IRS warns fake crypto compliance portal scam

TLDR

The IRS has confirmed that mailed letters about a Digital Asset Compliance Portal for crypto taxes are a scam designed to steal your personal data and digital assets.

1. Scammers are sending fake IRS-style letters with QR codes that lead to a copycat Digital Asset Compliance Portal site that the IRS says does not exist.
2. The fraudulent site and follow-up calls try to collect where you hold crypto, how much you own, and sensitive login or recovery information to drain your accounts.
3. Crypto users should ignore these letters, avoid scanning QR codes, verify any IRS contact via IRS.gov, and report suspicious correspondence to official channels.

Deep Dive

1. What The IRS Actually Warned About

On 31 July 2026, the IRS issued a strong alert that criminals are mailing counterfeit IRS letters telling people to enroll in a Digital Asset Compliance Portal before an August 10 deadline. The agency states plainly that it does not operate any such portal and that these letters are not from the IRS.

According to reporting on the fake portal scam, the letters are designed to look like official IRS notices and specifically reference digital assets, aiming to exploit fear and confusion around crypto tax compliance.

2. How The Scam Works And Who It Targets

The letters include a QR code that directs users not to IRS.gov but to a lookalike domain, irs.digitalcomplianceportal[.]com, registered via a Hong Kong registrar and hosted on infrastructure associated with phishing campaigns. The page mimics a government portal and urges users to Get Started before the enrollment deadline.

Victims are asked where they keep their crypto, how much they hold, and then prompted for exchange approvals and phone numbers. A scammer posing as an IRS agent calls and attempts to extract passwords, two factor authentication codes, or recovery phrases to move the victims crypto to the scammers wallet. Coinbase has also warned users about this DACP scam, underscoring that it is broad based and not limited to large portfolios.

3. Practical Steps To Stay Safe

For crypto users, the key protections are simple but critical. The IRS does not ask for passwords, 2FA codes, or seed phrases, and it does not run a Digital Asset Compliance Portal. Any letter demanding portal sign-ups, QR scans, or urgent crypto disclosures should be treated as fraudulent.

Verify any tax-related communication directly on IRS.gov or through a known IRS phone number, never via links or QR codes in unsolicited mail or messages. If you receive such a letter, report it using the IRS tip page referenced in the warning and alert your exchange if you may have shared sensitive information.

Conclusion

This scam is a classic social engineering attack that uses the IRS brand and growing crypto tax scrutiny to pressure users into handing over access to their wallets and accounts. Crypto holders who stick to official IRS channels, ignore QR codes in unsolicited mail, and never disclose passwords or recovery phrases can sharply reduce the risk of losing funds to this kind of fraud.