New IRS Impersonation Scam Spotted in the Wild<\/p>\n\n\n\n
There is an old rule in Bitcoin: don\u2019t trust, verify.<\/strong><\/p>\n\n\n\n That principle usually gets applied to wallets, transactions and private keys. But it is just as important when dealing with the people and institutions trying to reach your crypto holdings.<\/p>\n\n\n\n A recent scam highlighted by Coinbase is a perfect example.<\/p>\n\n\n\n\n\n\n\n According to Coinbase Security<\/a>, scammers have been mailing physical letters designed to look like legitimate IRS notices. The letters tell cryptocurrency holders that they must enroll in something called a \u201cDigital Asset Compliance Portal\u201d<\/strong> and provide a QR code leading to a fake IRS-style website. The supposed portal does not exist.<\/p>\n\n\n\n The interesting part isn’t simply that criminals are impersonating the IRS. Scammers have been doing that for years.<\/p>\n\n\n\n What’s new\u2014and particularly concerning for Bitcoin holders\u2014is how well the attack combines traditional identity theft, crypto-specific targeting and social engineering<\/strong>.<\/p>\n\n\n\n Crypto scams are often imagined as anonymous hackers operating entirely online.<\/p>\n\n\n\n This one starts with a letter delivered to someone’s home.<\/p>\n\n\n\n That matters.<\/p>\n\n\n\n A physical letter can feel more trustworthy than an email or text message. It can contain a person’s real name and address, official-looking government language, a notice number and familiar Treasury or IRS branding.<\/p>\n\n\n\n The Coinbase investigation found that the letters were designed to look like genuine IRS correspondence and created urgency with a supposed compliance deadline. The QR code then moved the victim from the physical world into a carefully constructed online trap.<\/p>\n\n\n\n That is a powerful combination.<\/p>\n\n\n\n The letter establishes credibility. The QR code establishes the connection. The fake website collects intelligence. The phone call can become the actual theft.<\/strong><\/p>\n\n\n\n And that last step is where Bitcoin holders need to pay particular attention.<\/p>\n\n\n\n One of the most revealing details in the Coinbase report is what the fake website asks for.<\/p>\n\n\n\n Victims are reportedly prompted to identify their crypto exchange or wallet and estimate how much cryptocurrency they hold. The site can therefore learn whether someone uses Coinbase, another exchange, or a hardware wallet\u2014and potentially get an idea of whether the target is worth pursuing.<\/p>\n\n\n\n That’s a different way of thinking about a crypto scam.<\/p>\n\n\n\n The first objective isn’t necessarily \u201csend us Bitcoin.\u201d<\/strong><\/p>\n\n\n\n It can be:<\/p>\n\n\n\n \u201cTell us where your Bitcoin is.\u201d<\/strong><\/p>\n\n\n\n Once a criminal knows which platform you use, approximately how much you own and how to contact you, the next attack can be much more convincing.<\/p>\n\n\n\n That’s where vishing<\/strong>, or voice phishing, comes in.<\/p>\n\n\n\n A supposed exchange representative can call and claim that the victim needs to complete a security check, resolve a compliance issue or move funds to a supposedly protected wallet. Coinbase warns that attackers may attempt to obtain passwords, two-factor authentication codes or recovery phrases\u2014or convince victims to move cryptocurrency into wallets controlled by the criminals.<\/p>\n\n\n\n For Bitcoin users, that is the nightmare scenario.<\/p>\n\n\n\n The good news is that the basic defense hasn’t changed:<\/p>\n\n\n\n Never give someone your keys because they told you who they are.<\/strong><\/p>\n\n\n\n Not the IRS.<\/p>\n\n\n\n Not an exchange employee.<\/p>\n\n\n\n Not \u201cBitcoin support.\u201d<\/p>\n\n\n\n Not a compliance officer.<\/p>\n\n\n\n Not a security specialist.<\/p>\n\n\n\n Not someone claiming to be helping you recover stolen funds.<\/p>\n\n\n\n Your seed phrase is not customer-service information. Your password is not a verification code. Your two-factor authentication code is not proof of identity that you should read to a stranger over the phone.<\/p>\n\n\n\n And nobody legitimate needs you to transfer Bitcoin to a \u201csafe wallet\u201d that they provide.<\/p>\n\n\n\n The IRS itself warns taxpayers about impersonation scams involving unexpected messages, threats, demands for immediate payment and requests for personal or financial information. Its 2026 scam guidance specifically includes IRS impersonation by email and text as well as AI-enabled phone impersonation.<\/p>\n\n\n\n QR codes have become almost invisible in everyday life. We scan them at restaurants, businesses, events and parking meters without thinking twice.<\/p>\n\n\n\n That makes them useful to scammers.<\/p>\n\n\n\n A QR code is simply a shortcut to a destination. It does not tell you whether that destination is legitimate.<\/p>\n\n\n\n If a letter claims to come from the IRS and tells you to scan a QR code, don’t let the physical letter make the digital destination seem trustworthy.<\/p>\n\n\n\n Instead, go directly to IRS.gov<\/strong> yourself.