France: Fake DGFiP mail targets crypto holders via phishing

A sophisticated phishing campaign is targeting taxpayers in France using fraudulent paper mail that impersonates the Direction générale des Finances publiques (DGFiP). The scam specifically targets cryptocurrency holders by presenting a fake “formal notice” to declare digital assets, including exchange platforms, wallets, and DeFi protocols.

The fraudulent documents use official logos and administrative language to appear authentic. They instruct recipients to scan a QR code to access a fake digital asset portal, threatening heavy fines and interest penalties if compliance is not met by a specific deadline. Because the scam uses physical mail, it bypasses traditional digital spam filters.

Reports indicate that the targeting of these individuals may be linked to a massive data breach at Colis Privé in January 2026, which exposed the personal information of millions of customers. Cybersecurity experts note that while the targeting appears broad across France, the use of leaked data allows for highly credible and deceptive fraudulent communications.