- The EU directive DAC8 has only been in force since January 1st, but it is already changing the European crypto scene – for some investors, however, in a completely different way than they had imagined.
- Crypto service providers are now obliged to report detailed customer data to the tax authorities, and fraudsters promptly take advantage of the ignorance of many private investors and send phishing emails – with success.
With DAC8 The anonymous use of cryptocurrencies on EU-regulated platforms ends. The directive requires exchanges, brokers and wallet providers to automatically transmit the names, tax data and transaction histories of their customers to the authorities without their intervention.
Non-EU service providers must also adhere to this rule if they serve customers in the EU. The measure is part of a comprehensive strategy to curb tax evasion. It is intended to standardize the exchange of information between national tax authorities.
Fraudsters take advantage of investors’ ignorance
The new reporting requirement is causing uncertainty – and this is currently being exploited by criminals. Emails are circulating across the EU that purport to come from tax authorities and request “DAC8 verification” or “wallet registration.”
The emails seem credible because they refer to real legal changes and use the usual official jargon with the corresponding bureaucratic phrases. There are also terms such as “automated information exchange” and “tax transparency”. But all of that is nonsense.
In fact, the new EU DAC8 directive is aimed exclusively at commercial crypto service providers, not investors. An authority will never request – and certainly not via email – to transmit wallet data, tax IDs or seed phrases (!). The wave of phishing shows how quickly new regulations that are still unknown in detail can be exploited if the information available to those affected is still incomplete.
Alleged authority emails are fake
As companies begin to adapt their processes to the new requirements, experts warn of significant risks in the transition phase of DAC8. The directive provides for fines of up to 50,000 euros for violations, which puts pressure on providers to quickly adapt their systems.
At the same time, the risk that criminals will take advantage of the situation increases before the public is fully informed about the new rules. The current wave of phishing is an example of how much cybercrime depends on the ignorance of those being deceived.
For investors this means: All DAC8-related emails that request the disclosure of any personal information or information about investments made are the beginning of an attempted fraud – ignore them.
DAC8 does not affect investors at all and does not create any reporting requirements for investors. The coming months will show how well Europe masters this balancing act between transparency, security and consumer protection.
No Comments