A New Crypto Scam Is Using Fake IRS Letters and QR Codes To Steal Funds and Personal Information

Cryptocurrency scams are constantly evolving. From popular pump-and-dump schemes to fake wallet apps on legitimate app stores, there’s no shortage of threats that crypto users have to keep in mind. Now, there’s a new cryptocurrency scam doing the rounds.

Coinbase, in partnership with Dark Tower, has uncovered a new scam in which malicious actors are sending fake physical letters to citizens while impersonating the IRS.^[1]

The letter informs cryptocurrency holders that they must register on a Digital Asset Compliance Portal (DACP) before a given deadline. However, there’s no such enrollment requirement from the IRS, nor does any such portal exist.

Once you scan the QR code on the letter, you’re taken to a malicious website where scammers can harvest personal information such as your phone number, email address, and cryptocurrency wallet details. This is how phishing attacks operate, but the method of delivering the phishing link in this case is unique, and that’s what makes it dangerous.

Here’s a detailed rundown of how the scam works and the steps you can take to protect yourself.

Thanks for subscribing!

Please check your email for your first message.

Never miss the privacy news that affects you.

Join thousands who get the latest security news, scams, and policy changes every week, right to their inbox.

Sign me up

By submitting this form you agree to receive emails from All About Cookies and to the privacy policy and terms.

How the scam works

As per Coinbase’s discovery, the scam starts when a citizen receives a letter allegedly from the IRS. The letter contains a QR code, which users are instructed to scan in order to enroll in the DACP portal.

However, once you scan the QR code, you’re taken to a legitimate-looking, IRS-branded website. The website isn’t related to the IRS in any way, and the domain was registered through a Hong Kong registrar just days before these fake letters started arriving at citizens’ doorsteps.

According to Coinbase, the site is hosted in Romania on a network already known for hosting several phishing pages impersonating FedEx and banking providers. Here’s what happens next:

• As soon as you arrive on the website, it urges you to click "Get Started."
• The site asks you to select where you keep your cryptocurrency, such as a hardware wallet or an exchange like Coinbase. This is done so that the scammers know which platforms they need to impersonate when attempting to steal your funds.
• Next, the website asks you to reveal the estimated value of your cryptocurrency holdings in predefined ranges, going all the way up to $100,000. This allows the scammers to prioritize high-value targets.
• The portal then claims that it needs approval from your exchange and that you’ll be redirected to complete the approval process.
• However, the website then asks for your phone number and says that a representative will contact you to complete the verification process. This is where the real attack begins.
• You receive a call from a scammer posing as a legitimate support representative from the exchange you selected earlier. This is called vishing, or voice phishing.
• During the conversation, the scammer tries to convince you to reveal sensitive account information such as a one-time login code, your password, or your recovery or seed phrase. We saw a similar support scam in the recent Qantas data breach.

How scammers can exploit the data

Once the scammer has this information, they could log into your crypto wallet and steal your funds by transferring them to their own accounts.

Also, because the fraudulent website collects your name, phone number, and email address, hackers can launch targeted phishing attacks against you.

These links may install malware on your device or trick you into revealing additional personal information through fake login pages, causing further damage through identity theft or financial fraud.

What can you do to protect yourself

The IRS has warned cryptocurrency holders about the scam through an official press release.

Keep in mind that the IRS communicates only through official notices sent by mail. It’ll never ask you to enroll in a new program or request information about your cryptocurrency exchange through a phone call or a QR code.

Here are some additional steps you can take to stay safe from this and other phishing scams.

1. Never scan suspicious QR codes: If you receive any letter claiming to come from the IRS, do not scan the QR code on it, as it could lead you to a malicious website.
2. Inspect URLs: Make sure you’re on the official IRS website by carefully verifying the URL. Scammers often spoof domain names to closely resemble the actual website, hoping that users will overlook the slight variation. This is called typosquatting.
3. Protect your personal details: Never enter your personal information, such as your name, phone number, or cryptocurrency exchange credentials, on such websites. If you receive a call, email, or SMS from someone claiming to be an IRS representative, do not interact.
4. Do not move funds: Beware of anyone trying to convince you to move your funds to an allegedly "safe" wallet. In most cases, this is an attempt to steal your cryptocurrency.
5. Contact your exchange: If you have already shared your information, contact your exchange’s official support team immediately and explain the situation. Change your passwords and review your two-factor authentication (2FA) settings.
6. Keep an eye on your accounts: Monitor your financial accounts and cryptocurrency transactions over the next few months, and report any suspicious activity immediately.
7. Report the scam: You can report suspected IRS-related scams to the official IRS fraud portal or report the fraud to the Federal Trade Commission (FTC). Make sure you keep records of all communications and preserve screenshots and recordings of any conversations with the scammer.
8. Get an identity theft protection service: In case you’ve already shared sensitive data on a fake website, an identity theft protection service can help. It scans dark web marketplaces and stolen databases for your personal information. Many providers also offer identity theft insurance and identity restoration services.

Bottom line

Both Coinbase and the IRS have warned cryptocurrency users about an ongoing scam in which malicious actors impersonate the IRS by sending physical letters to cryptocurrency holders.

The letter instructs recipients to scan a QR code to register for a non-existent Digital Asset Compliance Portal (DACP). However, the QR code is a phishing front and takes users to a malicious website that collects personally identifiable information, including cryptocurrency exchange account details.

However, as intimidating as this scam may seem, it is relatively easy to avoid. Do not scan random QR codes on unsolicited letters or websites, and do not click on suspicious links received through emails or messages from unknown senders.

Remember, the IRS will never call you or ask you to scan a QR code to communicate with you. If you’ve already shared such sensitive information with unknown parties, contact your exchange and report the fraud to the IRS and the FTC.

4.8

AllAboutCookies writers and editors score products based on a number of objective features as well as our expert editorial assessment. Our partners do not influence how we rate products.

Editorial Rating

Get Deal

On Aura Identity Theft's website

2026 Editors’ Choice

Best Overall Identity Theft Protection Service

Identity Protection

Aura Identity Theft

PROMOTION: Save Up to 68%

• ID theft protection that monitors your SSN, bank accounts, credit cards, and brokerage and retirement accounts for suspicious activity
• Every plan includes the full feature set, so no additional cost to unlock monitoring, insurance, or restoration
• Bundles data removal with identity theft protection, antivirus, VPN, and a password manager in one subscription

Author Details

Krishi Chowdhary

About the Author

Krishi Chowdhary specializes in digital privacy, cybersecurity, and consumer technology. He has written extensively on online privacy tools and broader cybersecurity topics, including online scams, data breaches, age verification, and emerging digital threats. Krishi believes technology reporting should empower readers, not confuse them, and is committed to making even the most technical subjects easy to understand without compromising on accuracy or depth. His work has appeared in leading technology publications, including CNET, ExpressVPN, and TechRadar, where he has covered topics ranging from cybersecurity incidents and privacy product announcements to artificial intelligence and major technology news