An important fact comes first: Coinbase is a legitimate, publicly traded American cryptocurrency exchange (Nasdaq: COIN) where millions of people buy, sell, and store digital assets. The scam described in this article is not Coinbase — it is criminals pretending to be Coinbase. Fraudsters call, text, and email crypto owners posing as Coinbase support staff, and then talk their victims into handing over the keys to their own accounts.
These impersonation schemes have stolen staggering sums. In September 2023, federal prosecutors in Brooklyn announced the sentencing of a man who posed as Coinbase support and stole nearly $16 million from about 100 victims. In a separate case, fake text messages impersonating Coinbase led to the theft of 33.7 bitcoin — worth about $900,000 at the time — from a Massachusetts family trust. The criminals in these cases never breached Coinbase’s systems; they breached people’s trust.
Coinbase itself has warned publicly about this exact pattern. The company’s own security guidance states plainly that Coinbase staff will never ask customers for their passwords or two-step verification codes. Anyone who contacts you claiming to be from Coinbase and asks for those details is a criminal — no exceptions.
How the Impersonation Scam Works: Step by Step
Step 1: The contact. The scam usually begins with a phone call, text message, or email that appears to come from Coinbase. In the Massachusetts case, the victim received fraudulent text messages on June 1 and 2, 2023 — at the exact moment he was legitimately corresponding with Coinbase by email about opening a separate account for a family trust. The timing made the fake messages look authentic. In the Brooklyn case, the scammer Ronald Spektor cold-called Coinbase users posing as a company representative.
Step 2: The alarm. The caller tells the victim their account has been compromised by a hacker and their funds are in immediate danger. The message is always urgent: act now or lose everything. Fear shuts down careful thinking, and that is precisely the point.
Step 3: The “rescue.” The fake support agent offers a solution: move your cryptocurrency to a new, “safe” wallet they will help you set up. They may ask you to share your screen through tools like Teams or AnyDesk so they can “guide” you — which lets them watch every password and verification code you type. Or they simply ask for your login credentials, passwords, and two-step verification codes directly.
Step 4: The transfer. Believing they are protecting their funds, the victim transfers crypto into the new wallet. Seeing the money arrive at the address feels reassuring — but a successful transfer only proves the transaction went through. It says nothing about who else can spend from that wallet. In the Brooklyn case, prosecutors said the supposedly safe wallets were accessible to the scammer all along.
Step 5: The drain. Once the funds are moved, the criminals empty the wallets immediately and launder the cryptocurrency — swapping it across multiple exchanges, converting it through privacy coins, and routing it to cash-out points, gift cards, and gambling services. In the Massachusetts theft, investigators traced part of the stolen bitcoin through conversions into Monero and Tether before one account was frozen. Only a fraction of stolen crypto in these cases is ever recovered.
The “Fake Law Enforcement” Variation
Criminals also impersonate police and federal agents to achieve the same result. In a consumer protection alert, Coinbase described scammers who call victims claiming to be law enforcement officers investigating identity theft. The script runs like this: the caller says criminals have stolen your identity, the only way to “protect” your funds is to move them, and you must share your screen and transfer your crypto to a “government-controlled” wallet immediately. The wallet, of course, belongs to the scammers.
The lesson Coinbase emphasizes is direct: no real police officer, federal agent, or embassy official will ever call you out of the blue, demand immediate action, ask you to move money or crypto to “protect” it, tell you to open a new Coinbase account, ask you to share your screen, or threaten arrest if you don’t comply right away. Any call that does any of these things is a scam, no matter whose badge the caller claims to wear.
Red Flags: Spotting a Coinbase Impersonator
- They contacted you first about a “problem.” Coinbase does not call customers out of the blue to warn them about account breaches. Unsolicited contact claiming your account is compromised is the single biggest warning sign.
- They ask for your password or 2FA code. Coinbase’s official policy: staff will never ask for passwords or two-step verification codes. Any request for them proves you are talking to a criminal.
- They ask for your seed phrase or recovery phrase. Your recovery phrase is the master key to your crypto. No legitimate support agent from any company ever needs it.
- They tell you to move funds to a “safe” or “secure” wallet. Legitimate support never asks you to transfer your crypto anywhere. Any instruction to move funds is theft in progress.
- They ask you to share your screen or install remote access software. Screen-sharing tools like AnyDesk or Teams let them watch your passwords and codes in real time.
