Crypto Scams September 2026: The Complete Active Threats List
Crypto Scams September 2026: Active Threats to Watch
A letter arrives in the mail. It carries a real-looking government seal, a case number, and a deadline that feels too specific to be fake.
For a growing number of digital asset holders across the United States, that letter is the first sign they have walked straight into one of the year's most convincing frauds.
Crypto Scams September 2026 are no longer confined to sketchy Telegram links or too-good-to-be-true trading bots.
This month's threat list includes a mail-based government impersonation campaign with a live deadline, AI-generated video fraud, wallet-draining smart contract approvals, and a physical kiosk scam that keeps growing despite years of warnings.
Below is a breakdown of what is currently active, how each scheme works, and how to verify before acting.
What Are the Active Crypto Scams Right Now?
The most urgent among current crypto scams September 2026 is a fake Internal Revenue Service letter directing recipients to a nonexistent "Digital Asset Compliance Portal."
Alongside it, AI deepfake investment pitches, wallet drainer links, approval phishing, and crypto ATM impersonation scams remain widespread. Each relies on urgency and borrowed trust rather than technical hacking skill.
The Fake IRS Digital Asset Compliance Portal Letter
This is the clearest example of an active crypto scam threat circulating right now, and it arrives through the mail rather than email.
The Internal Revenue Service confirmed in a fraud alert that fraudsters are mailing counterfeit letters to cryptocurrency holders, instructing them to enroll in a "Digital Asset Compliance Portal" before a stated deadline. No such portal exists.
The letters:
Reference real tax years spanning 2017 through 2026 to appear legitimate.
Include a fabricated notice number and an urgent enrollment deadline, often falling in early or mid-September.
Carry a QR code that leads to a look-alike site mimicking IRS.gov.
Request wallet details, exchange login credentials, or recovery phrases once the victim reaches the fake portal.
IRS Criminal Investigation Chief Jarod Koopman noted that criminals continue to exploit public trust in government agencies through convincing correspondence and fake websites.
Anyone who receives an unsolicited IRS crypto scam letter should not scan the QR code, should not enter any information, and should verify directly through IRS.gov rather than any number printed on the letter itself.
AI Deepfake Investment Platforms
An AI deepfake crypto scam is now one of the fastest-growing categories tracked heading into this cycle.
According to Chainalysis's 2026 Crypto Crime Report, impersonation scams surged roughly 1,400% year over year, and AI-enabled fraud increased sharply as generative tools made fake endorsements harder to distinguish from real ones.
The pattern is consistent across cases: a cloned video of a public figure or company executive promotes a fake crypto investment platform promising guaranteed daily returns.
The dashboard looks polished, small withdrawals are permitted early to build confidence, and larger deposits are later locked.
This is one of the clearest examples of new crypto scams this month where the underlying trick, a Ponzi-style deposit scheme, is old but the delivery method through AI video is what makes it convincing.
Red flags to watch:
Any celebrity or executive "endorsing" guaranteed or fixed daily returns
Video with slightly mismatched lip movement, lighting, or audio
Pressure to deposit quickly before a limited-time bonus expires
Platforms with no verifiable registration or audited smart contract
Wallet Drainer and Approval Phishing Attacks
A wallet drainer scam does not require a victim to hand over a private key directly.
Instead, it tricks the user into signing a malicious smart contract approval, often through a cloned decentralized app or a fake wallet-connect prompt. Once signed, the attacker gains standing permission to move tokens without further action from the victim.
This is part of a broader category of crypto phishing 2026 activity that includes:
Technique | How It Works | Primary Defense |
Approval phishing | Malicious contract requests token spending permission | Review and revoke unused approvals regularly |
Wallet drainer links | Fake dApp or airdrop page connects wallet, drains assets on signature | Never connect a wallet to an unfamiliar site |
Address poisoning | Scammer sends a look-alike address to trick future copy-paste transfers | Always verify the full address before sending |
Reviewing active token approvals through a wallet's permissions dashboard and revoking anything unused is one of the simplest ways to reduce exposure to this category of fraud.
Bitcoin ATM and Crypto Kiosk Impersonation Scams
Crypto kiosk scams remain one of the largest sources of reported losses. Data cited by AARP from FBI Internet Crime Complaint Center reports shows Americans lost more than $333 million to bitcoin ATM scams in a single reporting period, with individuals aged 60 and older accounting for the majority of losses.
The FBI has also reported that total crypto-related fraud losses topped $11 billion in 2025 across all categories.
The scheme typically starts with a phone call impersonating a government agency, bank, or tech support line.
The caller instructs the victim to withdraw cash, locate a nearby crypto kiosk, and scan a QR code to send funds. No legitimate agency accepts payment through a cryptocurrency kiosk under any circumstance.
How to Verify Before You Act
Knowing how to avoid crypto scams in the current environment comes down to a short verification habit rather than memorizing every scheme.
Confirm any government or company notice through the official website typed directly into a browser, never through a link or QR code in the message
Never sign a wallet approval or connect a wallet to a site received through an unsolicited message
Treat any guaranteed or fixed return claim as a warning sign, regardless of who appears to endorse it
Verify the full recipient address on every transfer, not just the first and last characters
Ignore any instruction to pay through a crypto kiosk on behalf of a government agency or law enforcement
Expert Opinion
Analysts tracking the current threat environment note that the shift from purely digital scams to mail-based and voice-cloned fraud reflects a deliberate move by criminal groups toward channels with lower detection rates.
The Digital Asset Compliance Portal letter campaign, in particular, is viewed as significant because it targets a demographic already primed to expect real correspondence from tax authorities during reporting season.
Analysts suggest that as blockchain surveillance and exchange-side fraud detection improve, social engineering aimed directly at individuals is likely to remain the primary attack vector through the remainder of 2026.
Disclaimer: This article is for informational purposes only and does not constitute financial, investment, tax, or legal advice. Cryptocurrency transactions are irreversible, and no government agency or law enforcement body accepts payment through cryptocurrency. Readers should independently verify any communication claiming to be from a government agency, exchange, or financial institution before taking action.
