Fake IRS Letters Aimed at Crypto Holders: A Household Checklist
A practical guide to spotting fake IRS letters targeting crypto holders, protecting recovery phrases, and verifying and reporting suspicious mail as a household.
If a letter claims to be from the IRS and mentions your crypto holdings, treat it as suspicious until you verify it through a channel you already trust. The agency's fraud alert on this scam gives households a short set of rules: stop, verify the source, and report potential fraud.
The alert describes criminals creating official-looking correspondence and convincing fake websites, often with urgent deadlines, to pressure people into quick decisions. For a household with crypto balances, the practical response is a routine: slow down, check independently, protect keys, and involve someone else before money moves.
Why this scam is built for crypto households
IRS Criminal Investigation Chief Jarod Koopman said criminals "continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence." That framing matters because the scam does not rely on sophisticated crypto knowledge. It relies on the look of authority and the fear of a tax problem.
The alert warns that fraudsters increasingly use convincing websites, official-looking letters, and urgent deadlines. Urgency is the lever: it shortens the time between a household seeing the letter and acting on it.
The alert also notes that Coinbase and its partners at DarkTower traced the infrastructure behind this campaign to a domain registered through a Hong Kong registrar. The domain was registered just days before the fake letters were mailed to crypto-holders, and the site was hosted in Romania on a network known for hosting phishing pages fraudulently tied to financial institutions.
A household checklist for the first ten minutes
The goal is not to decode the letter. The goal is to keep the household from doing something irreversible while it checks. Use this sequence before anyone replies, calls a number on the page, or scans anything.
- Stop. The alert says to slow down and verify the situation, because scammers create false urgency to push victims into quick decisions.
- Do not scan. The alert says not to scan QR codes from unsolicited letters, emails, or text messages, especially those claiming to be from a government agency.
- Do not share keys. The alert says never to share wallet recovery phrases or private keys. No legitimate tax notice needs them.
- Protect information. The alert says to protect personal and financial information, especially in response to unsolicited messages.
- Bring in a second person. The alert recommends consulting a trusted family member, financial advisor, or attorney before sending money or making major financial decisions.
- Report it. The alert says to report suspicious IRS-related communications immediately, and Koopman's guidance is to report potential fraud schemes to law enforcement.
Verify without using the letter's own contact details
Verification only works if it goes around the sender. A phone number, web address, or QR code printed on an unsolicited letter is part of the letter, not an independent check.
A household can split the job: one person reads the letter and notes what it demands, while another person looks up the agency's official contact channels separately. The alert's instruction to verify the source fits this pattern, and it keeps a single anxious reader from making the call alone.
For crypto accounts specifically, the alert's account-hygiene points apply: monitor financial accounts regularly, report suspicious activity immediately, and enable multifactor authentication on accounts. These steps limit damage if a household member has already engaged with a fake site.
Spotting the pattern: legitimate notice vs. pressure campaign
The table below separates what the alert actually establishes from the household behaviors it recommends. It is a reading aid, not a legal test.
| Signal | What the alert says | Household response |
|---|---|---|
| Urgent deadline in correspondence | Fraudsters use urgent deadlines; scammers create false urgency | Slow down and verify the source |
| QR code in an unsolicited letter | Do not scan QR codes from unsolicited letters, emails, or text messages | Do not scan; verify separately |
| Request for personal or financial information | Protect personal and financial information, especially in unsolicited messages | Pause and involve a trusted person |
| Request for recovery phrase or private key | Never share wallet recovery phrases or private keys | Refuse, regardless of claimed sender |
| New online contact pushing the matter | Be cautious of new online acquaintances and verify identities before engaging further | Verify identity before continuing |
A short worked example: the Saturday letter
Hypothetical: a household opens a letter on a Saturday that claims to be from the IRS, names a crypto exchange, and gives a deadline of Monday morning to respond through a printed web address. Nobody in the household can reach the agency over the weekend.
The alert's guidance covers this gap without requiring weekend phone hours. The deadline is a pressure device, not proof of legitimacy. The household can photograph the letter for its records, avoid the printed address and any QR code, confirm that no recovery phrase was shared, and plan a call through official channels on the next business day. If the letter demanded a payment method or personal details, the alert's reporting guidance applies immediately.
What the source does not say
The alert does not state how many letters were mailed, which states or households received them, or whether any household lost funds. It does not list specific phrases, seals, or formatting that would let a reader authenticate a real IRS letter on sight.
It also does not say that every unexpected IRS letter mentioning crypto is fake. It gives behavior guidance for suspicious communications, not a definitive test. No personal tax position, filing status, or balance is addressed.
Finally, the alert notes that additional details about this fraud scheme can be found on Coinbase.com, but the public alert itself does not quantify the campaign's reach. Households should not treat a single letter as confirmation that a broader account compromise occurred.
What to keep in the household file
The alert closes by calling this fraud alert a demonstration of the importance of public-private partnerships. For a household, the durable takeaway is a written routine rather than a one-time reaction.
Keep a short record: the date a suspicious letter arrived, what it asked for, and whether anyone responded. Note who in the household is responsible for verifying and who is the second reviewer. Then revisit account settings, including multifactor authentication, and confirm that no recovery phrase has been stored where a letter or caller could reach it.
Koopman's guidance summarizes the whole approach: "Before responding to unexpected requests for personal information, stop, verify the source, and report potential fraud schemes to law enforcement."
Sources
Informational only. Not financial, legal or investment advice. Check the primary sources listed above before you act on anything here.