IRS warns of physical mail phishing scams targeting crypto users

The Internal Revenue Service (IRS) has issued a warning regarding a sophisticated phishing campaign targeting cryptocurrency holders through physical mail. Scammers are sending counterfeit letters that impersonate the agency, often using official-looking headers and fake notice numbers to appear legitimate.

The fraudulent mail directs recipients to scan a QR code to access a non-existent ‘Digital Asset Compliance Portal’ (DACP). According to investigations by the Coinbase security team and threat intelligence firm DarkTower, the fake website is designed to collect specific information, including which cryptocurrency exchange a user employs, their approximate holdings, and their phone number.

Unlike traditional phishing that seeks immediate credentials, this method appears to facilitate ‘vishing’ (voice phishing). By gathering personal details and exchange information, scammers can later call victims while impersonating customer service representatives to solicit two-factor authentication (2FA) codes, passwords, or seed phrases. This tactic follows recent data breaches involving hardware wallet providers like Trezor and Ledger, which may have contributed to the availability of targeted user data.