Fake IRS Crypto Compliance Portal Scam: 7 Warning Signs

How the Fake IRS Crypto Compliance Portal Scam Works

The scam begins with an official-looking letter telling the recipient to enroll in a “Digital Asset Compliance Portal” before a deadline.

A QR code opens a fraudulent website that copies the look of IRS.gov and may ask for sensitive information.

The IRS does not operate a portal by that name.

You can review the Journal of Accountancy report about the warning about the fake Digital Asset Compliance Portal.

The scam feels believable because digital asset transactions can create real tax-reporting duties. Do not assume the letter proves the IRS has contacted you about a real crypto tax issue.

Warning Sign 1: The Letter Mentions a “Digital Asset Compliance Portal”

The strongest warning sign is the portal name.

The IRS has warned that it does not operate a “Digital Asset Compliance Portal.”

The name sounds believable, but that does not make it legitimate.

Do not search for the portal or try to enroll. Open a new browser window and type IRS.gov directly into the address bar.

If the letter includes a notice or letter number, search that number through the official IRS website. Use only contact information found on IRS.gov.

Warning Sign 2: The Letter Uses a Deadline to Create Pressure

The letter may say you need to act quickly. It may mention penalties, enforcement, or a limited time to register.

Real IRS notices can include deadlines. A short deadline alone does not prove a letter is fake.

The concern is when the letter uses urgency to push you into an unfamiliar website or asks for sensitive information before you have time to verify the request.

Slow down.

A deadline is a reason to check the letter promptly. It is not a reason to hand over account information through an unverified portal.

The IRS provides guidance on how to verify whether a contact is really from the IRS.

Warning Sign 3: The Letter Tells You to Scan a QR Code

A QR code can hide the website address until the page opens.

Some legitimate IRS letters may include QR codes. A QR code alone does not prove a letter is fake, but it also does not prove it is real.

The safer approach is to avoid scanning a code in an unexpected letter. Go directly to IRS.gov and verify the notice independently.

If the letter includes a CP notice number or LTR number, search for it on the IRS website.

Do not trust a QR code simply because it appears beside an IRS logo.

Warning Sign 4: The Website Looks Like IRS.gov

A fake website may copy IRS colors, seals, fonts, and tax language.

A logo, padlock symbol, or professional design does not prove who controls the site.

Close the page and type IRS.gov yourself. Do not use a website address or phone number from the suspicious letter until you verify it through an official IRS source.

IRSProb’s guide to common IRS impersonation scams explains why official-looking language can still be part of a scam.

Warning Sign 5: The Site Requests Wallet or Exchange Credentials

Never provide an unexpected website with:

• A wallet recovery phrase
• A private key
• An exchange password
• A multifactor authentication code
• Remote access to your phone or computer
• Permission to connect an unfamiliar application to your wallet

A recovery phrase or private key can give another person control over a wallet.

That is not ordinary tax documentation.

The IRS may request records supporting income, gains, losses, or basis. Those records are different from credentials that control your assets.

The IRS does not need your recovery phrase, private key, exchange password, or security code to review tax compliance.

Warning Sign 6: The Letter Mixes Real Crypto Tax Rules With a Fake Process

Digital asset tax duties are real.

The IRS generally treats digital assets as property. Sales, exchanges, rewards, payments, and other transactions may need to be reported.

Federal tax returns also include a digital asset question.

None of those rules requires enrollment in the fake portal.

That distinction matters.

Do not let the scam cause you to ignore a real reporting issue. If your records are incomplete or a prior return may be wrong, handle that through normal filing, amended-return, or professional-review procedures.

The fake portal is not part of the federal tax system.

Warning Sign 7: The Letter Pushes You to Use Its Contact Information

A suspicious letter may include a phone number, email address, QR code, or website and tell you to use only that contact method.

That keeps you inside the scam.

Do not call the number in the letter until you know the notice is genuine.

Instead:

• Search the notice or letter number through IRS.gov
• Sign in to your IRS Online Account directly
• Contact the IRS using a number found on an official IRS page
• Ask a trusted CPA, enrolled agent, or tax attorney to review the letter

Use an independently verified contact method, not the one chosen by the sender.

How to Check Whether an IRS Letter Is Real

Keep the letter and envelope. Look for a CP notice number or LTR number and search for an IRS notice or letter number through IRS.gov.

Compare the tax year, issue, amount, and response instructions with your records.

