IRS Warns Fake Crypto Letters Target Wallets and Personal Data

Fraudsters are mailing counterfeit IRS notices that direct cryptocurrency holders toward a fabricated compliance portal designed to capture sensitive financial information. The campaign targets wallet access, exchange credentials, identities, and digital assets through official-looking correspondence.

Each fraudulent letter contains a QR code directing recipients toward a website designed to resemble IRS.gov and collect valuable account information. The counterfeit portal may request personal details, cryptocurrency wallet information, exchange credentials, recovery phrases, private keys, or other data capable of enabling theft.

IRS Criminal Investigation (IRS-CI) Chief Jarod Koopman warned:

“Criminals continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence. Before responding to unexpected requests for personal information, stop, verify the source, and report potential fraud schemes to law enforcement.”

Crypto exchange Coinbase (Nasdaq: COIN) and cybersecurity firm Darktower traced the operation’s infrastructure to a domain registered through a Hong Kong registrar shortly before the letters circulated. Investigators found the website hosted in Romania on a network previously associated with phishing pages impersonating financial institutions, according to the agency.

Anyone who disclosed credentials should immediately change affected passwords, notify the relevant financial institution or cryptocurrency exchange, preserve messages and letters, and monitor accounts. The IRS also recommends multifactor authentication, while wallet holders should never disclose recovery phrases or private keys under any claimed compliance requirement.