Fake IRS portal letters are turning crypto tax anxiety into a phishing trap
A Coinbase Security and DarkTower investigation found mailed letters directing crypto holders to a look-alike compliance site. The safe response starts with the envelope, not the QR code.
By The Third AnglePublished 4 min read
An envelope icon used as an illustrative image. It does not depict the letters or website described in the report. Photo: paomedia / Wikimedia Commons · CC0 1.0
A new crypto phishing campaign is arriving by post instead of email. Coinbase Security, working with threat-intelligence firm DarkTower, warned on July 28 that scammers were mailing letters in plain envelopes to crypto holders and telling them to enroll in a supposed Digital Asset Compliance Portal, or DACP, before a deadline.
The letter uses the language of tax enforcement and includes a QR code. Scanning it leads to a look-alike website carrying an official-government banner and IRS-style branding. The site then asks visitors to identify where they hold crypto, including hardware wallets and major exchanges, before moving them toward requests for account or wallet information. There is no IRS Digital Asset Compliance Portal.
Coinbase's security report says DarkTower investigated the mailed letter, the look-alike domain and the infrastructure behind the campaign. That makes the warning more useful than a generic reminder about suspicious links: the delivery method and the fake process are part of the attack.
Why the timing can feel credible
Crypto tax reporting is becoming more formal. Coinbase's tax guidance says custodial brokers must report gross proceeds from covered digital-asset transactions on Form 1099-DA, with cost-basis reporting beginning for the 2026 tax year. A real compliance change gives a fraudulent letter a believable reason to exist, especially when it arrives with a deadline and a government logo.
The IRS's notice guidance gives taxpayers a safer route: use the notice number and instructions on the letter, then verify details through IRS.gov. Do not use a QR code, phone number or domain supplied by an unexpected message to reach a government account.
The practical response
Anyone who receives one of these letters should not scan the code, enter credentials or share a recovery phrase. The correct way to check a Coinbase issue is through the app or a typed official domain; the correct way to check an IRS notice is through IRS.gov. If information has already been entered, the priority is to contact the affected service through its real support channel, secure the account and treat any follow-up call claiming to be from an agency or exchange as part of the same campaign.
The scam's lesson is broader than this single domain. Tax rules can change, but a government agency does not need a crypto holder's seed phrase to verify a filing.
