The Counterfeit IRS Letters Are Real. The QR Code Is the Lie.

It starts with a plain envelope. No tracking number, no wax seal, no obvious warning that the small white rectangle in the corner is the most dangerous thing you can scan between coffee and a spreadsheet. Inside, on official-looking paper, there is a Department of the Treasury logo, a notice number, a list of tax years stretching from 2017 to 2026, and a message that reads like a gentle but urgent invitation: scan this code to verify your digital assets on the IRS compliance portal. That portal does not exist. The letter is counterfeit. The QR code is a one-way ticket to a phishing operation that has already been connected to infrastructure used in FedEx and banking scams. The warning came this season from IRS Criminal Investigation, and the details were published in the same blunt, unadorned language that security agents use when they know exactly how much money is about to disappear. I have been tracking phishing infrastructure in the Web3 space for years, and the first thing I noticed about this campaign was not the technology. It was the timing. The letters were designed to land in mailboxes during the period when crypto holders feel most exposed: right before filing deadlines, when the memory of underreported gains or an unaired Coinbase tax summary becomes a low-grade panic. The scammers did not have to invent a story. They just borrowed the one the government had already spent years telling. When the IRS first began sending educational letters to taxpayers who held virtual currency, back in 2019, the reaction inside the crypto community was a strange mixture of relief and dread. Relief because the letters were, at least initially, educational. Dread because the IRS had clearly begun to map the contours of a market that many people still believed was anonymous. Those early letters did not demand money. They did not ask for payment. They simply reminded taxpayers that virtual currency transactions are taxable, that reporting is a legal obligation, and that the IRS intends to take enforcement seriously. That made them perfect. Because a scammer does not need to create a new source of authority. They need only copy an existing one. An IRS letter about crypto is now a familiar object. It has been normalized by years of genuine government outreach, by tax software breadcrumbs, by legal analysts explaining what a CP notice is, and by the slow, bureaucratic creep of the 1099-DA broker reporting regime. The counterfeit letter is not terrible imitation. It is fluent mimicry of a genre that the IRS itself forged. The attack chain is a masterclass in layered trust. The first layer is physical: a letter that arrives in the ordinary mail, carrying official insignia, a notice number, and a range of tax years that feels plausible to anyone who has traded crypto across multiple cycles. The second layer is the QR code, which replaces a URL with a silent icon that modern users have been trained to scan without thinking. The third layer is a fake digital asset compliance portal, hosted on a domain that is not irs.gov, registered through a Hong Kong registrar, and pointed at a Romanian server. The fourth layer is a phone call. An actual human being, using the word special agent, asking you to confirm the one-time code that your exchange just sent you. If you have ever read the official statement of Jarod Koopman, the executive director of IRS Criminal Investigation, you will notice that he says something far more useful than most corporate security advisories. The IRS does not send unsolicited QR codes through the mail. The IRS does not ask you to tell it which exchange or hardware wallet you use, or to provide an estimate of your holdings, or to call a number that is printed on the letter itself. The IRS already has a secure way for you to check the authenticity of a notice: log in to your irs.gov online account. Everything else is not the IRS. Everything else is a story. One of the reasons this campaign feels so new is that it is not really new at all. The technology is recycled. QR codes have been used in phishing since they became a standard feature of restaurant menus. Domain impersonation has been around since the beginning of the internet. Telephone call centers have been the backbone of tax fraud for decades. What is original is the precise composition of the parts. The scammer has assembled a routine set of tools into a bespoke phishing pipeline that targets the exact moment when a crypto holder cannot distinguish between a government warning and a private nightmare. And because the attack resides in paper mail, it bypasses most of the automated filtering that has become effective at stopping email phishing. No sender domain to check. No link to hover over. No SPF record to inspect. Just a white square on a page, and the quiet assumption that a letter from the Treasury is a thing you respond to. In my own security research, I have audited phishing infrastructure that relied on domains registered minutes before the first email went out. This campaign is different because the domain was registered only a few days before the letters were mailed, and the registration and hosting were deliberately split across jurisdictions. Hong Kong for the registrar. Romania for the server. The United States Postal Service for the delivery. This is the kind of fragmentation that makes takedown requests slow and attribution nearly impossible. It is not a sign of technical sophistication. It is a sign of operational discipline. The attacker understood that the risk was not in building a system that could not be traced; the risk was in building a