How to Identify and Avoid Coinbase Customer Support Scams

The incident serves as yet another reminder to beef up on security and, equally important, raise awareness about the methods threat actors routinely use. So, in the information below, we’ll go over the intricacies of the recent Coinbase scams to avoid becoming a victim down the road, including what legal assistance might be available – and necessary.

Common tactics used by scammers impersonating Coinbase support

The foundation of the recent Coinbase scams was the bribery of a small number of overseas customer support agents stationed in India, who ultimately leaked sensitive user data from Coinbase’s internal systems. Because they obtained a sizable amount of confidential details, scammers had a high level of credibility when posing as Coinbase customer service agents. 

They employed effective social engineering tactics by leveraging sensitive information that only the user and the exchange’s staff would know, thus creating highly personalized and, unfortunately, convincing messaging. The two main tactics they used were:

Impersonating official support via unsolicited phone calls

Scammers would call victims from a spoofed phone number that made it look as though the call was coming from legitimate Coinbase support. Pretending to be and sounding like company representatives, the criminals created a sense of panic and urgency by warning the user about suspicious account activity, such as unauthorized access or withdrawals.

In some instances, victims were bombarded with genuine password reset codes or security alerts from various other services (Google, Uber, etc.) tied to their email while on the call with the scammer. Presumably, this was done to increase the sense of an active cyberattack, so that the victims go into panic mode and have diminished rational thinking.

There are also mentions of so-called security checks being implemented, where criminals would verify particulars they already knew from the data breach. Doing so reinforced their narrative that they were actual Coinbase representatives with access to internal systems, thus establishing necessary trust with the user.

Phishing emails and texts

Sent either as standalone or accompanying the phone calls, these communications looked like the real thing, with official logos, proper formatting, fake ticket numbers, and so on. The emails typically referenced the case ID number in the subject line and contained a “recovery link” for the user to verify their identity or perform a certain action that would improve the security of their account. Often included was a step-by-step guide on how to secure the account, like enabling two-factor authentication (2FA) or resetting the password.

Upon clicking on the link, a login page with a spoofed domain and looking eerily similar to the genuine Coinbase website would appear, once again featuring the correct company branding and content. There, the unsuspecting user was prompted to enter their email and password, not knowing that they were handing them over to the scammers.

As for texts, they were mainly used for fake verification codes, usually part of the two-factor authentication. In the same “we are Coinbase support” manner, the attackers fabricated a story that the newly received code is needed to verify the account or prevent a fake transaction. By providing the code, victims were giving away the keys to their accounts on the exchange. It’s worth mentioning that Coinbase largely utilizes codes for login or transaction confirmations, which is why attackers took the approach to begin with.

However, all of the above was only a part of the scam. From there on, the goal was to guide users to install a “Coinbase Wallet” (or to use another external address) that the criminals controlled and transfer funds there. For this fake new wallet, the attackers would even provide a pre-generated seed phrase (also known as a recovery phrase), which is a series of 12 to 24 random words that serve as the master key to a cryptocurrency wallet. 

This is important because whoever has their hands on your seed phrase has complete control over your cryptocurrency funds. They can import your wallet onto their device and move all your assets out without needing your password, 2FA, or any other security measure.

Red flags found in scams

Perhaps the most worrying thing is that no data breach per se has to take place for a user to be targeted. This goes for Coinbase and any similar platform, since trading cryptocurrency inherently creates publicly available data, either on the underlying blockchain or through KYC practices. Threat actors routinely parse through it, along with the inevitable social media activity, to hone in on potential targets.

