What the Fake IRS Crypto Letter Looks Like

The fake IRS crypto letter is a single printed page styled as a notice from the Department of the Treasury, Internal Revenue Service, Austin, TX. It carries a CP14-style notice number, a tax year range of 2017 through 2026, an enrollment deadline, and a QR code.

It arrives in a plain envelope. It sits in the mailbox between a utility bill and a grocery flyer. Coinbase Security, working with the threat intelligence firm DarkTower, published the letter on July 28, 2026 after a customer reported it. Two days later, IRS Criminal Investigation issued its own alert.

The person who reported it is anonymous in every published account. For this post, call him Ray. Ray is not elderly and not careless. He stood in his kitchen with his phone in his hand and almost scanned the code. He got suspicious about the portal and made a phone call instead.

That report is the only reason the rest of the funnel was documented. Almost nobody stops.

Why a CP14 Notice Number Makes the Letter Convincing

CP14 is the most common notice the IRS mails. It is the first balance-due notice, sent when a taxpayer files a return and still owes money, and the IRS sends more than 8 million of them every year.

Anyone who has ever owed the federal government a dollar has probably held one. Somebody picked that number on purpose. They took the notice that reaches more American mailboxes than any other, put it at the top of a page carrying a real name and a real address, and added a deadline.

Coinbase notes the notice number and dates may change from letter to letter. The presence of a notice code does not verify a letter. Scammers copy real-looking numbers, Treasury addresses, and formatting because those details are exactly what a recipient checks first.

What Happens When You Scan the QR Code

The QR code on the fake letter leads to a lookalike domain, not irs.gov. The address is built so the letters I-R-S sit at the very front, with the real domain hiding behind them. Coinbase documented it as irs.digitalcomplianceportal[.]com.

On a phone screen at the end of a workday, it reads correctly. The page shows a blue banner reading "Official website of the United States government." The seal is right. The typeface is right. There is a "Get Started" button with a countdown to the enrollment deadline above it.

That leaves one open question. Does the phone ring later?

The Phone Call: How Vishing Turns a Phone Number Into a Stolen Wallet

Vishing, or voice phishing, is the follow-up attack that a data harvest like this sets up. Coinbase describes it as one of the most effective account-takeover techniques used against crypto holders today.

No transcript of a call from this campaign has been published. The pattern is well documented. The caller sounds calm, slightly bored, the way real government employees sound. He has your address because you answered a mailing. He knows your exchange from screen one. He knows roughly what you hold from screen two. You are not surprised he is calling because screen three told you he would.

Then he needs to verify the account. He asks for the code that just landed on your phone, or a password, or the twelve words.

The version that catches careful people works the other way around. The caller does not ask for your seed phrase. He gives you one. He says your wallet has been compromised, he is sorry, this happens more than people realize, and he will help you move everything somewhere safe right now. He reads you a fresh recovery phrase. You set up the new wallet and move your crypto into it with your own hands.

You hang up feeling like you handled it. You have transferred your entire portfolio into a wallet a stranger controls, voluntarily, and thanked him for it.

Nobody legitimate will ever ask you for a seed phrase. Nobody legitimate will ever hand you one. Not the IRS, not an exchange, not support. There are no exceptions.

Who Built the Scam

DarkTower traced the lookalike domain to a registrar in Hong Kong. It was registered days before the letters went in the mail. The site was hosted in Romania on a network already known for hosting phishing pages built to imitate banks and delivery companies.

This was not one person with a printer. It required physical mail, print production, address data on crypto holders, a cloned federal website, a scripted profiling funnel, and a call operation on the back end.

In the July 30 alert, IRS-CI Chief Jarod Koopman said criminals keep exploiting public trust in government agencies with fake websites and official-looking correspondence. Notice the direction this moved. Years of security training taught people not to trust email, so the attack went back to the mailbox, the one channel most people still believe.

Why a QR Code Does Not Prove an IRS Letter Is Fake

Real IRS CP14 notices have carried QR codes since October 2020. The IRS announced the change in news release IR-2020-233 so taxpayers could scan the notice and land on their own IRS.gov account instead of sitting on hold.

Those codes are on real notices today. Many warnings about this scam treat the QR code itself as the red flag. It is not. A QR code on an IRS letter does not prove the letter is fake.

When Ray stood in his kitchen, he was not looking at an obvious forgery. He was looking at the one notice number that reaches 8 million households, carrying the one feature the IRS itself spent nearly six years training people to trust. That is not luck. That is research.

The tell is not whether the code exists. The tell is where it goes. A real code lands on irs.gov. This one does not.

Real IRS Crypto Letters vs. the Scam

The IRS does send real letters about cryptocurrency. Letters 6173, 6174, and 6174-A are compliance letters sent to taxpayers with known digital asset activity, and CP2000 notices go out when what a taxpayer reported does not match what an exchange filed.

Those letters land in real mailboxes. CryptoTaxAudit's account team handles them every week. So the problem cannot be solved by assuming every IRS envelope about crypto is a scam.

It is solved by knowing what a real one never does.

• A real IRS notice never asks you to enroll or register your wallets or exchanges. There is no Digital Asset Compliance Portal. The IRS has stated flatly it does not operate one.
• A real IRS notice never asks which platform you use or how much crypto you hold. Tax reporting works from transaction records, not self-declared brackets.
• A real IRS notice never sends you to a website other than irs.gov. Any lookalike address is a fake, no matter how the page looks.
• Nobody from the IRS will call and ask for a code, a password, or a recovery phrase. Not to verify you, not to protect you, not for any reason.

If a letter does any of these, it is a scam.

How to Verify and Report a Suspicious IRS Letter

To verify an IRS notice, type irs.gov into your browser yourself and sign in to your IRS Online Account. Copies of IRS notices and any balance due appear there. If the notice is not in your account, do not act on the letter. Confirm through the contact details published on irs.gov.

Do not scan the code, not even to see where it goes. Curiosity is the attack surface.

Report it. File a tip with IRS Criminal Investigation at IRS.gov/submitatip (linked from the IRS-CI fraud alert), report the fake communication through the IRS impersonation reporting page, and file with the FTC at reportfraud.ftc.gov. Keep the letter and any screenshots.

The reason this scam works is not that the letter is perfect. It arrives on the one subject where many crypto holders already feel exposed. Reporting is messy. There were wallet transfers never reconciled. An exchange sent a form that was not fully understood and the return was filed anyway. When a letter shows up saying the government wants to fix something, part of the reader already believes it. The target is uncertainty, not intelligence.

Ray got lucky. He was suspicious of the right thing on the right day. The better position is one where a letter like that cannot move you at all, because you already know what your reporting looks like and who picks up the phone if the real IRS writes. That is what Tax Shield membership is built for.

Frequently Asked Questions About Fake IRS Crypto Letters