Fake IRS Letters Target Crypto Holders: How to Verify and Respond
A fraud alert warns that fake IRS letters are targeting cryptocurrency holders. Here is what the warning establishes, what it leaves open, and how households should respond.
A fraud alert from IRS Criminal Investigation (IRS-CI) warns that fake letters imitating the agency are being used to target cryptocurrency holders. The confirmed useful answer is simple: if an unexpected letter, email, or text claims to be from the IRS and pushes you toward a QR code, a payment, or your wallet credentials, stop and verify through a source you chose yourself rather than one the message gave you.
The alert is a warning about a pattern, not a notice that any specific household has been contacted. It describes criminals building convincing websites and official-looking correspondence to exploit public trust in government agencies. That framing comes directly from IRS-CI Chief Jarod Koopman, who said criminals "continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence."
What the alert actually says
The alert identifies several mechanisms, not one. Fraudsters increasingly use convincing websites, official-looking letters, and urgent deadlines to trick victims. The urgency is a tool: scammers create false urgency to push victims into quick decisions, and the alert's advice is to slow down and verify the situation.
On the crypto-specific side, the alert is direct: never share wallet recovery phrases or private keys. It also warns against scanning QR codes from unsolicited letters, emails, or text messages, especially those claiming to be from a government agency. Those two points matter for households because a recovery phrase or a scan can move value or access in one step, with no bank reversibility in the background.
The alert also lists broader precautions: protect personal and financial information, especially in response to unsolicited messages; enable multifactor authentication on accounts; monitor financial accounts regularly and report suspicious activity immediately; and be cautious of new online acquaintances, verifying identities before engaging further. Koopman's quoted guidance is to "stop, verify the source, and report potential fraud schemes to law enforcement."
The infrastructure behind the campaign
The alert says Coinbase and its partners at DarkTower traced the infrastructure behind this campaign to a domain registered through a Hong Kong registrar. The domain was registered just days before the fake letters were mailed to crypto-holders. The site was hosted in Romania on a network known for hosting phishing pages fraudulently tied to financial institutions.
Those details are useful because they describe a sequence: a domain registered shortly before mailing, hosted on a network associated with financial-institution phishing. For a reader, the takeaway is not to trust a web address because it appears in a letter; the infrastructure can be stood up days before the mail arrives. The alert frames the overall effort as demonstrating the importance of public-private partnerships, but it does not publish an arrest, a charged defendant, or a count of victims.
A worked example for a household
Hypothetical: a household receives a letter citing an urgent tax matter, printed with an IRS-style header and a QR code, and the letter warns that a response is required within a short deadline. The alert's guidance maps to a sequence rather than a single check.
- Do not scan the QR code. The alert specifically says not to scan QR codes from unsolicited letters, emails, or text messages, especially those claiming to be from a government agency.
- Do not reply with personal or financial information, wallet recovery phrases, or private keys.
- Slow down. Treat the deadline as a pressure tactic, because the alert says scammers create false urgency.
- Verify the source independently, and consult a trusted family member, financial advisor, or attorney before sending money or making major financial decisions.
- Report the suspicious IRS-related communication immediately.
The alert does not provide a phone number, a mailing address, or a specific reporting form for this campaign. It says to report suspicious IRS-related communications immediately, but the mechanics of where and how to report are outside what the alert text establishes here. Readers should reach the agency through a channel they look up themselves, not one printed on the suspicious document.
Why this is a household budgeting issue
Households that hold crypto alongside cash and regular bills face a specific asymmetry. A fraudulent bank transfer can often be disputed through the bank. A wallet recovery phrase handed over, or a malicious QR code that initiates a transfer, does not carry the same built-in reversal path. The alert's emphasis on never sharing recovery phrases or private keys, and on enabling multifactor authentication, reflects that difference.
The alert does not estimate losses from this campaign, does not provide a victim count, and does not state whether the letters were mailed to a particular region or taxpayer category. It also does not say whether the domain traced by Coinbase and DarkTower has been taken down, or whether anyone has been charged. Those gaps matter for readers trying to judge whether a letter they received is part of this specific campaign or a different one.
What the source does not say
The alert does not establish that any particular letter is genuine or fake, does not publish a list of affected taxpayers, and does not state a dollar amount of losses. It does not describe the exact wording of the fake letters or the QR code destinations. It does not say whether the campaign is active, paused, or concluded as of the alert date. It does not say whether the traced domain has been seized or whether investigations have led to arrests or charges. It also does not specify how a reader should confirm an IRS contact through official channels beyond the general instruction to verify the source.
Readers should treat any letter, email, or text that combines an IRS claim, a deadline, a QR code, and a request for personal or crypto information as a verification task rather than a compliance task. The alert's own advice is to stop, verify, and report.
Sources
Informational only. Not financial, legal or investment advice. Check the primary sources listed above before you act on anything here.