"Everything was stolen with one QR code"...US IRS warns of phishing targeting cryptocurrency investors

▲ Phishing, impersonation, cryptocurrency crime, US IRS/AI generated image

The U.S. Internal Revenue Service (IRS) has issued a warning about fake tax notices targeting cryptocurrency investors. The QR code in the letter leads to a phishing site that targets wallet information and personal data.

According to Bitcoin.com on August 1 (local time), the U.S. Internal Revenue Service issued a fraud alert regarding a forged letter sent to cryptocurrency holders on July 30. The letter demands registration on a 'Digital Asset Compliance Portal' by a specified deadline. Scanning the enclosed QR code leads to a fake website designed to resemble the official IRS homepage.

The fake site demands not only names and financial information but also cryptocurrency wallet information, exchange login details, recovery phrases, and private keys. Jarod Koopman, Director of IRS Criminal Investigation (IRS-CI), stated, "Criminals exploit public trust in government agencies to create plausible fake websites and letters that appear to be official documents. If you receive an unexpected request for personal information, stop responding, verify the source, and report it to law enforcement."

Coinbase (COIN) and cybersecurity firm Darktower tracked the infrastructure used by the fraud organization. The domain for the fake site was registered through a Hong Kong registrar just before the forged letters were disseminated. The website operated from a Romanian server. This network has a history of being used to operate phishing sites impersonating financial institutions.

The IRS urged people not to scan QR codes from unknown sources or open suspicious links. Account information should also not be provided until the authenticity of the letter has been verified. Recipients can check their IRS online account and official notice forms or contact customer service directly. Fake letters, emails, text messages, websites, social media accounts, and phone calls can also be reported to the IRS.

In a separate incident impersonating Coinbase, approximately 100 victims transferred funds to the attacker's wallet. The damages are reportedly close to $16 million. If account information has already been provided, passwords should be changed immediately, and the incident should be reported to financial institutions or cryptocurrency exchanges. Related letters and messages should be preserved, and account activity should be reviewed. The IRS emphasized setting up multi-factor authentication and never disclosing recovery phrases or private keys for any compliance demands.

[Article Key Summary]

-The U.S. IRS has issued a fraud alert regarding forged tax notices targeting cryptocurrency wallets and personal information.

-The QR code in the letter leads to a phishing site mimicking the official IRS website, demanding even recovery phrases and private keys.

-Coinbase and Darktower confirmed that the fake site was registered in Hong Kong and operated from a Romanian server.

*Disclaimer: This article is for investment reference only, and we are not responsible for any investment losses based on it. The content should be interpreted for informational purposes only.*