system that could not be explained away. The use of QR codes deserves special attention. As a medium, a QR code is completely silent. It does not reveal the destination until it is scanned. It does not create a record in a mail filter. It does not trigger the habitual caution that comes when you see a strange URL in a text message. Instead, it leverages a decade of consumer training. We now scan QR codes for menus, for event tickets, for payment screens, for Wi-Fi access. The physical gesture has become reflexive. Scanning is an act of trust, and the attacker has simply outsourced the moment of caution to a phone camera. There is also a subtle psychological trick in the structure of the fake portal. It does not ask for your private key in the first step. It asks for the type of exchange or hardware wallet you use. Then it asks for an estimate of your holdings. Then it asks for your telephone number. This is reconnaissance dressed up as compliance. The questions are easy to answer. They feel like a security questionnaire, not an armed robbery. By the time the conversation reaches the point where a code or recovery phrase is requested, the victim has already performed a series of small, voluntary disclosures that make refusal feel inconsistent. That is the grammar of social engineering: every question builds on the last one until the final request feels natural. Now think about the phone call. In the old model of phishing, the email was the entire attack. It said, click here, enter your password, goodbye. In this campaign, the email is replaced by the letter and the QR code, and the phone call is the emotional completion of the attack. When a victim scans the code and enters their information, the attacker has their phone number. The call that follows is a confirmation ritual. The person on the other end is calm, professional, possibly even sympathetic. They say they are from IRS Criminal Investigation. They ask you to verify a code you received from your exchange. If you comply, the attack is complete. The code, or the recovery phrase, is not a tax issue anymore. It is access. What the public tends to miss is that this type of attack has an extraordinarily high floor and a terrifyingly low ceiling. The floor is high because the letter is physically present. It does not need to pass a spam filter. It does not need to be opened in a specific email client. It can lie on a kitchen counter for a week, silently gathering authority. The ceiling is low because the attacker does not need to break encryption, exploit a smart contract, or steal tokens from a hardware wallet. They only need the victim to hand over the recovery phrase. Once that phrase is in the attacker’s hands, the entire self-custody model collapses. The tokens do not disappear through a vulnerability in a DeFi protocol. They disappear through a mistake in an analog transaction between a frightened taxpayer and a well-rehearsed imposter. The infrastructure details in the original advisory are worth examining closely. The warning came through IRS Criminal Investigation, but the initial samples were shared publicly via Coinbase’s blog, which means the first line of defense for this particular attack was not a government security operations center. It was the support ticketing system of a centralized exchange. That is an uncomfortable fact for an industry that often likes to pretend that trustlessness is a substitute for security. The technology is trustless. The humans are not. When I think about this campaign, I keep returning to a phrase that is central to how I understand crypto and the people who use it: the story is not in the token, it is in the trust. The counterfeit letters were not successful because of a clever line of code. They were successful because they moved through the one channel where trust has not yet been automated: the mailbox. The email revolution pushed us to build spam filters, phishing filters, sender authentication, and a million little shields for the digital world. Paper mail skipped all of them. The story of this attack, if you trace it all the way down, is also the story of the regulatory treadmill. In a bull market, narratives move fast. Tax compliance is not a thrilling story to tell over drinks. But the IRS is now a central character in the crypto economy. The 1099-DA reporting rule will soon give the IRS a more complete picture of the gains and losses of every taxpayer who used a crypto broker. This is supposed to make tax enforcement easier. It will also make the scam merchant’s job easier. Every new regulation is a new template for impersonation. Every official notice is a new design pattern to copy. The more the government insists on formal correspondence, the more the mailbox becomes a battlefield. Let me walk you through the attack from the perspective of a victim, because that is where the technical details become human. Imagine you receive a letter that says it is from the IRS Digital Asset Compliance division. It is addressed to you by name. It cites tax years 2017 through 2026. It says that a routine review of your virtual currency transactions has identified a potential reporting discrepancy. It asks you to scan the QR code within 48 hours to verify your portfolio and provide information about your accounts. The label urgent is printed in bold. The notice number at the top looks official. The letter states that failing to respond may result in a penalty, or worse, referral to criminal investigation. Most people do not know what a real IRS notice looks like. That is precisely the point. The IRS has spent years telling crypto holders that digital assets are not anonymous, that tax obligations