Coinbase text scam: warning signs and how it works
A coinbase text scam is a fake SMS dressed up to look like it came from Coinbase, built to get you to tap a link, call a number or hand over a code.
Coinbase states on its phishing help page that it will never call or text you to request account access, your password or your 2-step verification code.
So any text that asks for one of those things, or pushes you toward a login link, is not Coinbase. The rest of the message can be ignored once you know that.
How a fake Coinbase text is put together
Most of these messages follow the same recipe, and the Federal Trade Commission describes the pattern in its guide to spam text messages. The sender claims there is news about your account or a transaction. The two most common hooks are “suspicious activity” and “a problem with your payment information”.
Scammers can spoof the sender’s phone number, so a message labelled Coinbase proves nothing about who actually sent it.
Then comes the pressure. The message gives you minutes to act, or says your account will be locked, so you tap before you think.
Coinbase warns that phishers register lookalike addresses such as www.c01nbase.com, with a zero standing in for the letter o. On a phone screen you will not spot the swap.
The destination is a copy of the Coinbase login page. The FTC notes that if you log in, the scammers capture your username and password, and some links install malware on the phone instead.
Video: The CryptoDad
What a real Coinbase message never asks for
Coinbase publishes a list of things its staff will never do, and every item doubles as a scam detector. Each row below comes from the same phishing help page, so you can check it against the message in front of you.
| The fake text asks you to | What Coinbase says about it |
|---|---|
| Confirm your password or 2-step verification code | Staff will never ask for your password or 2-step code |
| Enter or “back up” your seed phrase | Coinbase never provides a seed phrase or asks for yours |
| Move funds to a new “safe” wallet, vault or address | Coinbase will never call or text you with a new address to move funds to |
| Install an app or let an agent access your device | Staff will never ask you to install software or remotely access your device |
| Call a phone number in the message | Coinbase will never ask you to contact an unknown number to reach it |
| Buy a “Premium Insurance Policy” for your crypto | Coinbase does not offer insurance products of any kind |
If the text in your inbox matches any left-hand row, you already have your answer.
Three checks before you tap anything
First, do not use the link. Coinbase’s advice is to reach the site by typing https://www.coinbase.com yourself or opening the app you already installed. The FTC says the same about any company: contact it through a number or website you know is real, never through the details in the text.
Second, look at the whole URL if you already opened it. Read every character of the domain before the first slash, because the swap will be one letter.
This check fails against a shortened link, since the real domain stays hidden until the page loads. Treat any shortener in a “Coinbase” text as a fake.
Third, if you entered anything, lock the account. Coinbase’s own wording is “lock first, ask later”: lock your account in the app, then email security@coinbase.com. Coinbase also recommends turning on withdrawal allow-listing so on-chain transfers can only go to wallets you approved in advance.
How to report a Coinbase scam text
Coinbase’s reporting page asks for a screenshot of the text sent to security@coinbase.com. Its security team uses the report to get the phishing site taken down.
Then forward the message to 7726, which spells SPAM on a keypad. Coinbase and the FTC both point to this free service, which helps US carriers such as AT&T, Verizon and T-Mobile block similar messages. It is a US short code, so on a carrier outside the US the number may do nothing.
You can also file the message with the FTC at ReportFraud.ftc.gov. Signed-in Coinbase customers can use the Scam Hub inside the help centre to report activity and lock the account in one place.
Text phishing is one entry point among several. The same spoofed login page turns up inside fake wallet apps that clone the branding of real ones.
The same “act now” pressure runs through the Telegram romance-style crypto scam. And if the scare text has you questioning the exchange itself, the breakdown of whether Coinbase is safe or overrated separates Coinbase’s real protections from the impersonators.
Frequently asked questions
Does Coinbase ever send text messages?
Coinbase states on its help pages that it will never call or SMS you to request account access. Treat any text you did not trigger yourself as suspect, and check your account by opening the app or typing coinbase.com rather than following the message.
I tapped the link and typed my password. What now?
Lock your account from inside the Coinbase app, change your password from a device you trust, and email security@coinbase.com with a screenshot of the text. Coinbase’s help page says to lock first and ask questions later.
Why did I get a Coinbase text when I have no Coinbase account?
The sender does not know whether you are a customer. These messages go out to phone-number lists, so receiving one says nothing about your data or an account in your name. Report it to 7726 and delete it. This page is general information, not financial or legal advice.
