Scam library · Investment & crypto · Phone calls · Texts
Coinbase impostor call or text scam
A text says someone requested a withdrawal from your Coinbase account and to call support if it wasn't you. Or a caller already knows your name, email and that you have an account, and says hackers are draining it right now.
The 'support agent' walks you through 'securing' your funds: moving them to a new wallet, sharing a code, or entering your recovery phrase. That's how the money is stolen.
What the message looks like
From: Caller ID shows 'Coinbase Support'
We detected an unauthorized login from another state and a pending withdrawal of 1.2 BTC. To protect your assets we need to move them to a secure vault wallet now.
I'll text you the vault address. Please don't hang up, the attacker is active.
How this scam works
Exchange impersonators often use leaked customer data to sound convincing. They may spoof caller ID or send texts that thread with real messages from the company. Some send a fake 'case number' email to match the call.
The goal is one of three things: your login and two-step code, your wallet's recovery phrase (seed phrase), or a transfer to an address they control, often called a 'vault' or 'secure wallet'.
Coinbase says it will never ask you to move funds to a new address, never ask for your password or 2-step codes, and never ask for your recovery phrase. The same is true for any legitimate exchange or wallet provider.
Crypto transfers are usually permanent. Unlike a card charge, there's no dispute button. That's why stopping before you move anything matters so much, and why a few minutes of verification through the official app is worth any amount of urgency the caller creates.
Red flags
- Unexpected calls about your exchange account.
- Requests to move funds to a 'secure' or 'vault' wallet.
- Asking for your recovery phrase, password or 2-step code.
- Pressure to stay on the line while acting.
- Texts asking you to call a number about a withdrawal.
How to tell it’s fake
- Hang up and open the exchange's official app yourself to check activity.
- Use the help center inside the app to contact support.
- Never share a recovery phrase with anyone, ever.
- Check the URL of any page asking you to sign in.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- Hang up or delete the text. Don't call numbers in the message.
If you paid
- If you sent crypto, contact the exchange through its official app immediately and report to ic3.gov with the transaction IDs.
If you shared personal info, a password or a code
- If you shared your recovery phrase, move any remaining funds to a new wallet right away from a safe device. If you shared a login or code, change your password and reset 2-step verification.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard runs in Chrome and Edge on your computer, so it can't hear a call. When a caller sends you to a website or an email 'case', Scam Guard checks it, recognizes fake exchange login pages and warns before you sign in or paste a wallet address. If an alert seems legit, get a scam expert's opinion first.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- Does Coinbase call customers?
- Coinbase says it won't call to ask you to move funds, or for passwords, codes or recovery phrases.
- What's a recovery phrase?
- The 12 or 24 words that control a wallet. Anyone who has them can take everything.
- Can stolen crypto be returned?
- Rarely. Report quickly to the exchange and ic3.gov.
- How did they know I have an account?
- Often from leaked data. Knowing your details doesn't make them real.