exist, and that enforcement is coming. The letter taps directly into that recorded message. The victim’s first thought is not is this real? It is did I make a mistake? That is the moment the attacker wins. The scam operates on the anxiety that a taxpayer might have forgotten to report a wallet, might have missed a threshold, might have neglected to include a staking reward, might have done something wrong. The psychological vulnerability is not in the code. It is in the ambiguity of the reporting system itself. The QR code, once scanned, opens a page that looks professionally built. It has a seal. It has a banner about online security. It asks you to select your exchange from a list. It asks whether you use a hardware wallet. It asks how much you hold. It asks for your phone number. All of these fields are designed to feel like a security audit. The final screen asks you to verify your identity by entering a code that will be sent to your phone, or to enter your wallet recovery phrase. If the victim gets that far, the attacker now has everything needed to drain the accounts that the victim just helpfully listed. The phone call, if there is one, is the part that I find most chilling. The caller says they are from IRS Criminal Investigation. They reference the notice number from the letter. They sound calm and reassuring. They say that the review can be resolved quickly, but that the taxpayer must cooperate now. In the background, perhaps, there is a faint sound of a call center. The victim, already exhausted by taxes and terrified by the wording of the letter, hands over the code. The attacker finishes the call with a polite goodbye. The money is gone before the victim understands what happened. If you think about this as a security engineer, the obvious question is: why does the IRS allow paper letters to be the canonical form of official communication? Why is there no standardized cryptographic signature on every government notice? Why does a taxpayer have to log in to irs.gov and compare the letter with a database of real notices, instead of having a public key registry that everyone can verify? The answer is that government systems move slowly. But the lack of a public verification layer is not just an inconvenience. It is a vulnerability that attackers can exploit again and again. The counterintuitive insight is that the IRS itself is an unwilling accomplice in this fraud. By sending legitimate educational letters to crypto holders, the government trained a generation of taxpayers to look for certain visual cues: the Treasury logo, the notice number, the formal language, the warning about penalties. Every real letter makes the fake letter more plausible. Every real enforcement action lends weight to the parasitic copy. If the IRS sends a hundred thousand letters to crypto holders, and a scammer knows the exact template, the scammer only needs to reach a fraction of the same audience. This is what I mean when I say the story is not in the token, it is in the trust. The cryptocurrency industry has built sophisticated authentication for transactions. It has multisignature wallets, hardware security modules, threshold signatures, and verifiable data structures. But the human side of the system still relies on trust as a fuzzy, non-transferable property. A website can be inspected. A smart contract can be audited. A letter’s emotional authority cannot be audited, because the authority is supplied by the reader’s fear. The best defense against this class of attack is not a new wallet or a hardware plugin. It is a new cognitive habit. The habit is simple: if an instruction asks you to verify something, do not use the channel that the instruction provides. When you receive a letter that asks you to scan a QR code and log in to a compliance portal, the correct response is to close the envelope, open a browser directly, and log in to the official irs.gov online account. If the notice is real, it will be there. If it is not real, the fake portal will remain stranded in a server somewhere in Romania, waiting for a victim who never arrives. The IRS also asked people to report the scam. That is an underappreciated part of the defensive toolkit. Reporting fraudulent letters to both IRS Criminal Investigation and the Federal Trade Commission generates a pattern database that can be used to identify other campaigns before they mature. But reporting is a communal act, and it requires a level of energy that many victims do not have after they have nearly given away their life savings. The industry needs to make reporting as easy as scanning the QR code. Right now, the attacker’s path is more efficient than the defender’s path. That asymmetry is a strategic problem, not a technical detail. Let me talk about sentiment for a moment, because I have spent a significant part of my career listening to crypto users talk about their fears. The technical data around tax season is only part of the picture. If you look at search volume for queries like IRS crypto letter or how to report crypto, you will see sharp spikes around tax deadlines. If you look at the forums, you will see a different kind of signal. People do not search because they are curious. They search because they are afraid that they have done something wrong without knowing it. The counterfeit letter is a perfect instrument because it converts that vague background fear into a specific, immediate action. I remember the lessons I learned moderating a large crypto community during the 2020 cycle, when users were frantic about yield farming and rebasing tokens. The anxiety was never really about the protocol math. It was about the feeling of