Coinbase scam text

How to tell

In order. The first one holds even when the rest of the message looks completely real, which is the situation most people are actually in.

1. The message gives you a phone number to call.

   This is the one that holds even if you do have a Coinbase account and even if the code in the text looks exactly like a real one. The Sheriff’s Office lists "Requests to call a phone number to “verify” account activity" as a key indicator, and Coinbase’s own letter to customers says it "will never ask you to contact an unknown number to reach us". Support at Coinbase is reached from inside the app, in the direction you start. A number arriving in a message is the scam, because getting you onto a call is the point of sending it.

2. You were sent a one-time code you did not ask for.

   A real one-time code exists because somebody just asked for one. If you did not, then either someone is trying to get into your account, in which case the fix is to open the app and lock it, or the code is simply made up to make the text look real. Neither case is a reason to call anyone, and as the Sheriff’s Office puts it, "Legitimate companies will never ask you to share an OTP over the phone or via text."

3. It came from a number with no connection to Coinbase, and it is in a hurry.

   The alert lists messages from unknown numbers, odd formatting and "overly urgent language" among the indicators. Treat this as confirmation rather than as the decision: sender numbers are cheap to change and the wording gets better every month, so a tidy message from a plausible number is not evidence of anything.

What Coinbase actually does

Nothing that requires you to call a number out of a text. Check your account the way you normally reach it: open the Coinbase app, or type coinbase.com into the address bar yourself, and look at your own activity and pending withdrawals. If something is wrong you can lock the account from inside the app. The Sheriff’s Office says the same thing: "Check your account status by visiting the official Coinbase website (www.coinbase.com) or app directly—do not use links or numbers from the message."

Where to report it

Your mobile carrier

Forward the message to 7726, which spells SPAM on a keypad. It is free on every major carrier.

The Federal Trade Commission

Report it at ReportFraud.ftc.gov, which is the FTC’s own reporting site.

The FBI’s Internet Crime Complaint Center

File at ic3.gov. This is the route the FBI asks for where cryptocurrency is involved, and it is the one to use if any money or account access was actually lost.

Coinbase

Contact Coinbase support from inside the app or from its official site, reached by typing the address yourself. Do not use a number or link from the message.