Scammers Send Fake IRS Letters with QR Codes to Steal Cryptocurrency Wallet Credentials
Scammers are sending counterfeit physical letters from the IRS (Internal Revenue Service) containing QR codes, aimed at stealing cryptocurrency wallet credentials and exchange login information.
The letters use an official-style header, claiming the need to register for a non-existent "Digital Asset Compliance Portal," and set a deadline to create a sense of urgency. Scanning the QR code leads to a fake IRS website that requests personal data, wallet information, exchange account credentials, and even recovery phrases.
The IRS has issued a warning, clearly stating that it will not request QR code scans or registration for such portals via mail, nor will it ask for wallet private keys or recovery phrases. The phishing infrastructure has been traced back to overseas networks.
Such attacks exploit public trust in government agencies, bypassing digital defenses and directly targeting cryptocurrency holders.
Users are advised not to scan QR codes from unknown letters, not to share sensitive credentials, and to verify any tax notifications through official channels.
At the market mechanism level, phishing attacks directly lead to the theft of victims' assets, with funds flowing to addresses controlled by the attackers; the incident is driven by social engineering, benefiting the scam groups while putting pressure on users who trust emails and QR codes.
Source: Public Information
ABAB AI Insight
Scammers are transforming traditional paper trust into on-chain credential theft through physical fake IRS letters combined with QR codes, precisely targeting the compliance anxiety and operational habits of cryptocurrency holders.
In terms of capital pathways, attackers exchange low-cost printing and domain deployment for high-value access to wallets and exchanges, motivated by using the authoritative image of tax authorities to lower user vigilance, with specific actions including forging notifications, embedding QR codes, and inducing the input of sensitive information.
Similar cases can be seen in other phishing activities impersonating governments or exchanges, as well as the combined use of QR codes in physical and digital attacks; currently, cryptocurrency security is at a stage where social engineering and compliance themes are highly intertwined.
This essentially represents a technological substitution: user self-verification is replaced by the convenience of scanning forged authorities, with the mechanism bypassing digital security habits through the trust inertia of physical letters, thereby directly obtaining asset control.
ABAB News · Cognitive Law
The QR code in the fake IRS letter is often the shortest path to asset theft.
The government will not ask you to scan a QR code to submit your wallet.
The more genuine the sense of urgency created, the higher the success rate of phishing.