Fake IRS Letters Target Crypto Holders in Mail Scam

The Internal Revenue Service warned investors Thursday about a crypto scam that arrives by physical mail. Criminals are sending letters that direct taxpayers to register on a fake "Digital Asset Compliance Portal," the agency said. No such platform exists. The IRS advised people to avoid scanning QR codes or answering suspicious calls. Bloomberg reported the warning.

Physical mail is an unusual vector for crypto fraud. The shift shows attackers moving beyond phishing emails and social media to exploit the trust people place in government correspondence. The IRS said it does not solicit personal information through unsolicited mail.

The warning lands in a year when crypto hacks have already crossed $1 billion in the first half, according to chain analysis firms. Other scams this month include a $5.3 million fraud in the UK where three men impersonated police officers, and a SIM-swap ring in Poland linked to the on-chain sleuth ZachXBT. U.S. prosecutors also filed civil forfeiture complaints on July 21 to recover over $25 million tied to crypto scam networks.

For investors, the fake IRS letter is a reminder that any official-looking communication asking for wallet credentials or QR code scans should be treated as hostile. The agency said the only legitimate way to verify a tax notice is through its official website at irs.gov.

Wallet security is the first line of defense. Hardware wallets, cold storage, and multi-factor authentication reduce the risk of a single phishing link draining funds. Crypto market analysis shows that thefts from compromised accounts have been rising as fraudsters refine their methods.

Scammers are also targeting specific token holders. One XRP investor lost 14,646 tokens after interacting with a malicious message inside their wallet. The incident was reported by the security community as a drain attack masquerading as a network verification alert.

The IRS has increased its oversight of digital assets in recent years, requiring brokers to report transactions and issuing guidance on staking rewards. Attackers are using that familiarity to create urgency. A letter that threatens a tax penalty or demands immediate registration is designed to short-circuit a person's caution.

The best move is to ignore unsolicited mail and verify any notice directly through the IRS. For crypto holders, that means treating every inbound request for credentials or a QR scan as a potential attack until proven otherwise. Choosing a secure broker is one step, the real risk is at the wallet level.

No single scam defines the threat landscape. The pattern is diversification: physical mail, SMS, fake calls, malicious dApps. The IRS letter is the latest adaptation.