French authorities have warned cryptocurrency investors about a phishing campaign involving forged tax notices that impersonate the country's official tax administration. The fraudulent letters misuse the European Union's cryptocurrency reporting rules under the DAC8 directive to convince recipients to visit fake government websites and disclose sensitive financial information.
The campaign reportedly involves physical letters carrying official-looking government references, tax-related language and QR codes. Recipients are instructed to register their cryptocurrency holdings through a purported government portal. However, the QR codes lead to fraudulent websites designed to collect tax account credentials and cryptocurrency wallet recovery phrases.
The warning highlights how criminals are exploiting public uncertainty around new digital-asset reporting requirements to make fraudulent communications appear legitimate.
How the Fake Cryptocurrency Tax Scam Operates
The fraudulent notices claim to have been issued by France's tax administration, the Direction générale des Finances publiques (DGFiP).
The letters reportedly use government-style headings, official-looking addresses and references to cryptocurrency tax compliance. Recipients are asked to scan a QR code and complete a supposed digital-asset registration process.
The linked websites imitate official tax portals. After visitors enter their tax account details, the pages reportedly request the recovery phrase associated with their cryptocurrency wallets.
A wallet recovery phrase is highly sensitive information that can provide control over the assets held in a cryptocurrency wallet. Sharing it with an unauthorised party can expose those assets to theft.
Genuine Tax Rules Used to Make Fraudulent Letters Convincing
The scam relies on references to DAC8, a genuine European Union directive designed to improve tax transparency and the exchange of information about cryptocurrency transactions between tax authorities.
By incorporating real regulatory terminology, the fraudulent notices attempt to create a sense of official authority and urgency.
Some versions reportedly threaten recipients with penalties of €750 or €1,500, alongside additional tax surcharges ranging from 40% to 80%. Although French tax law contains penalties for certain compliance failures, the letters misleadingly connect them to registration through the fraudulent websites.
The use of genuine legal references alongside fabricated instructions makes the campaign particularly concerning for investors who may be unfamiliar with the new reporting framework.
Investigators Identify a Campaign Running Since August
According to the supplied report, the fraudulent letters have circulated since at least August 2026, with different versions containing changing website addresses and compliance deadlines.
One notice dated September 28 reportedly instructed recipients to complete registration by October 29. Investigators identified QR codes directing people to websites resembling official French tax portals.
The campaign has reportedly attempted to collect both tax account credentials and cryptocurrency wallet recovery phrases. However, the total number of letters distributed and the financial losses caused by the operation have not been established.
French media reports also described a police warning issued on October 29 about fraudulent letters impersonating the DGFiP and targeting cryptocurrency holders.
What DAC8 Actually Requires
DAC8 is a genuine EU directive that expands automatic tax-information exchange to include crypto-asset transactions.
The rules took effect on January 1, 2026. They require reporting crypto-asset service providers to collect information about reportable transactions and submit it to relevant tax authorities. The first reporting cycle covers transactions from 2026, with information exchanges between EU countries expected by September 30, 2027.
Importantly, these reporting obligations are directed at crypto-asset service providers. They do not create a requirement for individual investors to scan QR codes in unsolicited letters or disclose their wallet recovery phrases through a newly introduced government portal.
The French tax administration also publishes warnings about fraudulent communications impersonating its services and advises people to verify suspicious messages through official channels.
How Cryptocurrency Investors Can Protect Their Information
The incident highlights the importance of checking unexpected tax communications before responding to them. Investors should treat unfamiliar links, QR codes and urgent demands for financial information with caution.
In particular:
Verify tax notices independently through the official French tax website, impots.gouv.fr.
Do not enter tax credentials on websites reached through unexpected QR codes or links.
Never disclose a cryptocurrency wallet's recovery phrase to another person or website.
Contact the relevant tax administration through independently verified contact details if a notice appears suspicious.
Report suspected impersonation or phishing attempts to the appropriate authorities.
The broader lesson is that genuine regulatory changes can become tools for financial fraud when criminals use official terminology and fabricated compliance deadlines to create urgency.
For financial institutions, businesses and individuals, the case reinforces the importance of cybersecurity awareness, financial controls and independent verification of official-looking communications. Shunyatax's financial investigation and forensic support can be relevant to examining suspected financial irregularities.