The IRS 'Digital Asset Compliance Portal' Letter Is Fake

The IRS 'Digital Asset Compliance Portal' Letter Is Fake

Say you own some Bitcoin, and an envelope shows up in your mailbox — plain, unmarked, easy to miss in a stack of takeout menus and utility bills. Inside is a letter styled like an official IRS notice: a notice number, a tax year range, Treasury language, a deadline. It tells you to enroll in something called the Digital Asset Compliance Portal before that deadline or face penalties. There's a QR code at the bottom to make enrolling easy.

Here's the part that should stop you cold: there is no Digital Asset Compliance Portal. The IRS has said so directly. This letter exists because scammers figured out the exact thing that's supposed to protect you from IRS scams — "the real IRS always mails you first" — and built a fake mailing around it.

How this scam actually works

The letter is designed to look like routine IRS correspondence: plain envelope, official-sounding letterhead, a notice number, and a deadline pressuring you to act before you think it through. Instead of a phone number to call, it asks you to scan a QR code to "enroll" in the Digital Asset Compliance Portal, or DACP for short — a name invented for this scam, not a real IRS program.

Scan it, and you land on a site built to look like a government portal, complete with an "official website of the United States government" banner across the top. From there it walks you through a short sequence: which exchange or wallet you use, an estimate of what your holdings are worth, and finally a phone number so a "representative" can call you back to finish "verification." Every step is designed to feel like paperwork. None of it is.

Coinbase, working with the security firm DarkTower, traced the infrastructure behind one wave of these letters: the fake portal's domain was registered through a Hong Kong-based registrar just days before the letters went out, then hosted on servers in Romania previously linked to phishing pages impersonating banks and delivery companies. That's not a typo-riddled scam thrown together overnight — it's infrastructure built specifically to survive a quick Google search looking clean.

The IRS has addressed this one by name: "If you receive a letter claiming to be from the IRS that instructs you to enroll in a Digital Asset Compliance Portal, don't respond. The IRS did not send it. The IRS does not operate a Digital Asset Compliance Portal. This is a scam."

This is also, quietly, a crypto scam — it just arrives by mail instead of a dating app or a "trading platform." The target list is the same: anyone with a wallet or an exchange account, which scammers are increasingly willing to reach through the mailbox instead of a screen.

Why this one's harder to spot than the usual IRS scam

Every government impersonation scam I've written about has the same fatal flaw: they skip the step where the real agency contacts you through the mail first, so a phone call demanding immediate payment or a text about a refund is obviously fake the moment you know the rule. Even the gift-card version of the IRS scam — still the most common one — relies on a caller pretending the mail step never happened. This one doesn't skip that step. It leads with the mail. It's dressed as the exact thing our own IRS scam guide tells you to expect and trust.

That's what makes it a smarter scam than a rushed robocall — it's aimed at people who already know better than to answer a threatening phone call, precisely because it doesn't ask you to answer one. It asks you to scan a code instead, which strips out most of the usual tells. You can't hover over a QR code to preview where it leads the way you can with a link in an email. You find out where you're going after you've already scanned.

The red flags hiding in plain sight

There's no such thing as a "Digital Asset Compliance Portal." The IRS does not operate a portal by this name, or require crypto holders to "enroll" anywhere. This single fact ends the scam the moment you know it.

A QR code is the call to action. The real IRS's mailed notices point you to IRS.gov and your existing Individual Online Account, or a phone number you can independently verify. A QR code as the primary way to respond isn't how the agency operates, in crypto matters or anything else.

It asks which exchange or wallet you use before verifying anything about you. Legitimate identity verification starts with confirming who you are, not with mapping out where your assets sit. Naming your exchange first is data collection dressed as a form field.

It asks you to estimate your holdings. No tax-compliance process needs you to guess a dollar figure into a web form before any identity check has happened.

It ends by collecting your phone number for a callback. That number becomes the next attack surface — a "verification specialist" calling you back, sounding informed because they already know which exchange you use.

The deadline is doing the persuading. A tight, unexplained deadline is the same lever behind every version of this scam, whether it's a fake arrest warrant or a fake portal. Urgency is a tool for skipping the step where you'd otherwise stop and check.

The envelope is unmarked and easy to miss — on purpose. A plain envelope avoids anything that would let it get flagged as bulk marketing mail, while the letter inside borrows just enough Treasury and IRS visual language to read as official once opened.

