Scammers are mailing personalized letters with QR codes to crypto wallet owners, faking urgent security updates. Here's how the scam works and how to spot it.
Think about this for a second. If you were running a phishing scam, would you pay for printing, an envelope and a stamp when an email costs nothing and lands in someone's inbox in two seconds? Most scammers wouldn't. That's kind of the whole appeal of phishing online, it's free and it scales. But over the last few months a specific group of scammers has been doing the opposite. They're mailing actual printed letters, QR code and all, to the real home addresses of people who own crypto hardware wallets. Somebody is paying real money for stamps here, and that alone tells you the scam is working well enough to be worth it.
What's showing up in people's mailboxes
According to Cryptopolitan's reporting on the campaign, these letters aren't sloppy. They're professionally printed, they include a QR code, and, oddly enough, they list the recipient's correct hardware wallet model along with their order history. Not "Dear Valued Customer." A letter that already knows exactly which device sits on your desk.
The pitch changes a little letter to letter but the core idea stays the same: your wallet urgently needs a security update, and the reason given is "quantum resistance," basically protection against some future quantum computer that could theoretically crack today's encryption. This part isn't nonsense they made up, by the way. Whether and when quantum computing becomes a real threat to crypto is something actual cryptographers argue about seriously. Which is exactly why it works so well as bait. It's a real fear dressed up as a fake fix. Scan the code, the letter tells you, to finish the security migration. And the page waiting on the other end asks for your 24-word recovery phrase.
Ledger, the wallet maker being impersonated here, came out in early June 2026 and confirmed flatly that these letters are fake. Worth saying plainly: no legitimate company, ever, asks you to type your recovery phrase into a website. Not Ledger, not anyone.
This has been going on for a while now, not a one-off
The reason this is worth caring about beyond "huh, weird story" is the timeline behind it. Switzerland's cybersecurity office, BACS, first put out a warning about letters matching this description on July 31, 2026. Then, in a follow-up review published August 18, they said the reports were still coming in. Three weeks after the first warning and people were still getting these things in the mail. That's not one bad batch that slipped through. That's an active operation still running over a month later.
It's not just Ledger's name getting used either. Last month the IRS put out its own fraud alert about letters going to crypto holders demanding they sign up for something called a "Digital Asset Compliance Portal" before some made-up deadline. There's no such portal. Same playbook though: fake notice number, artificial urgency, a QR code that leads to a page dressed up to look like IRS.gov, and a request for your wallet info or login once you land there. Different name on the envelope, same trick underneath.
Why bother with the mail at all
Back to that first question. Why pay for postage when email is free and instant? Because email phishing doesn't work as well as it used to. Spam filters catch more. People have gotten at least a little wiser about clicking random links in messages. A letter dodges most of that entirely, because we're still wired to treat physical mail as serious, official, the kind of thing bills and legal notices come in. Scammers know most of their competition doesn't bother with paper anymore, so showing up in an envelope actually stands out as more trustworthy, not less. And yeah, printing and postage cost real money, but that cost works in the scammer's favor too. It filters out casual browsing and signals they're betting on a higher hit rate per letter than they'd ever get blasting the same message to a million inboxes. Targeting hardware wallet owners specifically also makes sense financially. Owning a hardware wallet is a decent signal you're holding enough crypto to be worth the extra effort.
There's a question in here that bugs me more than the scam mechanics themselves, honestly. How did these people get someone's correct wallet model and order history? That's not public data sitting around somewhere. It points toward some kind of breached or leaked customer information, shipping records maybe, though nobody's confirmed exactly where it came from. Either way, the fact that a letter gets your details right isn't a reason to trust it more. If anything it should make you more suspicious, not less.
If one of these shows up in your mailbox
No wallet company, no exchange, no tax office is ever going to ask you to type your recovery phrase into a website. Not for an update, not for compliance, not for any reason at all. A QR code pointing to a page that wants that phrase is the whole story right there, you don't need to read any further.
Don't assume a professional-looking, personally addressed letter means it's real. This whole campaign is proof that scammers sometimes know more about you than you'd expect, and that's not the same thing as them being legitimate.
Resist the urge to scan the code "just to see." Even loading the page it points to can kick off a phishing flow or set you up for more social engineering down the line. If you want to check something a letter claims, go find the company's real website yourself by typing it in. Don't use anything printed on the letter.
Got one of these letters? Report it. Ledger keeps a running page of active phishing campaigns using its name, and tax agencies usually have their own channel for reporting impersonation scams.
And if you're ever unsure whether some security update is genuine, call or email the company through contact info you found on your own, not whatever's printed on the suspicious letter. A phone number on a scam letter is just part of the scam.
Zooming out a bit
This is really just an old trick wearing a new coat. It's the same gap we keep coming back to on this blog, the distance between what a QR code appears to be doing and what it's actually doing once you scan it. Same root problem behind the QR code parking scams the FTC flagged earlier this year, and the same habits we go through in our quishing guide. The delivery method keeps changing, the con underneath doesn't. Email got wise to, so scammers moved to texts and stickers slapped over parking meters. Now, for people worth the extra effort, it's your actual mailbox.
Trusting mail because it looks official used to be reasonable advice. These days it's exactly the habit this scam is counting on you not breaking.