You can also check your IRS Online Account, but not every legitimate letter will necessarily appear there. If the letter still looks suspicious, contact the IRS using information obtained from IRS.gov.

Do not send identification documents, tax returns, wallet records, or financial information until you know who requested them and why.

IRSProb’s guide on how to review an unexpected IRS letter can help with the first review.

What to Do If You Scanned the QR Code

Scanning the code does not automatically mean your device was compromised.

What matters is what happened next.

If you only opened the website and entered nothing, close it. Do not download files, install software, connect a wallet, or return to the page.

Check your browser’s downloads and your device for anything unfamiliar.

Preserve the letter and website address for reporting.

If you installed software, granted remote access, or approved a wallet connection, stop and consider getting help from a qualified cybersecurity professional.

What to Do If You Entered Exchange Credentials

Go directly to the exchange’s official app or website.

Change the password immediately and use one you have not used elsewhere. Enable or reset multifactor authentication.

Review recent transactions, active sessions, connected devices, withdrawal addresses, and account permissions. Remove anything you do not recognize.

Contact the exchange’s security team through its official support process. Secure the connected email account if its password was reused or exposed.

Stop communicating with the sender.

What to Do If You Shared a Recovery Phrase or Private Key

Treat the wallet as potentially compromised.

Do not continue using the exposed credentials.

Contact the wallet provider, exchange, or a qualified digital asset security professional immediately. Depending on the situation, remaining assets may need to be moved to a new wallet created with new credentials.

Preserve wallet addresses, transaction IDs, dates, screenshots, and security alerts.

Act quickly, but avoid anyone who contacts you afterward claiming guaranteed recovery.

Cryptocurrency transfers are often difficult or impossible to reverse, so recovery should not be assumed.

The FTC provides guidance on cryptocurrency scam and recovery warnings.

What to Do If You Shared Personal or Financial Information

If you provided a Social Security number, identification document, bank information, or tax records, the risk may extend beyond cryptocurrency.

Contact affected financial institutions, change passwords, and review recent activity.

Consider identity-theft protections when appropriate. Visit IRS Identity Theft Central for current tax-related identity theft guidance.

Keep the letter, envelope, screenshots, website address, phone numbers, messages, and account alerts.

How to Report the Fake Letter

Preserve the original letter and envelope. The envelope may contain useful details such as the postmark or return address.

Use the IRS page to report a fake IRS letter or website. You may also use the IRS page to submit a tax scam tip to the IRS.

Because this involves mailed correspondence, suspected mail fraud may also be reported to the U.S. Postal Inspection Service through its page to report suspected mail fraud.

Contact the cryptocurrency exchange immediately if account access was exposed.

Keep confirmation numbers and copies of every report. Reporting may help agencies identify the scam and warn other taxpayers, but it does not guarantee recovery.

Real Digital Asset Tax Duties Still Apply

The fake portal changes nothing about legitimate digital asset reporting.

Keep records showing purchases, receipts, sales, exchanges, transfers, rewards, payments, dates, fair market values, fees, and tax basis.

A transfer between wallets you own or control may not be reported the same way as a sale or exchange, but records are still important.

A Form 1099-DA or other statement may help, but taxpayers still need their own records to calculate income, gain, loss, basis, and reporting treatment.

You can review IRS guidance on legitimate digital asset reporting requirements. IRSProb also explains digital asset basis and Form 1099-DA rules.

If you discover a real reporting problem, handle it through the normal return, amended-return, or professional-review process.

Records to Preserve After a Suspected Scam

Keep the original letter and envelope, photos or scans, the notice number, website address, screenshots, phone numbers, emails, exchange alerts, wallet addresses, transaction IDs, dates, and copies of reports.

These records may help the exchange, your advisers, or law enforcement.

IRSProb’s guide to digital asset records taxpayers should keep explains why documentation matters when digital asset activity is involved.

When to Get Professional Help

Consider professional help when:

• A private key or recovery phrase was exposed
• Cryptocurrency moved without permission
• Identity information was shared
• Software was installed from the fake site
• The letter may be genuine
• An actual notice appears in your IRS records
• You have unresolved digital asset reporting problems
• Tax-related identity theft may be involved

Protect your accounts and personal information first. Then handle any real tax issue through verified channels.

FAQs About the Fake IRS Crypto Compliance Portal

Disclaimer