preferred on
Points of Focus
- A fake French tax notice urged crypto holders to register through a QR-linked portal before Sept. 25.
- The letters impersonate France’s DGFiP and invoke the EU’s DAC8 rules.
- An earlier version led users to a cloned tax site that requested wallet recovery phrases.
A fake French tax notice is giving crypto holders until Sept. 25 to register through a QR-linked portal that impersonates the country’s tax administration and invokes the EU’s DAC8 reporting rules.
A Sept. 15 Signal-Arnaques report documents a letter dated Sept. 9 carrying the reference “MEC-2026-08-DAC8.” It claims information supplied by digital asset service providers shows the recipient conducted crypto transactions in 2024 and 2025.
The notice threatens fines of 750-1,500 euros, tax increases of 40%-80%, late-payment interest and a possible audit. It reproduces French government branding and lists 139 rue de Bercy in Paris, the real address of the Direction Générale des Finances Publiques (DGFiP) headquarters.
The same reference appeared on an Aug. 31 letter with a Sept. 5 deadline. Security researcher Anthony Legros investigated that version after photographs circulated online on Sept. 3.
Fake portal sought wallet recovery phrases
Investigators decoded the QR code in the Aug. 31 letter and traced it to “dac8flattax.com,” a domain registered three days earlier. The site copied France’s official page for Form 2086, which is used to report gains and losses from digital asset sales.
Visitors were asked about exchanges, staking, airdrops, transfers, previous crypto declarations, and wallet providers. The final step requested the first four letters of each word in the wallet recovery phrase. Signal-Arnaques found those prefixes were enough to reconstruct the words using the BIP39 list. Researchers also identified code sending wallet details, recovery phrases, passphrases, and email addresses to the site’s servers.
How the scammers selected recipients for physical mail remains unclear.
Crypto thieves have recently used compromised brands, government infrastructure, and offline payment channels to reach victims. A compromised HBO Max Reddit account was used to distribute crypto-stealing malware, while another campaign used an Italian government email domain to obtain information on Revolut customers. A separate class action involving Athena Bitcoin (BTC) kiosks alleges that scammers directed victims to crypto ATMs during impersonation schemes.
DAC8 reporting began in 2026
DAC8 expanded the EU’s tax transparency framework to crypto assets from Jan. 1, 2026. Crypto-asset service providers covered by DAC8 must collect information on reportable transactions involving EU-resident users from 2026. Reporting for the 2026 year is due by Sept. 30, 2027.
France implemented DAC8 through national tax rules adopted in 2025. The DGFiP’s official guidance describes reporting and due diligence requirements for crypto asset service providers.
The fraudulent letters combine real tax forms, government addresses, and penalty language with incorrect legal references. They cite a 2024 law unrelated to crypto taxation and a 2025 decree dealing with Markets in Crypto-Assets (MiCA) implementation as supposed legal bases for the demand. Signal-Arnaques found no DGFiP “Digital Assets Portal” matching the one described in the letters.
The campaign surfaced weeks after a separate breach of DGFiP systems. France’s Finance Ministry disclosed that attackers used compromised credentials in June and July to access and extract data concerning 678,000 individuals and businesses, including tax, contact, and cadastral information. According to the ministry, user passwords and online tax accounts were not compromised. French authorities have not linked that breach to the DAC8 phishing letters.
Share
Most read articles