Hence, it’s paramount to recognize glaring and not-so-glaring hints of scams because chances are, you will likely be a target at some point. Here is what you should watch out for:

• Any type of unsolicited contact: The operative word here is unsolicited. If someone reaches out to you without prior contact, it’s most likely a scam in the making, especially since Coinbase won’t get in touch on its own.
• Anomalies in the email and URL addresses: Though they look genuine (or good enough) at first, phishing emails reveal a few tiny irregularities upon closer look. Double-check the sender’s email address and domains carefully for any misspellings, as scammers often rely on users quickly skimming over these details. For example, there might be extra letters or characters (support@coinbasse.com instead of support@coinbase.com, using a zero for an ‘o’), incorrect domains (.org or.net instead of.com), subdomains used as main domain, or the more obvious excessive numbers or random characters in the email address.
• Immediate action is required: As mentioned, a fake Coinbase support scam (or any, really) will rely on the time factor to get you to do something in a hurry without really thinking about it.
• Fear tactics: Similarly, the language used is a dead giveaway, as it almost always introduces a crisis, with phrases like “unauthorized access attempts” and “suspicious withdrawals” among the usual suspects.
• Direct requests for private details or remote access: Though some scammers opt for the roundabout way of convincing victims to transfer funds themselves, it’s not unusual for them to sometimes cut to the chase and ask for passwords or 2FA codes. Additionally, they may require you to install remote access software like TeamViewer or share your screen to take control of your device and extract user credentials.
• Any kind of account transfers: These will likely be prefixed by the word ‘secure’, with the idea to transfer your crypto to another wallet or vault for safety. 

Generally speaking, if something is too good to be true or feels iffy, steer clear. Never give out your Coinbase login information, no matter how persuasive the other side is.

How to verify legitimate Coinbase communication

The good news is that any platform worth its salt, including Coinbase, instructs its customer service agents to refrain from asking about specific user and account details, as well as doing certain actions on the user’s behalf.

These are absolute no-nos:

• Asking for any type of credentials, such as a password or verification code
• Asking to install any type of software on your device
• Taking control of your device via remote access to perform an action
• Accessing or transferring funds in your account to external addresses

If you’re asked for any of the above, know that it’s not an official Coinbase representative you’re in contact with.

To verify that you’re having legitimate Coinbase communications via official channels, only use the email or call the number on the company’s Contact us page. 

The most important rule for emails is that all official emails from Coinbase will always come from a domain ending in @coinbase.com (e.g., security@coinbase.com) or its legitimate subdomain.

When it comes to verifying a suspicious call, hang up and then call Coinbase yourself using the official phone number. It’s imperative not to use the number that the caller used. You can also log into your Coinbase account and initiate contact via the help center.

What to do if targeted by a scam

If someone has you in their sights and you believe your account is compromised, your first order of business is to secure your account.

Coinbase has a feature to lock your account if you suspect unauthorized activity. Do this as soon as possible via the Coinbase app or website. While you’re at it, be sure to reset your password, upgrade your 2FA verification method, and turn on security alerts. If you’re using SMS 2FA, you might want to switch to an authenticator app (like Google Authenticator) or, even better, a hardware security key, since SMS 2FA isn’t all that great due to SIM swap attacks.

In case you can’t log in, use the account recovery options or get in touch with Coinbase via their official channels and let them know what’s happening.

You should file a police report in your local jurisdiction and contact the Internet Crime Complaint Center as the relevant regulatory body. Try to provide all the relevant details, such as the communication means used and the names involved.

Legal options at your disposal

In the event that you’ve been scammed, you might have legal recourse.

Marin & Murphy Law Firm focuses in cryptocurrency and cyber-fraud cases, with a dedicated Cryptocurrency Fraud Recovery practice that focuses on scams exactly like the Coinbase impersonation scheme.

In fact, we’ve already assisted numerous Coinbase phishing and support impersonation victims, so we can advise you on your rights and potential claims. For instance, a third party (like a crypto exchange or bank) may hold some responsibility, and we can also help you navigate Coinbase’s mandatory arbitration process for disputes. We leave no stone unturned, whether it’s filing an arbitration claim against Coinbase for possible security lapses or suing any responsible parties that facilitated the fraud.

In case you’re wondering, your consultation is 100% free and confidential, so you risk nothing by reaching out, yet stand to potentially gain a great deal. We understand that acting swiftly is crucial here, which is why our team is standing by to deliver the immediate legal assistance you need – around the clock.

Look at it this way: the sooner we get to work, the better our chances of tracking down your cryptocurrency before it’s gone for good. 

Act now and dial 888-348-2735 or message us to speak with a knowledgeable crypto scam attorney. Don’t let the scammers get away with stealing your hard-earned assets. With our law firm by your side, you can fight back.