IRS Warns AI-Powered Crypto Scams Are Draining Retirement Accounts

What happened

The IRS now has its own warning on AI-fueled cryptocurrency fraud, and a case file to go with it.

In a report broadcast by CBS News on April 22, 2026, a single victim lost $300,000 in retirement and savings accounts over less than three months. The money moved through 14 cryptocurrency wallets the victim was directed to fund, then through five more wallets the scammers controlled, and then off-ramped at a regulated exchange. By the time IRS Criminal Investigation's New York Field Office mapped the flow, the money was gone.

“These are highly sophisticated scams and anyone can be a victim,” said Harry Chavis, the special agent in charge of the case.

What makes this case different from the crypto fraud the IRS has been chasing for years is how it got built. According to investigators, the scammers are now using what they call “dark AI” tools, purpose-built language models marketed on underground forums, to automate targeting and write the scripts that convince victims to invest. Lists of prior victims, scraped data from past breaches, and leak databases from hacked exchanges feed into the targeting layer.

What happened: a 73-year-old's life savings, gone in 90 days

Kyle Holder, 73, had been an occupational therapist. An injury made that untenable, so she was intrigued by the idea of investing from home.

“I just thought maybe this was a way that I could use my time, start something new and make money, to carry me into my older years,” she told CBS News near the assisted living facility she has had to move into, paid for by Medicaid.

The first message came around Christmas 2024, via WhatsApp, a messaging app Holder used to communicate with family and friends in the United States, Canada, and Israel. The message offered coaching on how to invest in the crypto market.

Holder replied, asking for more information. Someone who called herself Niamh responded and started asking about her life.

The relationship-building phase

Holder recalled thinking she and Niamh had become friends. “She said she's a single parent and I thought I'm a single parent. She was always asking about me. And then she would say, ‘Is the money being transferred?’”

Early in the scam, Niamh sent Holder a WhatsApp message: “Honey, how did you sleep last night? Any plans for the day?... By the way, honey, have your funds arrived in your Citibank account?”

Niamh and another scammer, who was called a member of the “customer service team,” coached Holder on how to open two crypto wallets online. She transferred a small sum to a crypto account tied to the scammer, and thousands of dollars appeared in her crypto wallet. The fake gain was bait to build trust.

Niamh assured Holder that the team she worked with would pay taxes on the funds they earned together. Holder thought she had found a legitimate investment opportunity.

Then came the hook. Niamh asked for help: “I hope you can understand the plight of being a single mom because the money I lent you includes child support for my daughter Alice and even some of the funds obtained through loans.”

The money flow: 14 wallets to 5 wallets to an exchange

Holder transferred more from her crypto wallets, eventually sending almost $300,000 to 14 different wallets tied to the scammers.

Two months into communicating with Niamh, and not seeing any money flowing back into her crypto wallets, Holder became worried.

“Please assure me this is not a scam, I actually said that to her. I'm getting worried,” Holder told CBS News.

Niamh told her she had sent money to the wrong crypto wallet. “Oh my goodness, honey, how could you make such a little mistake? This is very bad. Contact [customer service] to consult on how to solve this problem.” In a later message, Niamh wrote: “You have made a fatal mistake.”

Her case was referred to the IRS Criminal Investigation New York Field Office. Special agents mapped out the scam and found that cybercriminals had transferred cryptocurrency from the 14 wallets Holder had funded into five new wallets to make it harder to trace.

“From these five wallets it makes its way to an exchange, which is the off-ramp,” Chavis explained.

Holder's money was consolidated with other victims' money. Eventually, the criminals off-ramped more than $5 million in cryptocurrency without being caught.

“While she may have contributed a couple hundred thousand dollars to this scam, they were able to ultimately see millions of dollars accumulating in this final wallet,” Chavis said.

Chavis's team has been trying to identify other victims of the same scam. They have not been able to identify the perpetrators. “They could be anywhere in the world,” Chavis said.

The AI element: how “dark AI” tools supercharged the scam

What makes the Holder case different from pig-butchering scams of years past is not the structure, the romance-baiting, the fake investment platform, the laundering through multiple wallets, but the automation.

According to Chavis, the scammers likely used tools readily available on the dark web that enable targeting victims even more effectively.

