking you to “enroll” in a compliance program doesn’t seem outlandish.

How to protect yourself

The IRS has been clear about a few ground rules that should help distinguish real communications from fakes. The agency does not send QR codes in its official correspondence. If you receive a letter with one, that’s your signal to stop and verify before doing anything else.

Any legitimate IRS notice can be confirmed through the agency’s official website, IRS.gov, or by calling the number listed on that site, not the number printed on a suspicious letter. The IRS also does not ask taxpayers to transfer digital assets as part of any compliance process.

The IRS has clarified that it does not operate any Digital Asset Compliance Portal and has urged taxpayers to verify communications through official channels.

Coinbase’s alert offered additional practical guidance. The exchange and DarkTower emphasized that the letters’ use of plain envelopes and bureaucratic formatting makes them unusually convincing compared to typical phishing attempts, which tend to arrive via email with obvious spelling errors and suspicious links.

If you receive one of these letters, don’t scan the QR code. Don’t call any phone number listed in the letter. Go directly to IRS.gov and use the agency’s own tools to check your account status.