Fake IRS Mails Use QR Codes to Empty Crypto Wallets

How the Scam Works

You get an official-looking letter in the mail. It has the IRS logo, a convincing layout, and a QR code. Scan that code, and you land on a website that looks like a real government page. It asks you to enter your crypto wallet details and personal info to enroll in something called the non-existent "Digital Asset Compliance Portal."

There is no such portal. It is a fake, built just days before those letters went out, according to investigators.

Jarod Koopman, chief of IRS Criminal Investigation, put it plainly. "Criminals continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence." The scheme targets cryptocurrency holders specifically, hoping people will trust anything that looks like it came from the taxman.

Coinbase Security, in a blog post detailing the scheme, described it as a "professional, international fraud operation." The letters themselves are physically mailed, which adds a layer of credibility. The fraudulent site was operated from servers in Romania on a network "already known for hosting FedEx and banking phishing pages," according to the Coinbase Security blog post. The campaign's technical framework was established only a few days before the letters went out, and the domain name was registered through a Hong Kong registrar.

Get the market news that matters in a five-minute read with Market Briefs, our free daily newsletter

The Numbers Behind the Crisis

This is not a small or isolated problem. The FBI tracks cyber crime through its Internet Crime Report, and the 2025 numbers are staggering.

The catch: More than 18,000 separate reports came in of crypto thefts over $100,000 in a single incident. That means a lot of people are losing life-changing money. The FBI also noted that cryptocurrency and AI-related complaints are now among the costliest types of cyber crime they track.

The trend is going the wrong way. As more people move digital assets into their own wallets, scammers are getting more creative about how to reach them. A phishing email is easy to spot. A fake IRS letter in the mail is a different story.

What This Means for Your Portfolio

If you hold cryptocurrency, this scam is worth paying attention to. The IRS will never ask you to scan a QR code to verify your wallet or pay a tax bill that way. They will not send you a letter demanding you enroll in a "compliance portal" to unlock your assets.

The real IRS communicates through official channels, and they already have your tax information. Any unsolicited message that asks for your private keys or wallet passwords is a red flag, no matter how official it looks.

The scam infrastructure was set up "just days" before the letters were mailed, which means these operations move fast. By the time the IRS issues a warning, the scammers may already be onto the next variation.

For anyone with crypto, the safest move is to ignore any letter or message that asks for your wallet details or personal information - even if it has a government logo on it. If you are unsure, go directly to the IRS website yourself, not through a link or code someone sent you. One scan of the wrong QR code can drain your wallet before you realize what happened.

Join Market Briefs, our free daily newsletter, for a quick daily rundown of the markets