Follow us on Google News
French authorities have warned cryptocurrency investors about a phishing campaign involving fraudulent tax notices that impersonate the country’s tax administration. The letters misuse the European Union’s DAC8 cryptocurrency reporting rules to trick recipients into visiting fake government websites and revealing their wallet recovery phrases.
Police issued a public warning after identifying letters designed to steal sensitive financial information.
How Does the Fake Crypto Tax Scam Work?
Fraudsters send physical letters claiming to come from France’s tax authority, the Direction générale des Finances publiques (DGFiP).
The notices carry official-looking government headings, addresses and references to cryptocurrency reporting requirements.
Recipients are instructed to register their digital assets through a supposed government portal by scanning a QR code.
However, the code redirects them to a fraudulent website that imitates an official tax service. The site requests tax account login credentials and subsequently asks for the recovery phrase associated with the victim’s cryptocurrency wallet.
Why Do the Letters Appear Genuine?
The fraudulent notices combine genuine tax provisions with fabricated compliance requirements.
They refer to the EU’s DAC8 directive, which concerns the collection and exchange of cryptocurrency transaction information between tax authorities.
The letters also threaten financial penalties, including fines of €750 or €1,500 and additional tax surcharges ranging from 40% to 80%.
https://the420.in/fcrf-certified-chief-ai-officer-second-cohort-november-2026/
Although these penalties exist in specific circumstances under French tax law, the notices misleadingly present them as consequences of failing to register through the fraudulent portal.
What Did Investigators Discover?
The campaign has reportedly been active since at least August 2026, with different versions of the letters using changing website addresses and deadlines.
One notice dated September 28 instructed recipients to complete registration by October 29.
The QR codes reportedly directed users towards websites resembling government tax portals. Investigators also identified attempts to obtain wallet recovery phrases after users entered their tax credentials.
The number of letters distributed and the financial losses, if any, have not been established.
What Are the Actual DAC8 Requirements?
DAC8 is a genuine European Union directive introduced to strengthen tax transparency involving cryptocurrency transactions.
Its reporting requirements began applying on January 1, 2026, with cryptocurrency service providers responsible for collecting relevant transaction information.
In France, the first reporting deadline for providers covering 2026 transactions is January 31, 2027.
The directive does not require individual cryptocurrency holders to register through a newly created digital assets portal or disclose wallet recovery phrases.
Have Similar Scams Appeared Elsewhere?
Authorities in Germany and the Netherlands have also reported phishing attempts exploiting DAC8-related tax requirements.
In those countries, fraudulent emails reportedly directed recipients to fake login pages and requested sensitive account information.
The incidents indicate that criminals are using unfamiliar cryptocurrency regulations to make financial phishing messages appear credible.
How Can Cryptocurrency Investors Stay Safe?
Cryptocurrency holders should independently verify unexpected tax notices, particularly those containing QR codes, unfamiliar websites or urgent payment demands.
In France, tax information should be checked through the official website, impots.gouv.fr.
Investors must never disclose wallet recovery phrases to tax officials, customer support representatives or unfamiliar websites. Anyone who has exposed a recovery phrase should immediately transfer remaining funds to a newly created wallet with a different recovery phrase and report the incident to the relevant authorities.
The case highlights how genuine financial regulations can be misused to create convincing phishing scams that place cryptocurrency holdings at risk.
