Fraudsters are mailing fake IRS letters to cryptocurrency holders in a scheme using a bogus website that aims to steal taxpayers’ personal information and digital assets, the IRS Criminal Investigation unit said in a fraud alert last week.
The fake letters direct recipients to a fraudulent website that mimics IRS.gov and instructs them to register for a nonexistent “Digital Asset Compliance Portal.” The IRS is telling anyone who has received this letter not to respond.
“The IRS did not send it. The IRS does not operate a Digital Asset Compliance Portal. This is a scam,” IRS-CI said.
In a statement, IRS-CI Chief Jarod Koopman added, “Criminals continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence. Before responding to unexpected requests for personal information, stop, verify the source, and report potential fraud schemes to law enforcement.”
Victims receive what appears to be an official IRS letter claiming they must enroll in the fake portal before a deadline. The letter instructs them to scan a QR code that directs them to a fraudulent website designed to look like IRS.gov. The site may ask for personal information, cryptocurrency wallet information, exchange account credentials, or other sensitive data that criminals can use to steal identities or digital assets, the tax agency says.
According to IRS-CI, online cryptocurrency platform Coinbase and cybersecurity firm DarkTower traced the infrastructure behind this scheme to a domain registered through a Hong Kong registrar. The domain was registered just days before the fake letters were mailed to crypto holders. The site was hosted in Romania on a network known for hosting phishing pages fraudulently tied to financial institutions.
Additional details about this fraud scheme can be found on Coinbase.com.
IRS-CI provided the following tips for crypto holders to protect themselves and their digital assets from scammers:
- Don’t scan QR codes from unsolicited letters, emails, or text messages, especially those claiming to be from a government agency.
- Hang up if someone claims to be from a government agency and asks for payment or personal information. Contact the agency directly using information from its official website.
- Slow down and verify the situation; scammers create false urgency to push victims into quick decisions.
- Protect your personal and financial information, especially in response to unsolicited messages. Never share wallet recovery phrases or private keys.
- Consult a trusted family member, financial advisor, or attorney before sending money or making major financial decisions.
- Monitor financial accounts regularly and report suspicious activity immediately. Enable multifactor authentication on accounts.
- Be cautious of new online acquaintances and verify identities before engaging further.
- Report suspicious IRS-related communications immediately.
Officials say if you or someone you know has been impacted by a fraud scheme, stop communicating with the fraudster; change passwords for affected financial accounts; contact your financial institution or cryptocurrency exchange immediately if you shared credentials; preserve screenshots, emails, and letters; and report information to IRS-CI at IRS.gov/submitatip.
Photo credit: starline/Freepik
Sign in to get access to this free resource, and all of our whitepapers and reports.
Download this content today!
Register Now Already registered? Click here to Log In
