Fake investment sites and counterfeit IRS letters hit crypto holders in the same week

Con artists are working the Twin Tiers with a fake investment pitch, New York State Police say. It pushes residents into cryptocurrency or gold bars and coins, then empties their accounts when they give financial details.

Investigators issued the alert this week. Those who fall for it can lose their whole savings.

How the Twin Tiers pitch works

New York State Police said the callers spend some time establishing rapport with the person they are targeting before they lead them to a website that appears to be a legitimate investment platform. Once a victim enters their banking or account details into that site, the money is at risk.

Troopers are warning people who receive a random call about buying crypto or gold to not provide any information and not to visit any website the caller suggests.

State Police advise hanging up and dial 9-1-1. The advice is even more pointed if a caller offers to sell cryptocurrency and requests financial information.

Anyone who thinks they have already been caught should call local law enforcement or the NYSP immediately, then contact the bank and close all accounts, State Police said.

A federal warning landed days earlier

On July 30, IRS Criminal Investigation reported that fraudsters were sending fake IRS letters to cryptocurrency holders. The letters tell recipients they must sign up for a “Digital Asset Compliance Portal” by a deadline, but there is no such portal.

The letters include a QR code that takes victims to a website that is designed to look like IRS[.]gov, where the page asks for personal information, wallet information, or exchange login credentials, the agency said.

“The IRS does not operate a Digital Asset Compliance Portal,” the release stated. “This is a scam.”

IRS-CI Chief Jarod Koopman said, “Before responding to unexpected requests for personal information, stop, verify the source, and report potential fraud schemes to law enforcement.”

The agency does include QR codes on some legitimate notices, including CP53E letters, so an IRS-CI representative said taxpayers should ignore the codes printed on any letter and go directly to IRS[.]gov or call using the contact information there.

The IRS’s release did not explain how the mailers obtained the names and addresses of crypto holders. An IRS-CI representative declined to discuss the scope of the campaign.

Coinbase and the cybersecurity firm DarkTower traced the operation to a domain established through a Hong Kong registrar and hosted in Romania.

In May, Cryptopolitan reported scammers were sending fake “Quantum Resistance Security Update” letters to Ledger customers with QR codes leading to sites that stole 24-word recovery phrases.

Americans lost about $21 billion to cyber-enabled crimes and online scams in 2025, the FBI said, a figure Cryptopolitan cited in past reporting.

If you're reading this, you’re already ahead. Stay there with our newsletter.