Consumer Protection Tuesday: A Fake IRS "Digital Asset Compliance Portal" Letter Is Targeting Crypto Holders
Coinbase Security in partnership with DarkTower
Scammers are mailing physical letters in subtle, unmarked envelopes that look like they come from the IRS, telling crypto holders they must "enroll" in a so-called Digital Asset Compliance Portal (DACP) before a deadline. The letter includes a QR code that leads to a convincing fake IRS website.
This is a scam.
If you received this letter:
Do not scan the QR code
Do not enter any information
Do not call any phone numbers listed on the website
If someone calls claiming to be from the IRS, Coinbase, or a "compliance portal," hang up.
Below we will outline what the letter looks like, how the scam works step by step, and what to do if you received it.
What the letter looks like
The scam letter, mailed to a real home address and printed to look like an official IRS notice. Sensitive details have been redacted.
The letter is printed to imitate a real IRS notice. In the letter shown above, it is styled as coming from the Department of the Treasury, Internal Revenue Service, Austin, TX, with a notice number of CP14-432RA, a tax year range of 2017–2026, and a fake enrollment deadline designed to create urgency. These small details may be different, but the scam is the same.
Red flags in the letter
It claims you must "enroll" in a "Digital Asset Compliance Portal (DACP)." This program does not exist. The IRS has no digital-asset "enrollment portal," and it does not require you to register your exchanges or wallets.
The web address is not IRS.gov. The QR code led to a look-alike domain (of the form irs.digitalcomplianceportal[.]com) — not the real irs.gov.
Our partners at DarkTower traced the infrastructure behind this campaign: the look-alike domain was registered just days before the letters went out, through a Hong Kong registrar, and the site was hosted in Romania on a network already known for hosting FedEx and banking phishing pages. In other words: this is a professional, international fraud operation — not the IRS.
How the fake "portal" works, step by step
If you scan the QR code, you land on a page engineered to look exactly like a real government website — complete with an "official website of the United States government" banner and IRS-style branding.
The fake "Digital Asset Compliance Portal (DACP)" landing page. It copies the look of a real government site and pushes you to click "Get Started" before an "enrollment deadline."
Step 1 — Pick your crypto exchange or wallet. After "Get Started," the site asks you to select where you keep your crypto — from hardware wallets (Ledger, Trezor) to exchanges like Coinbase, Kraken, Binance and others. This is the scammers learning which platform to impersonate when they come after your account.
The fake portal asks you to select your exchanges and wallets — the scammers are profiling exactly where your funds are held.
Step 2 — Tell them how much crypto you have. Next, the site asks for the estimated value of your holdings, with ranges up to "$100,000+." Legitimate tax reporting never works this way. This step lets the scammers prioritize the highest-value targets.
The site asks for the estimated value of your crypto — a way for the fraudsters to size up their targets.
Step 3 — The "platform approval" hand-off. The portal then says it needs to "obtain approval" from your exchange and that you'll be "redirected" to complete it. This is the bridge that sets up the real attack.
The "you'll be redirected to your provider for approval" step — designed to make the next move feel routine and official.
The real goal: getting you on the phone
Here's where the trap closes. To "get verified," the site asks for your phone number and tells you a "representative" will call you to complete the process.
That phone call is the actual attack. Armed with your name, your address (from the mailing), the exchange you use, and a rough idea of your balance, a scammer posing as "support" will try to talk you into handing over the keys to your account — a 2FA/one-time code, your password, or your recovery/seed phrase — or by providing you with a 12-word seed phrase to trick you into moving your funds to a "safe" wallet they control. This is called vishing (voice phishing), and it is one of the most effective account-takeover techniques used against crypto holders today.
The final step harvests your phone number so a fake "representative" can call you. When the DarkTower team entered a burner number and clicked continue, the site went dark — leaving open whether the call comes later, or whether the number and exchange choice are simply harvested for a future social-engineering attempt.
What to do if you received this letter
Do not scan the QR code and do not visit the website printed in the letter.
Do not enter your name, exchange, holdings, phone number, or any other detail.
Do not take or make a "verification" phone call about it. If someone calls claiming to be from the IRS, your exchange, or a "compliance portal," hang up.
Never share your password, two-factor (2FA) or one-time codes, or your recovery/seed phrase with anyone — for any reason.
Never move your crypto to a "new" or "safe" wallet because someone told you to. That is theft, not protection.
Verify independently. The IRS communicates about taxes primarily by mail through official notices — and it will never ask you to "enroll your exchange" via a QR code or a phone rep. Learn how the IRS actually contacts taxpayers at irs.gov, and read about real digital-asset tax rules at irs.gov/filing/digital-assets.
If you already entered information or spoke with someone, secure your accounts immediately: change your exchange password, confirm your 2FA method, and contact your exchange's official support through its app or website (not a number someone gave you).
The IRS — and Coinbase — will never
Send you a QR code to "enroll" your crypto exchange in a portal.
Ask which exchange or wallet you use or how much crypto you hold in order to "stay compliant."
Call, text, or email asking for your password, 2FA code, or seed phrase.
Ask you to move or transfer funds to a "protected," "government," or "safe" wallet.
Pressure you with a countdown or deadline to act immediately.
If a message does any of these, it's a scam — no matter how official it looks.
How to report it
Report suspected IRS-related scams to the official IRS fraud portal: https://www.irs.gov/help/report-fraud/report-fake-irs-treasury-or-tax-related-emails-and-messages
Report the fraud to the FTC at reportfraud.ftc.gov.
If it targets your Coinbase account, report it through the official Coinbase Help Center and follow the account-security steps there.
Frequently asked questions
Is the "Digital Asset Compliance Portal (DACP)" real?
No. There is no IRS "Digital Asset Compliance Portal" or "DACP." Any letter, QR code, or website promoting one is fraudulent.
I got an IRS letter about cryptocurrency with a QR code — is it a scam?
If it tells you to scan a QR code, enroll your exchange, or verify your holdings by a deadline, treat it as a scam. Do not scan it. The real IRS does not enroll your exchange or ask for your holdings this way.
Is irs.digitalcomplianceportal[.]com an official IRS website?
No. The only official IRS website is irs.gov. Look-alike domains such as irs.digitalcomplianceportal[.]com are fake, even when the page looks identical to a government site.
The letter had a notice number like "CP14-432RA." Doesn't that make it real?
No. Scammers copy real-looking notice numbers, Treasury addresses, and formatting to appear legitimate. The presence of a notice code does not verify a letter.
I scanned the code and entered my info. What now?
Assume the information is compromised. Verify your 2FA, never share codes or seed phrases, and contact your exchange's official support. Do not accept any inbound "verification" calls related to the letter.
How can I verify if I owe money to the IRS?
You can view all digital copies of any IRS notices, and any balance owed, by visiting irs.gov and searching “online account.” Any taxpayer can open an online account and view their IRS communications and balance. Irs.gov works with id.me for verification and account creation. For more information you can visit: https://www.irs.gov/payments/online-account-for-individuals
About this alert
This analysis was produced by Coinbase Security in partnership with DarkTower, whose threat intelligence team investigated the mailed letter, the look-alike domain, and the hosting infrastructure behind this campaign. We share these findings to help the broader crypto community recognize and avoid this scam. We're grateful to the individual who reported the letter that made this investigation possible.
Indicators of Attack
