Coinbase Text Scam: What It Looks Like & What to Do (2025)

The Coinbase text scam is the single most-searched individual text scam in the United States — generating more than 43,000 searches per month from people who received an alarming text message claiming to be from Coinbase and aren’t sure whether it’s real. If you’re reading this because you just received one of these texts, the short answer is: it is almost certainly a scam. Do not click the link. Do not call any number. Here is everything you need to know.

—

What the Coinbase Text Scam Looks Like

The Coinbase text scam typically follows one of a small number of templates:

The New Device Alert

“Coinbase: A new device has been detected on your account. If this wasn’t you, secure your account immediately: [link]”

The Large Transaction Alert

“Coinbase Alert: A withdrawal of $4,872.00 has been initiated from your account. If you did not authorize this, click here immediately: [link]”

The Account Suspension Warning

“Coinbase: Your account has been temporarily suspended due to suspicious activity. Verify your identity to restore access: [link]”

The Two-Factor Code Request (Advanced Variant)

In more sophisticated versions, you receive a real Coinbase 2FA code (triggered by a scammer who already has your username and password from a data breach), followed by a call or text asking you to share the code “to verify your identity.” Sharing the code gives the scammer full access to your account.

—

Why the Coinbase Scam Is So Effective

Coinbase is the most widely used cryptocurrency exchange in the United States, with tens of millions of registered users. This massive user base makes it a natural impersonation target — statistically, a significant percentage of any randomly texted group will be actual Coinbase customers.

The scam is also effective because it exploits a real and legitimate fear: cryptocurrency accounts are genuinely targeted by hackers, and Coinbase does send real security alerts. The combination of a real security context and a convincing impersonation creates a situation where even sophisticated users hesitate.

The high CPC figure for this keyword ($140–$1,600 depending on exact variant) reflects the enormous financial stakes — cryptocurrency accounts often hold tens of thousands of dollars, and a successful account takeover can result in an immediate, irreversible total loss.

—

How to Tell If a Coinbase Text Is Real or a Scam

Check 1: Does the link go to coinbase.com?

Press and hold the link in the text (on iPhone or Android) to preview the URL. Real Coinbase links go to coinbase.com or help.coinbase.com. Any other domain — coinbase-secure.net, coinbase-alert.com, coinbase.support-verify.net — is fraudulent.

Check 2: Log in to Coinbase directly to check.

Open the Coinbase app or type coinbase.com in your browser — do not use the link from the text. If there’s a genuine security alert on your account, it will be visible in the app. If nothing is there, the text was a scam.

Check 3: Did you receive a 2FA code you didn’t request?

If you received a Coinbase verification code you didn’t initiate, your username and password may already be in a scammer’s hands. Do not share the code with anyone. Change your Coinbase password immediately.

Check 4: Does Coinbase have your phone number on file?

Coinbase does send legitimate security texts — but only to the phone number associated with your account. If the text arrived on a number you’ve never linked to Coinbase, it’s a scam.

—

What to Do If You Received a Coinbase Scam Text

Received it but didn’t click anything:

Forward the text to 7726 (SPAM). Report at reportfraud.ftc.gov. Block the sender. Delete the text.

Clicked the link but didn’t enter information:

Close the page. Run a security scan on your phone. Monitor your Coinbase account for any unauthorized activity.

Clicked the link and entered your Coinbase login credentials:

Change your Coinbase password immediately — go to coinbase.com directly, not through the link. Enable two-factor authentication if you haven’t already. Review your account for any pending or recent transactions. Contact Coinbase support at coinbase.com/help.

Shared a 2FA verification code with someone who called or texted you:

Contact Coinbase support immediately at coinbase.com/help. Your account may already be compromised. Move any assets to a different wallet if you have access to your account. Enable an account-level withdrawal lock if available.

Had funds stolen from your Coinbase account:

Report to the FTC at reportfraud.ftc.gov. File a complaint with the FBI’s IC3 at ic3.gov. Contact Coinbase support — while cryptocurrency transactions are generally irreversible, Coinbase may be able to freeze associated accounts or assist with law enforcement investigations. Cryptocurrency theft is a federal crime.

—

How to Protect Your Coinbase Account From Scam Texts

Use an authenticator app for 2FA, not SMS.

SMS-based two-factor authentication is vulnerable to SIM-swapping attacks, where a scammer convinces your carrier to transfer your phone number to their SIM card. Switch to an authenticator app (Google Authenticator, Authy) in your Coinbase security settings.

Enable a withdrawal whitelist.

Coinbase allows you to whitelist specific withdrawal addresses — meaning withdrawals can only go to approved destinations. This prevents a scammer who gains access to your account from immediately sending funds to an unknown address.

Use a hardware security key.

For accounts holding significant assets, a hardware security key (YubiKey) provides the strongest available 2FA protection.

Use a unique, strong password for Coinbase.

Never reuse passwords. Use a password manager to generate a random, complex password for your Coinbase account.

Enable Coinbase’s advanced security settings.

Coinbase offers email notifications for all account activity, trusted device lists, and account-level freeze options. Enable every available security feature.

—

Frequently Asked Questions

Q: Does Coinbase actually send text messages?

A: Yes — Coinbase sends legitimate security texts for two-factor authentication, device verification, and some account notifications. The difference is that real Coinbase texts don’t contain links to click — they contain verification codes. Any Coinbase text containing a link asking you to log in or verify information is a scam.

Q: Is there any way to recover cryptocurrency stolen through a Coinbase scam?

A: Cryptocurrency transactions are irreversible by design — once funds leave your account, recovery through the blockchain is not possible. Your best avenue is: report to Coinbase (they may be able to flag associated accounts), report to the FBI IC3, and report to the FTC. In some cases, exchanges at the receiving end of stolen funds will freeze assets when alerted by law enforcement. This is not guaranteed.

Q: I received a Coinbase 2FA code I didn’t request. What does that mean?

A: It means someone has your Coinbase username and password and attempted to log in — triggering a real 2FA code sent to your phone. The text or call asking you to share that code is the scammer trying to complete their unauthorized login. Do not share the code. Change your Coinbase password immediately.

→ Back to Pillar: https://www.scammed.org/text-scams/