The Fake IRS Letter Now Comes With A QR Code

The scam is old-school paper with a modern trap. A letter arrives with an IRS logo, a deadline, and a QR code. One scan can hand a client's identity and crypto trail to criminals.

The Letter Looks Official On Purpose

The newest IRS impersonation scam does not start with a sketchy email. It starts with a paper notice that looks like government mail.

The letter tells crypto holders to enroll in a Digital Asset Compliance Portal before a deadline. That portal does not exist. The QR code sends the recipient to a fake IRS site and asks for personal information.

That is what makes this dangerous for tax pros. A client who expects IRS scrutiny on crypto activity may not treat the letter like obvious spam. They may treat it like a compliance fire drill.

The Website Is The Trap

The fake site is built to borrow the IRS brand, then push the client into giving up identity details. The goal is not only a bad payment. It is access, identity theft, and a cleaner path into the client's financial life.

Investigators said the campaign infrastructure was set up just days before the letters went out. The domain was listed through a Hong Kong registrar.

A Coinbase Security review said the look-alike site was hosted in Romania on a network already known for FedEx and banking phishing pages. That points to a professional international fraud operation, not a one-off fake letter.

This Lands On The Accountant Anyway

When the letter hits, many clients will not call the IRS first. They will send it to their CPA, bookkeeper, tax preparer, or controller and ask if it is real.

That creates a workflow problem. Firms need a fast way to route suspicious IRS letters, check them against official IRS channels, and tell clients not to use the contact details or QR codes printed on the notice.

This is especially important for clients with self-custody wallets, multiple exchanges, or older crypto records. Those clients already know crypto tax compliance is messy, so a scary IRS deadline can feel believable.

The Losses Are Already Huge

The broader crypto fraud numbers are ugly. In 2025, Americans lost more than $11 billion to crypto-related scams, up 22% from the year before.

The average loss was $62,604. There were more than 18,000 reports involving theft above $100,000.

That is why this is not just a client education note. For firms serving crypto clients, fake IRS mail is now part of the risk file.

The Fix Is Boring And Necessary

The best advice is simple. Do not scan codes from unexpected IRS letters. Do not enter personal information into a site reached from a notice. Do not call a number printed only on the suspicious letter.

Firms should give clients that warning before the next letter arrives. The scam works because the mail looks official and the deadline feels urgent. A clear policy gives clients one thing to do before they panic.