Fake IRS Letters Target Crypto Holders: How to Check Before You Act
IRS Criminal Investigation is warning about fake letters mailed to cryptocurrency holders using urgent deadlines, QR codes, and look-alike websites to harvest personal data and funds.
A fraud alert from IRS Criminal Investigation (IRS-CI) describes a mailing campaign aimed at cryptocurrency holders: official-looking letters and convincing websites that use urgent deadlines to push people into responding before they think. The practical takeaway for a household is simple: treat any unexpected letter about your crypto as unverified until you confirm it through a channel you chose yourself, not one the letter gave you.
The alert quotes IRS-CI Chief Jarod Koopman saying criminals "continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence," and advising people to "stop, verify the source, and report potential fraud schemes to law enforcement" before responding to unexpected requests for personal information.
What the alert actually says
The alert identifies a pattern rather than a single isolated letter. Fraudsters increasingly use convincing websites, official-looking letters, and urgent deadlines to trick victims (c03). The urgency is the mechanism, not a side detail: scammers create false urgency to push victims into quick decisions, and the alert's advice is to slow down and verify the situation (c05).
Specific instructions in the alert include:
- Don't scan QR codes from unsolicited letters, emails, or text messages, especially those claiming to be from a government agency (c04).
- Protect your personal and financial information, especially in response to unsolicited messages (c06).
- Never share wallet recovery phrases or private keys (c07).
- Consult a trusted family member, financial advisor, or attorney before sending money or making major financial decisions (c08).
- Monitor financial accounts regularly and report suspicious activity immediately (c09).
- Enable multifactor authentication on accounts (c10).
- Be cautious of new online acquaintances and verify identities before engaging further (c11).
- Report suspicious IRS-related communications immediately (c12).
Those items read as a list, but they fall into two different jobs. Some are about not handing over access — QR codes, personal data, recovery phrases. Others are about slowing a decision down long enough to get a second opinion, which matters for a household where one person may handle the tax paperwork and another may hold the wallet.
How the trail was traced
The alert notes that Coinbase and its partners at DarkTower traced the infrastructure behind this campaign to a domain registered through a Hong Kong registrar (c14). That domain was registered just days before the fake letters were mailed to crypto-holders (c15), and the site was hosted in Romania on a network known for hosting phishing pages fraudulently tied to financial institutions (c16).
This detail is worth holding onto for a reason beyond the specific campaign. A letter can look official while the website behind it was stood up days earlier. The alert frames the broader effort as a demonstration of the importance of public-private partnerships (c13), and points readers to Coinbase.com for additional details about the scheme (c17).
The verification habit that fits a household budget
The alert does not publish a phone number or a single official page to check, so the workable habit is procedural: if a letter asks you to act on crypto or tax information, stop, and reach the agency or exchange through a contact route you already use — a statement, a saved bookmark, a number from the agency's own site — rather than any contact the letter supplies.
That habit is cheaper than the alternative. A single shared recovery phrase, once handed over, is not something a family can reverse with a bank call. The alert's advice to never share wallet recovery phrases or private keys (c07) is the one rule that has no exception in the document.
Households that keep crypto alongside ordinary savings accounts may want to use the same second-set-of-eyes rule for both. The alert recommends consulting a trusted family member, financial advisor, or attorney before sending money or making major financial decisions (c08) — a step a family can pre-agree on while nothing is urgent, so the agreement still exists when a letter says it is.
What is confirmed and what is not
| Item | Status in the alert |
|---|---|
| Fake letters mailed to crypto-holders | Described as a campaign in the alert |
| Domain registered via a Hong Kong registrar | Traced by Coinbase and DarkTower, per the alert |
| Hosting in Romania | Stated in the alert |
| Registration timing relative to mailing | Stated as days before the letters were mailed |
The alert describes the campaign and the infrastructure findings; it does not present a count of victims, an amount of money lost, or a list of the specific letters recipients should match against. Readers who receive a letter should not assume that the absence of those details means the campaign has ended.
What the source does not say
- It does not state how many letters were mailed or how many people responded.
- It does not give a dollar figure for losses tied to this campaign.
- It does not tell readers how to confirm whether a specific IRS letter is genuine, beyond the general advice to verify through a trusted route.
- It does not say which tax years, states, or crypto holdings the letters referenced.
- It does not say whether any arrests or charges resulted from the tracing work.
- It does not give a timeline beyond the note that the domain was registered just days before the letters were mailed (c15).
The alert is a warning and a set of habits, not a closed case. For a household, the useful move is to make the pause automatic: unexpected letter, stop, verify through a route you chose, and tell someone else before anything is sent or shared.
Sources
Informational only. Not financial, legal or investment advice. Check the primary sources listed above before you act on anything here.