Scammers target crypto users. Learn how to recognize, avoid, and report fraud attempts — and keep your Coinbase account secure.
If you remember nothing else, remember these:
Your 12 or 24-word recovery phrase (seed phrase) gives complete control of your wallet to anyone who has it. Coinbase will never ask for it. Not in support chat. Not on the phone. Not in an email. Never.
Your password and one-time 2FA codes are yours alone. Sharing them — even with someone claiming to be Coinbase — gives attackers full access to your account.
Coinbase does not make unsolicited outbound calls. If you receive a call from "Coinbase," hang up. Call us back through the official number in the app if you're unsure.
Crypto transactions are irreversible. Always double-check the recipient's address before sending. Scammers use clipboard malware to swap addresses at the last second.
Promises of guaranteed returns, "double your crypto" offers, exclusive investment opportunities, or celebrity endorsements are always scams.
Real support is available only via the Coinbase app and help.coinbase.com. DMs from "Coinbase" accounts on Twitter/X, Telegram, Instagram, or Discord are fake.
Fraudsters call pretending to be Coinbase security, claiming your account has been compromised. They pressure you to "verify" your identity by providing your password, 2FA code, or recovery phrase.
Emails that look exactly like official Coinbase messages, with logos, similar email addresses (e.g. "no-reply@coinbase-support.com"), and urgent language like "Your account has been suspended."
Scammers build a fake romantic relationship over weeks or months, then introduce a "can't-miss" crypto investment. Victims are coached to invest increasing amounts before the scammer disappears with the funds.
Fraudulent websites or apps that show impressive "returns" to lure victims into depositing more crypto. When you try to withdraw, you're told to pay "taxes" or "fees" — which don't go to any real institution.
Pop-ups or calls claiming your computer is infected and you need to grant remote access. Once in, scammers can see your screen while you log in to Coinbase, and steal your credentials.
Fake social media posts from spoofed accounts of celebrities or Coinbase executives promising to "double" any crypto you send them. The sent crypto is never returned.
Complete these steps to significantly reduce your risk of being hacked
Use an authenticator app (like Google Authenticator) — not SMS — for stronger protection
Use a password manager. Never reuse passwords across sites
A YubiKey or similar device provides the strongest form of 2FA
Go to Settings → Security → Trusted devices and remove any you don't recognize
Restrict withdrawals to pre-approved addresses only
Get notified of every login, withdrawal, and account change
Your email is the key to account recovery. Protect it with 2FA too
Write it on paper. Never screenshot it, email it, or save it in cloud storage
Go to Settings → Help → Contact us and select "I think my account has been compromised" or "Report a scam."
File a complaint with the FTC at reportfraud.ftc.gov, the FBI IC3 at ic3.gov, or your state's attorney general.
Forward phishing emails to security@coinbase.com and to the Anti-Phishing Working Group at reportphishing@apwg.org.