- Extreme urgency and threats. “Your account will be drained in 10 minutes,” threats of arrest, or pressure to stay on the line and not talk to anyone else are manipulation tactics.
- They arrived at a suspiciously perfect moment. In the Massachusetts case, the fake texts arrived while the victim was already dealing with Coinbase about his account — impersonators time their attacks to moments when you expect contact, and they also monitor social media posts about crypto for targets.
- Instructions to open a new account. Real law enforcement and real support staff never instruct you to open new accounts as part of an “investigation.”
How to Verify: 8 Steps to Protect Your Crypto
- Hang up and verify independently. If someone calls claiming to be Coinbase support, end the call. Then open the official Coinbase app or type coinbase.com into your browser yourself — never use a link, phone number, or callback the caller gave you.
- Never share passwords, 2FA codes, or your seed phrase. Not with “support,” not with “security,” not with anyone who calls you. These are yours alone.
- Never share your screen with an unsolicited caller. Especially while logged into any financial account.
- Never move crypto because someone on the phone told you to. There is no “safe wallet” transfer that legitimate support will ever ask you to perform.
- Bookmark official support channels. Save Coinbase’s official help pages and support contact in advance, so you never need to search for them in a panic — scammers buy search ads that mimic official support pages.
- Enable the strongest authentication available. Use an authenticator app or hardware security key rather than SMS codes where possible, since texts can be spoofed and SIM-swapped.
- Treat every urgent crypto message as suspect. Slow down. A real problem with your account will still be there after you hang up and check through official channels.
- Check the sender carefully. Look at full email addresses and URLs, not just display names. But remember: spoofed messages can look perfect, so verification through a channel you open yourself is the real defense.
What to Do If You’ve Been Targeted
If you received a fake support call or text but did not share anything, you did the right thing — block the number and report it (see below). If you shared credentials or moved funds:
- Act immediately. Contact real Coinbase support through the official app or website and secure your account — change your password and revoke active sessions.
- Move remaining funds to a brand-new wallet whose seed phrase was generated offline and never shared, using only the official app.
- Document everything: phone numbers, message screenshots, wallet addresses, transaction IDs, and the exact timeline. Crypto transactions are traceable, and this evidence matters to investigators.
- Do not pay anyone who promises to “recover” your crypto for a fee. Recovery-room scams target people who have just been victimized; legitimate investigators do not cold-call victims offering recovery.
How to Report a Coinbase Impersonation Scam
- FBI Internet Crime Complaint Center: File at ic3.gov with all transaction details. The Massachusetts $900,000 case advanced precisely because the theft was reported and traced by the FBI.
- FTC: Report at ReportFraud.ftc.gov.
- Coinbase: Report the impersonation to real Coinbase support through the official app or website so the company can track and warn about the campaign.
- Local police: File a report, especially if the loss is large — prosecutors in the Brooklyn case built a criminal case that ended in a multi-year prison sentence and restitution orders.
The Bottom Line on Coinbase Impersonation Scams
Criminals impersonating Coinbase support have stolen tens of millions of dollars — not by hacking the exchange, but by hacking human trust. They call with bad news about your account, then offer a “rescue” that is really a robbery. The defense is a short list of nevers: never share passwords, 2FA codes, or seed phrases; never share your screen with a stranger; never move crypto because a caller told you to; and always verify through channels you open yourself. Coinbase staff will never ask for your login secrets — anyone who does is, by definition, not Coinbase.
Sources
- Coinbase, “Consumer Protection Tuesday: No Real Cop Will Ever Ask You to Move Your Crypto” — https://www.coinbase.com/blog/consumer-protection-tuesday-no-real-cop-will-ever-ask-you-to-move-your-crypto
- TheStreet Crypto, “100 Coinbase users lose millions to fake support calls” — https://www.thestreet.com/crypto/latest-news/100-coinbase-users-lose-millions-to-fake-support-calls
- CryptoNews, “Fake Coinbase Texts Led to $900K Bitcoin Theft, US Seeks Seized Crypto” — https://cryptonews.net/news/security/33516550/
- Gridinsoft Blog, “Coinbase Impersonator Stole $16M Through ‘Safe’ Wallets” — https://blog.gridinsoft.com/coinbase-safe-wallet-scam-spektor/
- NRPI, “A $16 Million Scam Just Ended In Prison” — https://nrpi.org/a-16-million-scam-just-ended-in-prison/
Last reviewed: October 2026
This article is for education only and is not financial or legal advice.