“You could go here and they would sell potential lists of people who were prior victims. There's other data that has been scraped or pulled through hacks or leaks that can be sold for criminals to obtain. And then they're using these dark AI tools to write scripts to literally go specifically to the victim,” Chavis told CBS News.

What are “dark AI” tools?

The term “dark AI” refers to large language models (LLMs) that are either jailbroken versions of commercial AI models, legitimate models like ChatGPT or Gemini that have been “uncensored” to remove guardrails against generating harmful content, or purpose-built malicious models trained specifically on hacking forums, scam scripts, phishing templates, and malware code.

Cybersecurity firm Palo Alto Networks' Unit 42 recently documented the growing underground market for these tools. In a report published in late 2025, researchers found that models like WormGPT 4 and KawaiiGPT are being sold on dark web forums, with WormGPT 4 offering lifetime access for as little as $220 and an option to purchase the complete source code.

These models are advertised as hacking assistants or dual-use penetration testing tools, but they are clearly marketed for criminal purposes. One model, KawaiiGPT, is available for free on GitHub, where around 500 contributors support and update the project.

The real danger, according to Unit 42 senior director of threat intelligence Andy Piazza, is that these tools lower the skill barrier for cybercrime. Users no longer need to know technical jargon like “lateral movement,” they can simply ask, “How do I find other systems on the network?” and receive ready-made scripts.

For pig-butchering scams specifically, AI tools are being used to:

• Generate thousands of personalized opening messages, no more copy-paste errors or broken English.
• Sustain long-term romantic conversations. The AI can remember details about the victim's life and refer back to them naturally.
• Create fake “customer service” interactions. When victims get suspicious, an AI-powered “support agent” can reassure them.
• Scale operations. One human operator can now manage dozens of simultaneous scams, with AI handling the bulk of conversation.

The IRS response: new Dirty Dozen entry and crypto tipline

The Holder case is not an isolated incident. It is part of a broader surge in AI-powered crypto fraud that has caught the attention of federal regulators.

For the first time, the IRS has added “AI-enabled IRS impersonation by phone” to its annual Dirty Dozen list of tax scams for 2026. The Dirty Dozen, released annually, warns taxpayers about common schemes that threaten personal and financial information. According to the IRS, scammers are now using robocalls, spoofed caller IDs, and AI-generated voices to impersonate IRS agents and demand payment or sensitive information.

The IRS emphasizes that it contacts taxpayers by mail first and never threatens arrest or demands immediate payment over the phone. But AI-generated voices sound real, and scammers are counting on that.

The IRS Criminal Investigation division has also recently set up an online tipline for crypto fraud cases. The tipline is designed to give victims a direct channel to report scams and give investigators faster access to blockchain data that can help trace funds.

“Do not be ashamed. These are highly sophisticated scams and anyone can be a victim,” Chavis said.

Why it matters

Holder was one of thousands of Americans swindled out of a total estimated at $20 billion by way of cyber theft in 2025, according to the FBI. More than half of those funds were in cryptocurrency.

As AuthentiLens reported in our coverage of the FBI's 2025 Internet Crime Report, the bureau documented $893 million in losses from AI-enabled fraud, a category that did not exist in the IC3's reporting until this year. Of that, $632 million was specifically tied to AI-nexus investment scams, the exact type of fraud described in the Holder case.

The overlap between these numbers is not coincidence. The Holder case is a single thread in a much larger tapestry: a global, AI-powered pig-butchering industry that the DOJ, FBI, and IRS are now fighting in parallel.

The IRS Criminal Investigation unit: a primer for victims

Many people do not know that the IRS has a criminal investigation division, or that it has become one of the most sophisticated cryptocurrency-tracing units in the federal government.

IRS Criminal Investigation (IRS-CI) is the law enforcement arm of the IRS. Its special agents are federal law enforcement officers with the authority to conduct searches, seize assets, and make arrests. Unlike the civil side of the IRS, which deals with tax collection and audits, IRS-CI focuses on criminal violations of tax and financial laws, including money laundering, wire fraud, and cryptocurrency-related crimes.

Under Chief Guy Ficco, IRS-CI has ramped up its focus on cryptocurrency enforcement, including tracing blockchain transactions, working with public-private partnerships like Chainalysis and TRM Labs, and training agents on the latest crypto-laundering techniques.

