Fake IRS letters are targeting cryptocurrency investors and digital asset owners, using official-looking correspondence and fraudulent websites to steal personal information, account credentials, and cryptocurrency holdings.

The Internal Revenue Service’s Criminal Investigation division (IRS-CI) recently issued a fraud alert warning taxpayers about a sophisticated scam involving a nonexistent “Digital Asset Compliance Portal.” According to the IRS, fraudsters are mailing convincing letters that appear to come from the agency and direct recipients to register through a fake portal designed to harvest sensitive information.

How the Scam Works

Victims receive what appears to be an official IRS letter stating that they must enroll in a “Digital Asset Compliance Portal” before a specified deadline. The correspondence typically includes a QR code that directs users to a fraudulent website designed to closely resemble IRS.gov.

Once on the fake website, users may be asked to provide:

• Personal identifying information
• Cryptocurrency wallet details
• Exchange account usernames and passwords
• Financial account information
• Other sensitive data that can be used for identity theft or theft of digital assets

The IRS has emphasized that it does not operate a Digital Asset Compliance Portal, and any correspondence suggesting otherwise is fraudulent.

Why This Scam Is Effective

Cryptocurrency investors are increasingly accustomed to receiving communications regarding tax reporting and compliance obligations. Scammers are exploiting this growing awareness by creating a scheme that sounds plausible and authoritative.

The fraud relies on three tactics commonly seen in phishing and social engineering attacks:

1. Official-Looking Communications

The letters are designed to resemble legitimate IRS notices and use government-style language to build credibility.

2. Fake Government Websites

Recipients are directed to websites that mimic the appearance of IRS.gov, making it difficult for unsuspecting taxpayers to identify the fraud.

3. Urgent Deadlines

Like many scams, the fraudulent letters create a sense of urgency by imposing registration deadlines, pressuring recipients to act quickly without verifying the legitimacy of the request.

Warning Signs to Watch For

If you receive a communication claiming to be from the IRS regarding cryptocurrency compliance, look for these red flags:

• Requests to register for a “Digital Asset Compliance Portal”
• QR codes directing you to external websites
• Demands for wallet recovery phrases, private keys, or exchange credentials
• Urgent deadlines requiring immediate action
• Requests for personal or financial information through unsolicited communications

Remember: The IRS does not ask taxpayers to provide cryptocurrency wallet credentials, private keys, or exchange passwords.

How to Protect Yourself

The IRS recommends taking the following precautions:

Do Not Scan Unsolicited QR Codes

Avoid scanning QR codes included in unexpected letters, emails, or text messages, particularly those claiming to come from government agencies.

Verify Directly With Official Sources

If you receive a suspicious notice, contact the IRS directly using information available on the official IRS website rather than through contact information provided in the communication.

Enable Multifactor Authentication

Use multifactor authentication (MFA) on cryptocurrency exchanges, wallets, and financial accounts whenever possible.

Protect Sensitive Information

Never share:

• Private keys
• Wallet recovery phrases
• Exchange login credentials
• Account verification codes
• No legitimate government agency will require this information.

Be Skeptical of Urgency

Scammers often rely on fear and urgency to bypass critical thinking. Take time to verify any request before responding.

What to Do If You Have Already Responded

If you believe you may have interacted with the fraudulent website or disclosed information:

• Stop communicating with the sender immediately.
• Change passwords for affected accounts.
• Contact your cryptocurrency exchange or financial institution.
• Preserve copies of the letter, screenshots, emails, and other evidence.
• Report the incident to IRS Criminal Investigation.

The Bottom Line

As digital assets become more mainstream, scammers continue developing increasingly sophisticated tactics to exploit taxpayer concerns about compliance and reporting obligations. The latest fake “Digital Asset Compliance Portal” scheme demonstrates how criminals use trusted government branding and realistic-looking communications to target cryptocurrency holders.

If you receive a letter instructing you to register for a Digital Asset Compliance Portal, do not respond. The IRS has confirmed that no such portal exists. When in doubt, verify communications directly through official government websites and trusted advisors.

Concerned about cryptocurrency tax reporting or digital asset compliance? Contact TRP Sumner for guidance on legitimate IRS reporting requirements and best practices for protecting your financial information.

This article is for informational purposes only and should not be construed as tax, legal, or investment advice. Consult a qualified professional regarding your specific circumstances.