Security Alert: Sophisticated "Coinbase Support" Phishing Scam Targeting Users

Recently, we have become aware of a sophisticated phishing campaign impersonating Coinbase Customer Support. Because this scam uses advanced social engineering techniques—including reference to real security protocols like government ID verification—we want to ensure our community knows how to spot and stop this threat.

Here is an analysis of how this specific scam works and the critical red flags to look for.

The Anatomy of the Attack

This scam usually begins with an email that is designed to create immediate panic. The scammers use a multi-step approach to make the threat feel real.

1. The "Hook" (Panic): You receive an email claiming there has been a "request to change the phone number linked to your account." This makes you immediately worry that you are being hacked.

2. The "Proof" (Credibility): To make the claim believable, the scammers add a frightening detail: "Someone provided full proof government ID as evidence for this change." This is a clever tactic. It makes you feel as though the hacker has already surpassed a major security barrier, raising your panic level further.

3. The "Lockout" (Isolation): The email states that due to this high-risk activity, your account has been flagged. Most critically, they tell you: "You cannot contact us directly through standard channels at this time." This forces you to rely entirely on them for a solution.

4. The "Sting" (The Financial Theft): This is the ultimate goal. They will send follow-up instructions telling you that to protect your funds, you must immediately "move your money to a Safepal wallet" (or another external "safe" wallet).

It is crucial to understand: Once you move your funds to a wallet the scammers control, they are gone forever. Legitimate crypto exchanges will never ask you to move your funds to a third-party wallet to "protect" them.

How You Protect Yourself

One of our alert community members recently encountered this exact scenario. Their swift action prevents theft. They recognized the signs, did not click any links, did not download attachments, and reported the emails directly to the official exchange.

Key Red Flags to Remember:

• Requests to Move Money: No legitimate financial institution or crypto exchange will ever ask you to move your funds to a specific external wallet address. This is always a scam.

• Panic Tactics: Any message demanding "immediate action" to prevent an account closure or loss of funds is a major red flag.

• "Do Not Contact Us": A legitimate company will always want you to contact them through official, verified channels (like the Help Center within their official app).

Safe Action Steps

If you receive an unexpected or suspicious email from any service:

1. Stop. Do not react immediately.

2. Do Not Click. Avoid links or downloading attachments in suspicious emails.

3. Verify Directly. Close the email, open a new browser tab, and type the website address directly (e.g., www.coinbase.com). Log in there or use the official app to check your actual account status.

4. Enable Stronger 2FA. Switch your Two-Factor Authentication from SMS to an app-based authenticator or a hardware security key.

How to Report Phishing:

• Forward suspicious Coinbase emails to: security@coinbase.com

• If you receive suspicious emails impersonating our company, please forward them to Your Company’s Security Email.

← Back to resources