<\/p>\n\n\n\n The IRS says taxpayers should be suspicious of unexpected communications that pressure them to act, request personal or financial information, or direct them to questionable websites.<\/p>\n\n\n\n The same principle applies to crypto exchanges.<\/p>\n\n\n\n If you receive a message claiming to be from your exchange, don’t use the phone number, QR code or website supplied in the message. Open your normal app or manually navigate to the company’s official website and contact support from there.<\/p>\n\n\n\n Don’t verify the message using the message.<\/strong><\/p>\n\n\n\n Verify it independently.<\/p>\n\n\n\n There’s sometimes a misconception that Bitcoin’s decentralized nature protects people from fraud.<\/p>\n\n\n\n It doesn’t.<\/p>\n\n\n\n Bitcoin’s blockchain can make transactions transparent and difficult to reverse, but it cannot prevent a person from voluntarily sending coins to a scammer.<\/p>\n\n\n\n That’s why Bitcoin security is partly a technical problem and partly a human one.<\/p>\n\n\n\n A sophisticated hardware wallet can protect a private key from malware. It can’t stop someone from voluntarily entering their seed phrase into a fake website.<\/p>\n\n\n\n A perfectly secured exchange account can have strong authentication. It can’t prevent a victim from reading a one-time code to a convincing impersonator.<\/p>\n\n\n\n The weakest link can still be the person holding the phone.<\/p>\n\n\n\n If you receive an alleged IRS notice concerning your cryptocurrency, slow down.<\/p>\n\n\n\n Don’t scan the QR code.<\/p>\n\n\n\n Don’t visit the website printed in the letter.<\/p>\n\n\n\n Don’t provide your exchange, wallet, holdings, phone number, password or other information.<\/p>\n\n\n\n Don’t call a number provided by the message.<\/p>\n\n\n\n Instead, independently visit IRS.gov<\/strong> and check your tax information through your official IRS account. The IRS provides an online account where taxpayers can view notices and balances.<\/p>\n\n\n\n If you have already interacted with a scammer, the IRS recommends immediately stopping communication, contacting your financial institution and taking steps to protect your identity and tax information.<\/p>\n\n\n\n For an IRS-related phishing message, the IRS also provides a reporting process for suspicious emails, texts, social-media accounts, phone calls and letters.<\/p>\n\n\n\n And if a crypto account may have been exposed, contact the exchange through its official<\/strong> support channel\u2014not through contact information supplied by the person who contacted you.<\/p>\n\n\n\n The most interesting thing about this scam isn’t that criminals found another way to impersonate the IRS.<\/p>\n\n\n\n It’s that they’re adapting their tactics to the realities of cryptocurrency ownership.<\/p>\n\n\n\n They know that Bitcoin holders may have substantial assets sitting behind a password, a hardware wallet or a seed phrase. They know that fear of tax authorities can be extremely effective. And they understand that getting someone on the phone can be more valuable than stealing information from a website.<\/p>\n\n\n\n That means Bitcoin security requires more than protecting a private key.<\/p>\n\n\n\n It requires protecting the information around<\/strong> that private key.<\/p>\n\n\n\n Where do you keep your Bitcoin?<\/p>\n\n\n\n Which exchange do you use?<\/p>\n\n\n\n How much do you own?<\/p>\n\n\n\n What phone number is associated with your account?<\/p>\n\n\n\n Who knows your wallet setup?<\/p>\n\n\n\n Those details can help a criminal construct a much more believable attack.<\/p>\n\n\n\n So the takeaway from the fake IRS \u201cDigital Asset Compliance Portal\u201d isn’t merely \u201cwatch out for fake IRS letters.\u201d<\/p>\n\n\n\n It’s broader:<\/p>\n\n\n\n Don’t confuse professionalism with legitimacy.<\/strong><\/p>\n\n\n\n A letter can look official.<\/p>\n\n\n\n A website can look perfect.<\/p>\n\n\n\n A caller can know your name and address.<\/p>\n\n\n\n A person can know which exchange you use.<\/p>\n\n\n\n None of those things prove that you’re talking to someone you can trust.<\/p>\n\n\n\n In Bitcoin, the old rule remains one of the best rules:<\/p>\n\n\n\n Don’t trust. Verify.<\/strong><\/p>\n\n\n\n And when someone wants access to your Bitcoin, verify independently\u2014before you click, before you call, and especially before you hand over the keys.<\/p>\n","protected":false},"excerpt":{"rendered":" New IRS Impersonation Scam Spotted in the Wild There is an old rule in Bitcoin: don\u2019t trust, verify. That principle usually gets applied to wallets, transactions and private keys. But it is just as important when dealing with the people and institutions trying to reach your crypto holdings. A recent scam highlighted by Coinbase is … Continue reading In Bitcoin, Looking Official Means Nothing<\/span> The scam starts with something surprisingly old-fashioned<\/h2>\n\n\n\n
The criminals don’t necessarily need your Bitcoin immediately<\/h2>\n\n\n\n
The most important Bitcoin security rule still works<\/h2>\n\n\n\n
QR codes deserve more skepticism<\/h2>\n\n\n\n
Bitcoin doesn’t make you immune to scams<\/h2>\n\n\n\n
What to do if you receive a letter like this<\/h2>\n\n\n\n
The bigger lesson for Bitcoin holders<\/h2>\n\n\n\n