France hit by Crypto Scams - fake Tax Letters Use EU's DAC8 Crypto Rules to Steal Wallet Recovery Phrases

French National Police have warned crypto holders about fake "formal notices" posted in the name of France's tax authority, the Direction générale des Finances publiques (DGFiP). The letters use the EU's new DAC8 crypto-reporting rules as cover and carry a QR code that leads to a fake "digital assets portal". That site asks for the victim's tax login and then the recovery phrase of their crypto wallet, which gives full control of the funds.

The Police nationale issued the alert on Facebook and X on 29 October 2026. The campaign has been running since at least late August 2026, and the letters have been reissued with new dates and new web addresses.

What the letter says

The letter carries the "République Française" letterhead and the address of the DGFiP's Service des Impôts des Particuliers at 139 rue de Bercy, Paris. It is headed "Formal notice: reporting obligations relating to digital assets (DAC8 Directive)". The copy published by the police has reference MEC-2026-06-DAC8, is dated 28 September 2026 and covers tax years 2024 and 2025.

Key lines, translated from French:

• "Information transmitted by digital asset service providers (PSAN) registered with the AMF shows that you carried out transactions in digital assets during tax years 2024 and 2025."
• "The DGFiP has set up the Digital Assets Portal, operated in conjunction with approved compliance bodies."
• "You must complete your mandatory registration and connect your accounts via the Digital Assets Portal before 29 October 2026."
• "Scan the secure QR code below with your mobile device to access the official portal."
• "Receipt of this regulatory notice requires immediate action."

The letter asks recipients to list every exchange, wallet and DeFi protocol they use, wherever it is based. It then threatens penalties: a fine of 750 euros per undeclared digital-asset account, rising to 1,500 euros above 50,000 euros (Article 1736 of the General Tax Code, CGI), a 40 to 80% surcharge (Article 1729), late interest of 0.20% a month (Article 1727), and a full personal tax audit (ESFP).

Where the QR code leads

Media report: Numerama reported on 29 October that the QR code on the latest version points to reglement2026.com, a domain with no link to the tax administration that security vendors on VirusTotal already flag as malicious. The site copies the look of a government page, asks for tax login details and then for the wallet recovery phrase.

Earlier versions used other addresses. Media report: the consumer site Signal Arnaques described a version dated 31 August 2026 (reference MEC-2026-08-DAC8, deadline 5 September) whose QR code led to dac8flattax.com, registered on 28 August through a Vietnamese registrar. The site cloned the impots.gouv.fr page for Form 2086 and, after a fake tax questionnaire, asked for the recovery phrase word by word. The fraud-analysis site Synaris reported another version pointing to conformitecan.com, registered on 29 August. BFM TV reported the letter on 4 September and the accountancy network Cerfrance issued a client alert on 24 September. The Ministry of Cyber Affairs has not independently scanned the QR codes or checked these domains.

No figures have been published on how many letters were sent, how many people lost money, or whether the recipients were chosen because they hold crypto.

Why it looks credible

The letter mixes real rules with false claims, so a quick check of individual details appears to confirm it.

• DAC8 is real. Directive (EU) 2023/2226 of 17 October 2023 extends the EU's automatic tax-information exchange to crypto-assets, and has applied since 1 January 2026.
• The penalties are real. Article 1736 X of the CGI does fine an undeclared foreign digital-asset account 750 euros, or 1,500 euros where its value exceeded 50,000 euros during the year. Articles 1729 (40% and 80% surcharges) and 1727 (0.20% monthly late interest) are also real, as is the ESFP audit procedure.
• The forms are real. Form 2086 declares crypto capital gains and Form 3916-bis declares crypto accounts held abroad.
• The address is the DGFiP's real address at Bercy.

Red flags

• The "Portail des actifs numériques" does not exist. Crypto holders in France declare through their annual income tax return on impots.gouv.fr, according to Cerfrance and the consumer sites that examined the letter.
• The DGFiP does not send people to a QR code to register their crypto, and no tax authority asks for a wallet recovery phrase. Anyone who has the phrase can empty the wallet.
• The legal citations are wrong. Loi No. 2024-537 is dated 13 June 2024 (the letter says 12 June) and deals with business financing and electronic transferable records, not DAC8. France actually transposed DAC8 through Article 54 of the 2025 Finance Law (Loi No. 2025-127 of 14 February 2025). Décret No. 2025-169 of 21 February 2025 concerns the MiCA crypto-markets rules, not the OECD Crypto-Asset Reporting Framework (CARF).
• DAC8 puts obligations on crypto platforms, not on individuals. It creates no registration, portal or personal deadline for taxpayers.
• The deadline was a month after the letter date and the text demands "immediate action", a standard pressure tactic. BFM TV also noted spelling mistakes in the text.
• Real DGFiP websites use .gouv.fr addresses and its emails come only from @dgfip.finances.gouv.fr.

The real DAC8 timeline across the EU

• 17 October 2023: Directive (EU) 2023/2226 (DAC8) adopted. It builds on the OECD's Crypto-Asset Reporting Framework.
• 1 January 2026: the rules apply in all EU member states. Crypto-asset service providers start collecting data on the transactions of EU-resident users.
• 31 January 2027: first deadline in France for providers to report 2026 data to the DGFiP. Other member states set their own national deadlines.
• By 30 September 2027: tax authorities exchange the 2026 data with the user's country of residence, according to the European Commission.

For individuals nothing changes: they keep declaring and paying tax on crypto as before.

Not just France

Tax authorities in other EU countries have reported phishing that uses DAC8 as bait, so far by email rather than post.

• Netherlands: on 15 January 2026 the Belastingdienst warned of fake emails asking crypto holders to log in with DigiD and give details of their holdings. It received nine new variants in the first week of January alone, followed in some cases by fake staff trying to book a phone call. It said DAC8 has no tax consequences for crypto holders and gives it no reason to request information by email.
• Germany: the Federal Central Tax Office (BZSt) has warned of emails claiming "discrepancies in crypto declarations" under DAC8 and directing people to a fake "Mein Elster" login. Media report: heise online reported on 7 January 2026 that the emails demanded a review within five working days and threatened fines of up to 50,000 euros.

Physical letters are a growing tactic in crypto theft. Media report: BleepingComputer reported in February 2026 that letters posing as hardware-wallet makers Trezor and Ledger used QR codes to lead users to pages asking for their recovery phrase.

What to do

The Police nationale's advice:

• Do not scan a suspicious QR code.
• Never share your recovery phrase.
• If in doubt, go directly to the official tax website by typing impots.gouv.fr into your browser.

In France:

• Check your personal account on impots.gouv.fr, call your local tax office, or call Impôts Service on 0 809 401 401.
• Report fraud and get help through 17Cyber (17cyber.gouv.fr) or cybermalveillance.gouv.fr.
• Report a fraudulent website to Pharos (internet-signalement.gouv.fr).
• Forward fraudulent text messages to 33700.
• If you entered your recovery phrase, move any remaining funds to a new wallet with a new phrase straight away, change your tax account password, and file a complaint with the police or gendarmerie.

Elsewhere in the EU:

• Verify any tax letter or email only through your tax authority's official website or app, typed in by hand.
• In the Netherlands, forward fake emails to [email protected].
• Report losses or attempted fraud to your national police or its online cybercrime reporting service.

Source: Police nationale (France), 29 October 2026; European Commission; Belastingdienst; BZSt; Numerama; BFM TV; Signal Arnaques; heise online.