The U.S. Internal Revenue Service (IRS) is sending a strong warning that scammers are mailing fake letters to American taxpayers to steal their data or digital assets, Bloomberg reported on J
The U.S. Internal Revenue Service (IRS) is sending a strong warning that scammers are mailing fake letters to American taxpayers to steal their data or digital assets, Bloomberg reported on July 31.
The IRS warned that these counterfeit physical letters ask taxpayers to enroll in a fake Digital Asset Compliance Portal (DACP) before the Aug. 10 deadline and submit personal information. But no such genuine portal exists at all, the agency said.
The IRS also warned against scanning QR codes or taking calls from scammers posing as its agents seeking payment.
"Criminals continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence,” IRS criminal investigation chief Jarod Koopman said.
Though there is no death of digital scams targeting crypto users, the use of physical letters seems new.
The Coinbase crypto exchange also cautioned crypto users against falling for the scam.
The scam letter, mailed to a real home address and printed to look like an official IRS notice. Sensitive details have been redacted. Source: CoinbaseThe QR code doesn't direct to IRS.gov; instead it directs to irs.digitalcomplianceportal[.]com, the exchange warned.
The counterfeit domain was registered through a Hong Kong registrar only days before these fake letters were sent, and the site was hosted in Romania on a network already known for hosting phishing pages, Coinbase highlighted.
The fake DACP landing page. It copies the look of a real government site and pushes you to click "Get Started" before an "enrollment deadline." Source: CoinbaseIf a vulnerable user lands on the DACP portal, they are asked where they keep their crypto assets (wallets, exchanges, etc.) and then reveal the amount of their holdings. Next, the portal asks for approval from their exchange and asks for the user's phone number.
A scammer posing as an IRS agent then calls the user to complete the verification process, who will ask for a two-factor authentication (2FA)/one-time code, password, or recovery/seed phrase or send a 12-word seed phrase to trick the user into moving their crypto assets to the scammer's wallet.
The IRS has already clarified to crypto users that it has no Digital Asset Compliance Portal and doesn't ask for an enrollment. Users should never reveal their passwords, 2FA, recovery or seed phrases, etc., to anyone as no IRS agent asks for such sensitive details.
Coinbase advised any American taxpayer who receives such a counterfeit mail to report the scam to official IRS fraud portal or the Federal Trade Commission (FTC).
