Skip to content
Scammers.com
Government impersonationReviewed

MalwareTips: irs.digitalcomplianceportal.com fake IRS crypto enrollment portal

MalwareTips says mailed CP14-432RA letters send recipients to a fake IRS crypto compliance portal that harvests wallet details. The IRS is impersonated and not involved.

First reported
Reports
1

Source: malwaretips.com · published

Illustration: Impersonation scams

What happened

MalwareTips published an investigation on 6 November 2026 of a fake IRS crypto letter scam. Coinbase Security and DarkTower documented a mailed notice marked CP14-432RA whose QR code led to a government-styled website for a so-called Digital Asset Compliance Portal (DACP). The IRS warns that these letters are fraudulent and does not operate the portal; the IRS is impersonated and not involved.

How the scam works

MalwareTips says this is not a dispute about whether cryptocurrency can create tax obligations but a fake enrollment process. The website, using hostnames such as irs.digitalcomplianceportal[.]com that place irs before a separate .com domain, asked visitors to choose their wallets and exchanges, select holdings in value brackets reaching $100,000 or more, and pass a provider-approval stage. It then requested a phone number and promised a call from a representative.

These questions matter even before any password is requested, because they tell a future caller which account provider to imitate and roughly how much money is at stake. Investigators supplied a burner number, but the site went dark before the verification call could be observed, and the report does not show a completed call or a victim's transfer. A follow-up caller who repeats details entered on the form is not authenticated by that knowledge, and could ask the victim to approve a sign-in, disclose codes or move funds.

MalwareTips' advice depends on what was shared. With only the letter, keep it as evidence and verify through IRS.gov or a known IRS number. If personal details were submitted, expect targeted follow-up and refuse verification calls. If account secrets were exposed, use the real provider's emergency security process. If funds were sent, report the transaction promptly and ignore anyone promising recovery for a fee.

Source

MalwareTips investigation, 6 November 2026: https://malwaretips.com/blogs/fake-irs-crypto-letter-digital-asset-compliance-portal-scam/

Red flags

  • A mailed IRS-looking notice telling you to enroll crypto holdings in a portal.
  • A QR code leading to a site whose address only starts with irs before an unrelated .com domain.
  • Questions about which wallets or exchanges you use and how much they hold.
  • A promise that a representative will call to verify you.
  • A caller asking you to approve sign-ins, read out codes or move crypto.

If you were targeted

  1. 1Do not scan QR codes on unexpected tax letters; go to IRS.gov yourself.
  2. 2Never give wallet recovery phrases, passwords or codes to anyone who calls.
  3. 3If you entered details, refuse verification calls and watch your exchange accounts.
  4. 4If account secrets were exposed, secure the account through the real provider's official support.
  5. 5Report the letter to the Treasury Inspector General for Tax Administration and phishing@irs.gov.
ReportFraud.ftc.gov FBI IC3 More resources