being left out of some secret knowledge. The solution was not to explain the math more clearly. The solution was to make the user feel seen and supported. Scammers understand this better than most legitimate projects. They know that a victim who feels isolated is easier to move. The IRS letter scam replicates that dynamic on a paper document. It says we have your name, we know your activity, and we are watching. It creates a sense of exposure that is perfectly calibrated to the privacy expectations of crypto users. There is another layer to this that deserves attention. The attackers reused infrastructure that had previously hosted phishing pages for FedEx and banks. This detail suggests that the crypto tax scam is not a one-off project. It is part of a recurring, multi-brand phishing operation. The same call centers, the same domain templates, the same hosting accounts, and the same payment channels are likely being used for several verticals at once. The IRS, the package carrier, and the bank are different masks worn by the same organization. If you track the infrastructure, you start to see a web that connects logistics scams, banking fraud, and crypto theft. This is not amateur hour. It is an industrial-scale impersonation economy. For the crypto industry, the lesson is humbling. We like to believe that decentralized finance is a leap forward because it removes intermediaries. But the reality is that the most important security properties are still intermediary properties. The exchange that notices suspicious activity, the tax software that warns you about a fake notice, the human moderator who tells you not to send your recovery phrase to a stranger: these are intermediaries in a very real sense. The counterfeit letter attack succeeds precisely because the decentralized world has not yet built a trusted channel for official communication. The blockchain tells you the history of a token. It does not tell you whether a letter from the Treasury is a lie. The next wave of attacks will be worse. Artificial intelligence will make the fake portals more polished. Personalization will make the letters more convincing. If the attacker has access to a public wallet address, they can tailor the letter with a history of the wallet’s balances and transactions. If they have access to a leaked email from a data breach, they can address the victim by name and reference a specific exchange. The 1099-DA data flow itself may become a vector, as third-party service providers become targets for extraction of the very data that was collected for compliance. The path to protecting users is not going to be found in a single software update. It will require a reimagining of how official verification works, from the signature on a letter to the user interface of a wallet. What would that look like? Imagine a world where government agencies publishing legal notices are required to sign them with a public key that is registered on a public ledger. When a taxpayer receives a letter, they can scan a code, but the scan does not take them to a fake portal. Instead, it takes them to a verification page that reads the signature against a canonical registry. If the signature does not match, the page says invalid. That is the kind of solution that crypto has been building for years, but it has not yet been applied to the analog channel that this attack exploits. The technology exists. The political will, and the coordination among agencies, does not. In the absence of that solution, the responsibility falls on two groups. The first group is the platforms that users already trust. Exchanges, wallet providers, and tax software should treat the word IRS as a risk keyword. When a user mentions an IRS letter that requests a recovery phrase, the software should intervene. The second group is the users themselves, which is the harder and more uncomfortable part. Self-custody was supposed to mean more than private key ownership. It was supposed to mean self-reliance. But self-reliance is impossible without a reliable way to distinguish official from counterfeit. Right now, the primary tool is irs.gov. That is not a bad tool. It is just not a fully deployed one. I want to make one more point about the timing. The counterfeit letters reference tax years 2017 through 2026. The choice of 2017 is not accidental. That was the bull run that drew millions of retail investors into crypto without any meaningful tax infrastructure. The ambiguity around what to report, what cost basis to use, and which exchanges had even issued forms created a population of taxpayers who may be genuinely uncertain whether they are in compliance. The scammer is betting that at least some of those taxpayers will be too afraid to check with a professional and will instead scan the QR code in search of a convenient resolution. The range of years also makes the letter feel comprehensive. It suggests that the virtual audit is serious and that the institution really has been tracking the taxpayer across multiple cycles. This is what makes the attack so elegant and so cruel. The strongest weakness being exploited is not a vulnerability in a smart contract. It is the ambiguity in the tax code and the emotional residue of past cycles. The crypto community talks about market cycles as if they only affect prices. But the 2017 cycle left behind a generation of taxpayers who still do not know whether they owe a debt. The 2021 cycle left behind a group of people who saw their NFT profits disappear and are now being asked whether they reported the sales. The 2022 cycle left behind the victims of failed exchanges, who are now being contacted by IRS-related scammers who