|
The 2026 filing season is approaching, and tax-related scams are already on the rise. Criminals know taxpayers are more likely to react quickly when a message appears that involves the IRS, a filing deadline, a refund or an unpaid balance. One of the newest schemes targets cryptocurrency holders with official-looking letters designed to steal personal information and digital assets.
In this scheme, a taxpayer receives what appears to be an IRS letter stating that cryptocurrency must be registered through a “Digital Asset Compliance Portal.” The letter includes a deadline and a QR code that leads to a fraudulent website made to resemble IRS.gov. The site may request personal information, cryptocurrency wallet details, exchange account credentials, recovery phrases or private keys. The IRS does not operate a Digital Asset Compliance Portal and is not sending these letters.
Even if you do not own cryptocurrency, this warning applies to you. The details of IRS scams may change, but the tactics are often the same: criminals create urgency, imitate official communications and direct taxpayers to a fraudulent website, telephone number or payment method. The same precautions that protect cryptocurrency holders can help every taxpayer recognize and avoid a scam:
Do not scan a QR code in an unexpected letter, email or text. We have long advised clients not to click unfamiliar links, open unexpected attachments, call a number provided in a suspicious message or reply with personal information. A QR code should be treated exactly like a link: scanning it can take you to a fake website or expose sensitive information before you realize the communication is fraudulent.
Know the warning signs. Be cautious of any unexpected communication that creates urgency, threatens arrest or loss of a license, demands immediate payment, requests personal or financial information, or directs payment by cryptocurrency, gift card, prepaid debit card or wire transfer. The IRS generally begins contact by mail, but a letter is not automatically legitimate simply because it includes an IRS logo, a notice number or your personal information.
Pause and verify before taking action. Do not use the telephone number, website or QR code included in a suspicious communication (letter, email, text, etc.). Do not respond, send payment or provide account credentials. Instead, independently verify the matter through a trusted source like logging into your IRS Online Account or calling the IRS directly at (800) 829-1040. If the communication involves cryptocurrency, never share a wallet recovery phrase or private key.
Most importantly, if you are uncertain whether an IRS letter, email, text message or telephone call is legitimate, contact your QRGA team member before replying or taking any other action. We can help you review the communication, confirm whether it is authentic and determine the appropriate next step.
|