IRS confirms fake letters with QR codes built to drain crypto wallets
It arrives by physical mail. Paper, letterhead, a case number and a list of tax years running from 2017 through 2026. It reads like a full review of your digital asset history. There is a QR code and a deadline. On July 30, 2026, IRS Criminal Investigation confirmed that the letter does not exist: it is a forgery built to walk you into an invented portal and take your exchange credentials.
The alert came from IRS Criminal Investigation and was picked up by Bloomberg Tax, Accounting Today and The Block, among others. The scheme is simple, which is exactly why it works: a physical letter styled like an official notice, announcing that you must enrol in a supposed "Digital Asset Compliance Portal" before a deadline. The QR code opens a site that copies the IRS.gov design. There, it asks for personal information, wallet details and, in some cases, login credentials for your exchange.
The reported specimens share several traits. They cite tax years 2017 through 2026, giving the impression of an audit covering your entire history with digital assets. They include a short deadline and the threat of penalties if you do not act. And the whole flow depends on a single gesture: scanning the code. The fraud infrastructure was registered through Hong Kong and hosted on Romanian servers already used in earlier phishing campaigns.
| Element of the letter | Why it is a red flag |
|---|---|
| A QR code to "enrol" | The IRS does not use QR codes in its notices to send you to a portal |
| A "Digital Asset Compliance Portal" | That portal does not exist. The IRS runs no enrolment register of that kind |
| A 2017 to 2026 range in the header | A genuine notice refers to specific tax years, not a whole decade at once |
| A very short deadline and threatening tone | Urgency is the core tool of fraud, not of tax procedure |
| A request for wallet data or keys | No tax authority asks for private keys or exchange credentials |
A fraud like this would have been implausible three years ago. Today it is not, and that is the important part of the story. In 2026 it is genuinely normal for a tax authority to write to you about cryptocurrency. Form 1099-DA is live, and custodial brokers, meaning centralised exchanges and digital asset payment processors, already report their customers gross proceeds to the IRS. On the international side, CARF, the extension of automatic information exchange to digital assets, has been in force since January 1, 2026, with the first exchange expected in 2027.
The most exposed profiles are predictable. First, anyone trading crypto on centralised exchanges with identity verification, because their physical address sits in a file that can leak or be cross-referenced with public records. Second, US persons living outside the United States, a group that already carries the sense of being permanently one step behind on its obligations and therefore reacts with more fear. And third, anyone with meaningful activity between 2017 and 2021 who never reported it cleanly: for that person the letter does not look like a fraud, it looks like the call they had been waiting for.
- Do not scan the QR code and do not call any phone number printed on the letter.
- Go to IRS.gov yourself, typing the address by hand, and check your account status with the agency own tools.
- If you have a US accountant or adviser, send them a photo of the letter before doing anything else.
- Report the letter to [email protected] and keep the original.
- If you already scanned the code and handed over data, change your exchange passwords immediately, revoke active sessions, and move funds if you shared anything connected to your wallet.
Do you know what the authority already sees?
Our AI co-founder reviews your tax residency, your structure and your digital asset exposure, and gives you a first read for free, with no obligation. If your case calls for it, the strategy session with a written opinion costs $449 USD.
Run my diagnosis →The entire engineering of this scam rests on one question the recipient cannot answer: what does the authority know about me? Someone with a clear answer reads the letter, spots the QR code and bins it. Someone without one scans. The technical defence, not opening links, checking domains, enabling two-factor authentication, is necessary but secondary. The real defence is knowing your tax position, what the platforms you use report, which country you are tax resident in and what that country expects from you.
That work, moreover, does not get done under pressure. Sorting out your tax residency, your structure and your digital asset reporting is a matter of weeks, not of the 72 hours a deadline letter gives you. The people who will fall for this fraud are, almost always, the same ones who had been postponing the conversation about their real situation for two years.
It is worth separating the fraud from the facts, because the facts also demand action. Form 1099-DA is operating and, in its first year, custodial brokers report gross proceeds only, without cost basis. Non-custodial brokers, such as decentralised exchanges and unhosted wallet providers, fall outside the scope of those rules for now. CARF started on January 1, 2026, and the first effective exchange of information between countries is expected in 2027. For a US person, the FBAR threshold of $10,000 in aggregate and the foreign earned income exclusion of roughly $132,900 for 2026 also remain in force.
None of that arrives by letter with a QR code. It arrives, when it arrives, through procedures you can verify on the official site and with your adviser. The gap between those two worlds is exactly where this fraud lives.
Frequently asked questions
Does the IRS really send paper letters?
Yes. The IRS communicates primarily by postal mail, and that is precisely why this forgery feels credible. The difference is in the content: a genuine notice identifies specific tax years, does not include QR codes to enrol in portals, and never requests exchange credentials or wallet keys. When in doubt, the correct route is to go directly to IRS.gov by typing the address by hand.
How do I know whether my exchange already reported me to the IRS?
If you trade on a centralised exchange with identity verification, it most likely did. Form 1099-DA requires custodial brokers to report their customers gross proceeds, and in its first year it does not include cost basis. You should receive a copy of the form. If you did not receive one and you traded during the covered period, ask the exchange for it and review your position with an accountant.
Does CARF mean my country already sees my crypto?
CARF has been in force since January 1, 2026 and extends automatic information exchange to digital assets, but the first effective exchange between jurisdictions is expected in 2027. In other words, the information starts being collected now and circulates later. Planning on the assumption that it will never be seen is, at this point, planning for the wrong scenario.
I live outside the United States, does this affect me?
If you are a US citizen or a green card holder, yes. The United States taxes on citizenship, so your filing obligations continue regardless of where you live, and that is why US persons abroad are a preferred target for this kind of fraud. If you are not a US person but trade on US exchanges, your exposure depends on your tax residency and on the information exchange agreement between your country and the United States.
I already scanned the code and gave up data, what now?
Act on the assumption that your credentials are compromised. Change the passwords on every exchange, revoke active sessions and devices, enable or reset two-factor authentication using an app rather than SMS, and review your whitelisted withdrawal addresses. If you shared anything tied to a wallet you control, move the funds to a new address. Then report the incident to [email protected] and keep the original letter.
Your first analysis is free
Answer a few questions and get a preliminary read on your case from our AI co-founder. No obligation, no sales calls.
Run my diagnosis →Keep reading
CRS explained: exactly what your bank reports to your home country Crypto wrench attacks hit a record: $124M in six months US citizens abroad: why moving doesn't stop the IRSThis content is informational and educational. It is not legal or tax advice. Verify current regulations and consult a specialist about your case before making decisions.