Scammers are sending physical letters to Trezor and Ledger users, impersonating official entities to lure them into scanning QR codes that lead to phishing websites, according to BleepingComputer. These letters claim to require "identity verification checks" or "transaction checks" to deceive users into revealing their recovery phrases, facilitating cryptocurrency theft. The letters create a sense of urgency to pressure victims into compliance. While the exact targeting criteria remain unclear, past data breaches at both companies may have exposed some user contact information. This method of using physical mail for phishing is notably rare compared to email scams.