Photo Credit: Getty Images
A new mail fraud scheme is targeting cryptocurrency holders with convincing, IRS-style notices and a fake "compliance portal" designed to steal sensitive financial information. The scam uses official-looking letters and QR codes to direct recipients to a fraudulent website, where they may be prompted to enter financial or personal details.
What happened?
According to AOL, a criminal investigation conducted by the IRS discovered that an international scam operation has been sending letters that resemble official IRS notices. The mailers tell recipients to register for a supposed "Digital Asset Compliance Portal."
The outlet noted that recipients who scan the QR code in those letters are sent to an imitation website that asks for personal and financial details, including crypto exchange account information and wallet data.
Once that information is submitted, the next step is often a follow-up call from someone posing as an IRS official and requesting a password, a two-factor authentication code, or a private key for the victim's crypto account.
The IRS has said that no legitimate Digital Asset Compliance Portal exists and that any message referring to one should be reported.
Jarod Koopman, the IRS's Criminal Investigation Chief, warned in a statement reported by AOL that "Criminals continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence."
Researchers working with Coinbase and cyber defense firm DarkTower traced the fake site's domain to a Hong Kong registrar and its hosting to a Romanian location associated with other impersonation schemes involving banks and FedEx.
Why does it matter?
This scam is emerging at a time when crypto-related fraud is already costing Americans enormous sums of money.
