The Coinbase Scam Call That Almost Got Me

In June 2023 I got a text telling me my Coinbase two-factor authentication had been changed. Then my phone rang. San Francisco number. Calm, professional voice. "Coinbase support" calling about suspicious activity on my account, wanting to verify some travel.

I trade for a living. I have spent years around every kind of market predator. And I am telling you plainly: this crew was good enough that it almost worked on me.

Here was their playbook, step by step, because you will see a version of it eventually.

The text creates the emergency. Your 2FA was changed. If that was not you, act now. Fear opens the door. Then the call arrives while the fear is fresh, that timing is not luck, it is choreography. The voice is calm and procedural, exactly like real support. They ask harmless verification questions first. Are you traveling? Did you authorize a login from another state? Each yes or no builds the rhythm of you answering their questions.

Then the finisher. An email arrives while you are still on the phone, from what looks exactly like help@coinbase.com, containing a real verification code. The voice says: to secure your account, just read me the code we sent.

That code was the code to my account. Reading it aloud would have handed them everything. They were trying to drain it while I was on the line reassuring me they were saving it.

The three-second check that beat them: legitimate companies never call you and ask for a code. Not banks, not exchanges, not ever. The direction of contact is the entire tell. If they called you, they are not who they say they are. Hang up, open the app yourself, check your account directly. Three seconds.

Afterward I dug into how they had my name, number, and email paired together. My data appeared in more than twenty separate breaches over the years. Yours almost certainly has too, which means the raw material for this call already exists for you. I posted the whole episode publicly and it went viral because thousands of people replied with some version of "they called me too, and it worked."

The uncomfortable math: these operations run on volume. They do not need to fool the paranoid. They need to catch one distracted person out of a hundred on a bad day. I estimated when it happened that ninety eight percent of normal users would have handed over that code, and nothing since has changed my estimate.

Set the rule now, while you are calm, so it holds when you are not: no code, ever, to anyone who contacted you first. Tell your parents the same sentence tonight. This scam family collects more from ordinary people every month than most market crashes ever will.