If this already happened to you

Stop responding or interacting with the site or any callback number connected to it — don't call, don't scan again, don't reply. If you entered which exchange or wallet you use, contact that exchange directly through its own app or official site (never through anything from the letter) and flag your account for extra monitoring; turn on two-factor authentication if it isn't already on. If you gave a phone number and get a callback, don't engage — hang up.

Preserve everything before you do anything else: photograph the letter and envelope, screenshot the fake site if you can safely do so, and keep any callback number. If you're unsure whether a document or screenshot you're holding is legitimate, run it through our scam image checker before you act on it. Report the letter to IRS Criminal Investigation at IRS.gov/submitatip, and separately to the FTC at reportfraud.ftc.gov. If you shared banking or Social Security information anywhere in the process, freeze your credit at all three bureaus as a precaution.

None of this makes you careless. This letter was built by people who trace scam infrastructure through offshore registrars for a living, aimed at a rule ("wait for the letter") that every legitimate piece of IRS advice — including mine — tells you to trust.

How to not become the next victim

Treat any QR code in unsolicited mail the way you'd treat one taped over a parking meter: don't scan it as the default move. If a letter claims to be from the IRS about anything — crypto, back taxes, an audit — go around it entirely. Log into your IRS Individual Online Account at IRS.gov directly, or call the IRS's published general number, and ask about the notice using its number. Never use a phone number, QR code, or link printed on the letter itself to verify the letter.

If you hold crypto, lock down the account that actually matters: your exchange login. A hardware security key like a YubiKey 5C NFC makes your exchange account resistant to exactly the kind of follow-up phishing this scam sets up — even if a scammer gets your username and password from a later attempt, they can't get past a physical key they don't have.

This letter is one entry in a much wider field — if you want the complete rundown of what else is out there, the full breakdown of crypto scam types covers wallet drainers, fake exchanges, and the rest of the lineup this one is joining. And keep this in mind generally: the IRS doesn't email, text, DM, or QR-code you into a portal for anything, crypto or otherwise. If digital asset reporting requirements ever actually change, you'll hear about it through your tax software, a licensed preparer, or a mailed notice you can verify independently — never through a code you scan on the spot.

FAQ

Is the IRS Digital Asset Compliance Portal real? No. The IRS has said directly that it does not operate a Digital Asset Compliance Portal, and that if you receive a letter instructing you to enroll in one, you shouldn't respond — the IRS did not send it. Any letter using that name is a scam, full stop.

I scanned the QR code but didn't enter any information. Am I at risk? Scanning alone mostly just confirms your phone number and address are active to whoever registered the scam domain — annoying, not catastrophic. The real exposure starts if you went further: picking your exchange, estimating your holdings, or entering a phone number for a callback. If you stopped at the landing page, you're fine. If you're not sure how far you got, treat it as if you gave information and follow the steps above.

What if I told the fake site which exchange I use and estimated my holdings? Contact that exchange directly — through its official app or website, not any link from the letter — and let them know your account information may be targeted. Turn on two-factor authentication if you haven't, and watch for phishing follow-up calls or texts referencing the exchange you named, since that detail is now something scammers can use to sound more credible.

Does the real IRS ever text, email, or call about cryptocurrency? No. The IRS's first contact on any tax matter — cryptocurrency included — is a paper letter through the U.S. Postal Service, and that letter will never include a QR code directing you to a portal to "enroll" your digital assets. Any call, text, email, or QR code claiming otherwise is an impersonation attempt.

How do I check if an IRS letter I received is real? Don't use any phone number, QR code, or link printed on the letter itself. Go to IRS.gov directly, log into your IRS Individual Online Account, and check whether a matching notice is listed there. You can also call the IRS's general line at 1-800-829-1040 to ask about a specific notice number.

I don't own any cryptocurrency. Why did I get this letter? These letters are mailed in bulk to addresses scammers believe might belong to crypto holders — they don't actually know who owns what. If you don't hold crypto, the letter is obviously fake to you, but it's worth reporting anyway, since the same scam is landing on neighbors who might not catch it as fast.

Scammers spent years training people to trust mail over phone calls, and this letter is what happens when they read their own press. The fix isn't a new rule to memorize — it's the old one, applied one layer deeper: a letter telling you to scan a code is still a letter telling you to act before you check. Check first.

Sources: IRS Criminal Investigation fraud alert on fake cryptocurrency compliance letters, Coinbase — Consumer Protection Tuesday: A Fake IRS "Digital Asset Compliance Portal" Letter Is Targeting Crypto Holders