claim to help them recover their funds. Every cycle creates a new class of anxious crypto holders, and an attacker who can name those cycles will always have material. It is easy to dismiss this as a simple internet scam, but the scale is not simple. The IRS has been aggressively expanding its crypto enforcement capabilities. The appointment of specialized units, the investment in blockchain analytics, and the implementation of new reporting rules are all part of a policy direction that will continue for the rest of this decade. The counterfeit letter operation is a direct reaction to that policy direction. As the number of genuine IRS communications grows, the number of fake communications will grow with it. This is a parasocial relationship between enforcement and fraud. The regulator creates the signal, and the fraudster amplifies the noise around it. Let me give you the advice that I would give to a friend, a family member, or a stranger in a Discord server who receives such a letter. First, do not scan the QR code. It is a link wearing a costume. Second, do not call the phone number on the letter. The number on the letter belongs to the scammer. Third, go directly to irs.gov and log in to your account. Every legitimate notice will be visible there. If the notice is not there, it is not real. Fourth, if you have already scanned the QR code and provided information, contact your exchange or wallet provider immediately. Change your passwords. Move your funds. Consider the exposure serious. Fifth, report the event to IRS Criminal Investigation and the Federal Trade Commission. The report is not just for you. It is for the next potential victim. That advice is simple, but it hides a deeper problem. The person who receives a counterfeit letter is likely in a state of heightened anxiety. They may not think to open a browser and navigate to irs.gov. They may not remember that the IRS has a secure login portal. They may not even know that they have an online account. The scammer’s landing page is optimized for exactly this moment. It asks the question in a clear, structured, official way. It makes the victim feel like they are cooperating with an audit. The official government website, by contrast, is sometimes clunky, and the login process is archaic. The asymmetry in ease of use is a security vulnerability. This is where the industry can do more. Wallets can integrate an official notices viewer. Exchanges can display messages when a user reports a suspicious letter. Tax software can add warnings that the IRS will never ask for a recovery phrase. None of these features require a new blockchain. They require a new kind of attention. The story is not in the token, it is in the trust, and trust must be engineered with as much care as the cryptography underneath the token itself. There is a phrase from the crypto community that I have always loved: Winter broke many, but bonded the rest. I cannot use it in a formal analysis, because it belongs to the short-form world of memes and Discord threads. But the spirit of that phrase applies here. Attacks like this will break people who are not prepared. They will also bond the communities that decide to take security education seriously. If you have been through this, you should not feel ashamed. The letter was designed by people who study fear for a living. The shame belongs to the attackers, not to the victims. The best way to break the cycle is to talk about it openly. The more we talk about the exact language of the scam, the QR code infrastructure, the fake portal questions, the phone call scripts, the less power the attack has. That is why public warnings from agencies like IRS Criminal Investigation and from companies like Coinbase are so important. They are not just news. They are threat intelligence. If this article does nothing else, I hope it convinces you to look at the next official-looking letter with slightly different eyes. When you see the Treasury logo, ask a question that would never have occurred to you before: what would the real IRS need from me that it does not already have? The IRS has your name. The IRS has your tax records. The IRS, increasingly, has your crypto transaction data. What it does not need is for you to tell it which wallet you use, what your balance is, or what phone number you have. If a letter asks for those things, it is not from the IRS. It is from someone who wants to become you. The next generation of crypto security will be about authentication in the physical world as much as the digital one. Government letters will need cryptographic signatures. Wallets will need to recognize official communication. Tax software will need to guide users through verification processes instead of leaving them alone with a QR code. And all of us, as a community, will need to understand that the most valuable asset we have is not the token in our wallet. It is the trust we place in the channels through which information reaches us. The story isn’t in the token. It was never in the token. It is in the trust. A QR code is an act of trust conducted with a camera. A recovery phrase is a trust handed to a voice. The security of the crypto economy depends on the choices we make before we scan, before we click, and before we share. The counterfeit IRS letters are a reminder that the blockchain only records transactions. It does not protect us from ourselves. And if you receive one of those letters, please do not scan the code. Close the envelope. Open irs.gov. And then, maybe, take a minute to tell someone else about what you almost did. Because the surest way to break a story built on trust is to make its ending less predictable.