Loading story…
Scammers are mailing physical letters to cryptocurrency holders that impersonate the IRS and U.S. Treasury, claiming recipients must register with a bogus Digital Asset Compliance Portal. The letters include a QR code that leads to a fake IRS-branded site asking for exchange or wallet provider details, estimated crypto holdings, and phone numbers. The IRS said it did not send the letters and does not operate any such portal, while reporting indicates the campaign was uncovered after a customer report to Coinbase.
Infrastructure analysis tied the phishing site to a recently registered domain using a Hong Kong-based registrar and hosting in Romania on systems previously associated with phishing pages targeting banks, financial institutions, and delivery services. Investigators said the web form likely serves as a lead-generation step for follow-on phone fraud, with impostors posing as support staff to steal one-time passcodes, passwords, seed phrases, or to pressure victims into transferring assets to attacker-controlled wallets.
Get the infrastructure and lures behind it.
5 events from the most recent confirmed update back to the earliest known activity.
The IRS publicly stated that it did not send the letters and does not operate any "Digital Asset Compliance Portal." IRS Criminal Investigation officials warned that criminals were exploiting trust in government branding and urged people to verify unexpected requests for personal information.
DarkTower assisted with threat intelligence analysis and traced the scam site to hosting in Romania. It also linked the infrastructure to prior phishing pages impersonating banks, delivery services, and other financial targets.
Coinbase published an analysis of the campaign after a customer reported receiving one of the fraudulent letters. Its review concluded that the fake portal was likely used to set up the real attack stage: a follow-up phone call by impostors seeking credentials, one-time codes, seed phrases, or fund transfers.
Investigators found the malicious domain used in the campaign had been registered only days before the fake letters were mailed. The domain was registered through a Hong Kong-based registrar.
A fraud campaign sent physical letters to cryptocurrency holders that impersonated IRS or Treasury notices and claimed recipients had to enroll in a "Digital Asset Compliance Portal" or face penalties. The letters used official-looking branding, notice details, and a QR code to drive victims to a phishing site.
Vulnerabilities, threat actors, malware, products, organizations, breaches, and observables Mallory has linked to this story. Indicator values are masked here and available in full in the app.
Indicator values are masked on this page. See the values in Mallory Domains, IPs, hashes, and URLs are exportable to your SIEM.
Get the infrastructure, lures, and IOCs behind this campaign, ready to push into your email and identity stack.
5 references tracked. Mallory keeps watching after this page renders.
bitdefender.com
Open sourcehelpnetsecurity.com
Open sourcecoinbase.com
Open sourceirs.gov
Open sourceirs.gov
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Criminals are running **IRS impersonation scams** during tax filing season, using phone calls, emails, and texts to pressure victims into paying alleged tax debts or “fines,” or to trick them into disclosing sensitive personal and financial information. Common tactics include spoofed caller ID/sender details, use of official-looking IRS branding, and urgent threats (e.g., arrest or penalties) designed to short-circuit normal verification steps. Guidance highlighted for defenders and end users includes treating unsolicited IRS outreach as suspicious (the IRS typically initiates contact via mailed letters), refusing demands for immediate payment, and recognizing that requests for payment via **gift cards** or **cryptocurrency** are strong indicators of fraud. One reported lure centers on the phone number **`833-727-9955`** being used in “IRS scam calls,” consistent with broader IRS-themed social engineering that may be further amplified by **AI-enabled** voice/text techniques to increase credibility and scale.
Jun 29, 2026
Fraudsters are running a broad IRS impersonation campaign through robocalls, voicemails, texts, and emails that use fake names such as **Tax Mediation and Abatement Office**, **Tax Resolution Service Office**, **Taxpayer Abatement Assistance Office**, **American Tax Advocates**, and **American Tax Benefits**. The messages claim the target has unresolved tax issues, a file in "final review," frozen accounts, missed filings, or access to penalty relief or refunds, then pressure them to call back numbers including `888-355-0728`, `888-753-0127`, `888-663-0866`, `888-681-0352`, `888-788-3067`, `202-649-2801`, `202-649-2790`, `202-649-2783`, `771-222-3150`, `771-333-2237`, `771-333-2065`, `833-604-4139`, `877-706-0402`, `888-825-0405`, `888-551-2231`, `888-834-1048`, `888-792-0335`, `888-471-0706`, `833-684-4075`, `888-461-3098`, and `888-796-1408`. Some calls reportedly use spoofed caller ID, aliases such as **Laura Christie** and **Tara C. Hutchinson**, and AI-enhanced personalization to appear legitimate. The operation relies on classic social engineering: threats of arrest, fines, deportation, license revocation, liens, asset seizure, or collection escalation, alongside false promises to settle tax debts "for pennies on the dollar" or secure refunds. Victims are pushed to disclose personal data, IRS account credentials, and banking details, or to send money through gift cards, wire transfers, prepaid debit cards, or cryptocurrency; some lures also direct targets to phishing sites or malware-bearing links. The warnings align with the IRS **Dirty Dozen** advisory for the filing season, which highlighted impersonation, phishing, account theft, and malware risks targeting taxpayers and tax professionals. Officials and consumer alerts stress that the IRS generally initiates contact by postal mail, not unsolicited calls, texts, or social media, and urge victims to hang up, avoid calling back, verify any issue only through official IRS channels, and report incidents to **TIGTA**, the **FTC**, or `phishing@irs.gov`.
Jul 2, 2026
Microsoft reported a wave of tax-season phishing campaigns targeting primarily U.S. organizations and individuals, using **IRS-themed lures**, fake tax documents, QR codes, malicious attachments, and abused legitimate services to steal credentials or deploy malware. One campaign attributed to **Storm-0249** used IRS-themed emails and counterfeit **DocuSign** pages to deliver **BruteRatel C4** and later **Latrodectus**, while other activity used QR-code PDFs to direct victims to **RaccoonO365** credential-harvesting pages, malicious Excel macros to install **AHKBot**, and tailored outreach to accountants to deliver **GuLoader** and **Remcos**. The activity shows attackers exploiting tax filing urgency and trust in government communications to compromise users and enterprise environments. Microsoft published indicators and mitigation guidance including **MFA**, phishing-resistant authentication, Safe Links, network protection, and Defender detections, while the **IRS** continues to direct the public to report fake IRS, Treasury, or other tax-related emails and messages through its phishing reporting channels.
Aug 15, 2026