For victims of crypto fraud, IRS-CI is a critical, and often overlooked, resource. The newly launched crypto fraud tipline is designed to give investigators the kind of early access to wallet addresses and transaction data that can make the difference between a seized asset and a vanished fortune.

The industrialization of pig butchering

The Holder case, like the Ron Williams case we covered last week, is not an anomaly. It is the output of an industry. Three things about the IRS warning matter for anyone who uses a phone, has a retirement account, or loves someone who does.

1. It is no longer a human typing the scam messages. The dark AI tools IRS investigators are describing are language models trained or fine-tuned on romance-scam scripts, pig-butchering playbooks, and investment-pitch material. One operator can now run dozens of simultaneous conversations, each tailored to a specific target's profile, with tone and pacing that pass the “feels real” test. The economic unit of fraud has been compressed by an order of magnitude.

2. The targeting is now data-driven. The scammers are not guessing at who to contact. They are buying lists, of prior scam victims, of breach-exposed accounts, of public records matched with financial profiles, and feeding those into AI-powered matching systems. If you have been targeted before, you are more likely to be targeted again. If your personal information has ever been in a breach, which for most Americans it has, you are on a list somewhere.

3. The laundering is built into the workflow. The 14-wallets-to-five-wallets-to-exchange pattern IRS investigators described is not artistry. It is a template. Scam operators are now paired with crypto-laundering infrastructure the way retailers are paired with payment processors. By the time a victim realizes what happened, the money has already moved through multiple wallets and exited at an exchange.

The practical takeaway: the old advice still works, but more of it is needed, and it has to be applied earlier in the conversation.

How to protect yourself

The AuthentiLens editorial team has distilled the Holder case and the IRS warning into six concrete protections.

1. Never invest in a cryptocurrency platform recommended by someone you met online.

Not a match on a dating app. Not a “wrong number” texter. Not a mentor from an investing group. This is the single rule that would have saved nearly every pig-butchering victim we have covered, including Kyle Holder.

2. Treat inbound messages from unknown senders as automated until proven otherwise.

Short, flattering messages from unknown senders are almost always automated. “Long time no talk!” “Sorry, wrong number, but you seem nice.” “My friend said you could help.” Every one of these is an opener from a machine feeding a scripted human operator. Block and delete.

3. Verify tax-related contacts through official channels only.

The IRS does not call, text, or DM. If you get a call or message claiming to be from the IRS, especially one that asks for cryptocurrency, gift cards, or wire transfers, it is a scam. Verify by calling the IRS directly at 800-829-1040 or going to IRS.gov yourself.

4. Dashboard “gains” are not proof the money is real.

Scam cryptocurrency platforms display whatever balance the operator wants. The only real test is an actual withdrawal to a bank account in your name. The “you need to pay taxes before you can withdraw” request is a nearly universal tell, ironically, often from scammers impersonating the IRS.

5. If your information has been in a breach, assume you are being targeted.

You can check at Have I Been Pwned (haveibeenpwned.com). If your email or phone has appeared in a breach, expect scam attempts and treat every unsolicited message accordingly. The scammers have your data. Act like it.

6. Scan before you trust.

Paste any suspicious message, investment pitch, voice note, or crypto “opportunity” into AuthentiLens. Our detection engine flags AI-generation signals, pig-butchering language patterns, urgency tactics, and impersonation indicators in seconds, before the opener turns into a conversation.

What to do if you have been scammed

If you or someone you love has lost money to a crypto scam, the most important thing you can do is report it, quickly.

• File a complaint with the FBI's IC3 at ic3.gov. The sooner the complaint is filed, the better chance investigators have of freezing funds before they are off-ramped.
• Report to the IRS Criminal Investigation crypto tipline. The division recently launched this resource specifically for cases like Holder's. Visit irs.gov and search for “crypto fraud tipline.”
• Contact your bank and any cryptocurrency exchanges you used. They may be able to freeze accounts or provide information to law enforcement.
• Tell your family. Shame is the scammer's greatest ally. The silence is what they count on.

Holder now lives in an assisted living facility paid for by Medicaid. She sits on a park bench near the facility and tells her story so that others will not make the same mistake. “There's nothing left,” she told CBS News.

The goal of this case file, and of AuthentiLens, is to make sure her story is the last one like it.