Photo by Shutter Speed on Unsplash
…
What do tax scammers do during the summer? They come up with new ways to steal our personal data. And identities. And money.
The latest criminal tax scheme is a bogus Internal Revenue Service online option touted as a way for crypto owners to fulfill their federal tax obligations.
Don’t be fooled by the purported online IRS Digital Asset Compliance Portal. It is fake.
IRS Criminal Investigation (IRS-CI), the federal tax agency’s law enforcement branch, is now onto the scheme, with help from some private sector cyber security companies that tracked the source of the threat.
But the IRS still is issuing warnings (like the one below from X nee Twitter) to ensure that no one else falls prey.
Here’s how we got to this new digital assets scam, and how to avoid falling victim to this bogus tax outreach.
…
…
Scams evolved along with digital advances: Digital assets, what is popularly though not strictly or limited to cryptocurrency, have been around in some form (or discussion) for more than three decades. The sector finally took off in full force with the emergence of Bitcoin in 2008.
But it wasn’t until 2021 that the Internal Revenue Service formally announced how it would deal with digital transactions. In Notice 2014-21, the tax agency said it would treat virtual currencies as property, not as legal tender.
Since then, when digital asset owners use digital assets as payment for goods or services or the receipt of digital assets for goods or the performance of services, tax is levied on the short- or long-term capital gains the transactions produce.
And the IRS has been trying to ensure digital asset tax compliance, with mixed results, ever since.
So, it’s no surprise that scammers jumped into the crypto tax area. The most common fraud attempts typically have asked/demanded that victims pay fake due tax bills using cryptocurrency. You’ll find such cons regularly listed in the IRS’ annual Dirty Dozen tax scams.
This summer, the con artists expanded into the more proactive bogus Digital Asset Compliance Portal.
Merging real and fake tax tricks: Like almost all tax cons, the perpetrators combine a bit of real tax info with their lies. They also use several types of known IRS contact with taxpayers.
Here, the fraudsters start by utilizing the typical way that the tax agency makes first contact with filers about any tax issues. They mail fake IRS letters to cryptocurrency holders. That’s a redacted copy below.…
…
The letter seems real in an attempt to steal personal information and digital assets, according to IRS Criminal Investigation (IRS-CI). It is formatted like official IRS notices. It also cites notice number CP14-432RA.
But while CP14 is a legitimate IRS notice that the agency sends when a taxpayers owes a tax balance, there is no such thing as IRS notice CP14-432RA.
The fake letter directs recipients to a website that mimics IRS.gov. That’s another typical ploy con artists use. Look-alike (or look-close-enough) online sites give the scheme a (thin) veneer of legitimacy.
“Criminals continue to exploit public trust in government agencies by creating convincing fake websites and official-looking correspondence,” noted IRS Criminal Investigation (IRS-CI) Chief Jarod Koopman.
But the only official IRS website is IRS.gov. This scam wants its victims to go to a fake one ending with a .com suffix.
Those who do go to the fake site will be instructed to register with the nonexistent Digital Asset Compliance Portal. The crooks try to create urgency by giving their crypto-owning victims a deadline by which they must enroll at the portal. And to make the steal easier, the letter provides a QR code that recipients can scan to get to the fake portal.
Again, the QR bit is based on a tax reality. The IRS does include QR codes in some of its redesigned notices. But neither this notice nor the scannable code is real.
If they follow the con artists’ instructions, the fake digital tax compliance site may ask for personal information, cryptocurrency wallet information, exchange account credentials, or other sensitive data.
All this information will not go to the IRS to ensure tax compliance, since the IRS did not send the letter and does not operate a Digital Asset Compliance Portal. Instead, the criminals who created this scam will log-out with victims’ identities and/or digital assets.
You can read more about this digital assets fraud, which includes follow-up phone calls to targets the criminals deem the most valuable, in Coinbase’s blog item about the scheme.
Avoiding this and other scams: IRS-CI issued the Digital Asset Compliance Portal fraud alert in late July after working with cryptocurrency exchange Coinbase and DarkTower, a cyber intelligence and threat investigation firm.
The private sector investigators traced the infrastructure behind this campaign to a domain registered through a Hong Kong registrar. It had been registered just days before the fake letters were mailed to crypto-holders. The site was hosted in Romania on a network known for hosting phishing pages fraudulently tied to financial institutions.
Again, such international connections are typical with tax, and other, online fraud efforts. The global tangled web means it takes more time for investigators to untangle them.
“Before responding to unexpected requests for personal information, stop, verify the source, and report potential fraud schemes to law enforcement,” said IRS-CI’s Koopman.
Here are some specific ways to protect yourself.
- Don’t scan QR codes from unsolicited letters, emails, or text messages, especially those claiming to be from a government agency.
- Hang up if someone claims to be from a government agency and asks for payment or personal information. Contact the agency directly using information from its official website.
- Slow down and verify the situation; scammers create false urgency to push victims into quick decisions.
- Protect your personal and financial information, especially in response to unsolicited messages. Never share wallet recovery phrases or private keys.
- Consult a trusted family member, financial advisor, or attorney before sending money or making major financial decisions.
- Monitor financial accounts regularly and report suspicious activity immediately. Enable multifactor authentication on accounts.
- Be cautious of new online acquaintances and verify identities before engaging further.
- Report suspicious IRS-related communications immediately.
The IRS has made reporting scams easier. In February, it launched a new consolidated tax fraud web page.
And if you or someone you know has been impacted by a fraud scheme, don’t be ashamed to admit it. You are most definitely not alone. But you do need to take some additional steps.
Stop communicating with the fraudster. Change passwords for affected financial accounts. Contact your financial institution or cryptocurrency exchange immediately if you shared credentials. Preserve screenshots, emails, and letters so that you can share them with investigators.
Stay alert for digital asset scams and tax developments: As noted at the start of this item, the IRS has been lagging in its response to our changing, and taxable, digital world. It’s not alone. The courts are facing challenges, too.
“When detailed tax guidance exists, it has generally been fact-specific and limited in scope,” writes Milan N. Ball, a legislative attorney for the Congressional Research Service, in his Sept. 2 CRS report on developments in the tax treatment of digital assets.
Ball also points out that federal lawmakers have proposed legislation aimed at clarifying the existing tax treatment of digital assets and altering the tax treatment of digital assets in certain types of transactions.
However, Ball also notes that “The dynamism of digital assets complicates the formulation of a flexible and clear digital assets tax regime. … As new types of digital assets emerge, Congress may evaluate whether existing tax laws adequately address the new digital asset and determine whether new and more targeted legislation is needed.”
As Congress (and the IRS) sort their way through this process, digital asset owners must take care. Not only must they ensure they comply with the current tax law, but also avoid being scammed by crooks who are taking advantage of this complicated and confusing area.
