Why the letter cannot be genuine
The Kryptowerte-Steuertransparenzgesetz (KStTG) places every duty on the provider. The provider identifies its users and obtains the self-certification (§§ 3 to 6). The provider reports yearly by 31 July to the BZSt (§ 9(1)). The provider informs you before the first report that your data is collected and reported to the BZSt for forwarding to the state tax authorities (§ 13). The provider pays the fines if it fails (§ 18). Crypto-asset operators without an EU authorisation must register (§ 17). Nowhere does the BZSt write to a user, demand a registration or fine an account. A letter that does exactly that contradicts the law in whose name it appears.
Eight marks of the forgery
| Mark | Why it is not genuine |
|---|---|
| A portal, a link, a QR code | The KStTG knows no registration of users. Crypto-asset operators without an EU authorisation must register (§ 17). A 'portal for crypto-assets' or 'portail des actifs numériques' for private persons does not exist. |
| A 'self-certification' to the authority | The self-certification is real, but it goes to your provider (§§ 3 to 6), which checks and reports it. No authority asks you for it directly. |
| Connect a wallet, enter a seed phrase | Neither the tax office nor the BZSt connects wallets. Whoever has the seed phrase has the money. That is the letter's actual purpose. |
| A deadline in days | The law's real deadlines are yearly: the report by 31 July (§ 9(1)), a block no earlier than 60 days after a provider's request (§ 8(3)). A letter demanding action 'within 5 days' is not one. |
| A fine 'per account' or 'per wallet' | The KStTG's fines are aimed at providers: up to EUR 50,000 for missing self-certifications, reports or registrations, up to EUR 10,000 for record-keeping (§ 18). No sentence of the law fines a user per account. |
| A file number with 'DAC8' in it | DAC8 is an EU directive, not a reference number. Genuine letters from a tax office carry your tax number and the office with its address; the BZSt does not write to users in this procedure at all (§ 13 names the provider as the sender of the information). |
| The sender address | Authorities write from the administration's .de addresses or by post. A mail from a freely registered domain carrying an authority's logo is the most common case; Berlin's tax administration warns of exactly such mails about 'discrepancies in crypto information'. |
| The tone | A genuine letter does not threaten 'immediate suspension' and does not demand a reply by scan. Urgency plus jargon is the pattern phishing warnings have described for years. |
What a genuine notice is
There are two kinds. First, your provider's notice under § 13 KStTG, before the first report, through its usual channel: the app, the mailbox at the provider, a mail from its known address. It demands nothing, it informs, and it leads to no foreign portal. Second, a letter from your tax office about your tax return, with your tax number, by post, with the office's own call-back number. The tax administration states that it never asks by mail, SMS or phone for payments or data.
What to do when such a letter arrives
- Scan nothing, click nothing, enter nothing.
- Check the letter with your tax office's number from its own website, not the number in the letter.
- If you have already entered a seed phrase: move the funds to a new wallet at once, then report it.
- Report the case to the consumer centre or the police; in France signal-arnaques.com, in Germany the Verbraucherzentrale's phishing desk.
- Ask your provider whether it has already informed you under § 13. That notice is the only genuine one you should expect on DAC8.
For companies: the second letter after founding
Whoever founds a company gets the same trick on paper: fake invoices from a 'court' or 'register' in the days after the commercial-register entry, with a foreign IBAN and a short deadline. The real court cashier sends its invoice too, just without urgency. A founder documented both letters side by side in October 2026; the rule he drew from it holds generally: after a founding, only the notary, the state cashier, the tax office, the city, the chamber of commerce, the accident insurer and the broadcasting fee service write legitimately. Everything else is checked before it is paid.
Who reports me? The providers by the register
Sources: KStTG, gesetze-im-internet.de, read on 22.10.2026, §§ 3 to 6, 8, 9, 13, 17, 18. German forgery: Mimikama, 'Krypto-Steuerprüfung als Fake des BZSt', 07.04.2026, with file number DAC8-2024-001 and mail dated 31.03.2026. French forgery: reports by Clubic, Korben and presse-citron, September 2026, reference MEC-2026-08-DAC8, letter dated 09.09.2026; an affected holder published the letter on X on 22.10.2026. Berlin tax administration's warning on mails about 'discrepancies in crypto information': berlin.de/sen/finanzen. Founding invoices: Lukas Hermann, 'From Einzelunternehmen to GmbH', lukashermann.dev, 20.10.2026. This page is not legal advice.