untrappable.Check

Coinbase email scam: is that alert or invoice real?

Editorially reviewed · Last updated September 8, 2026

Yes, this is a scam. Coinbase doesn't email you a link to “verify” your account or cancel a withdrawal.

What to do right now

  1. Don't click the link or the button. Don't reply.
  2. Check independently. Open Coinbase yourself and review activity. If anything is unfamiliar or you exposed credentials, follow its official compromised-account and locking instructions; do not assume the withdrawal is absent.
  3. If you already entered your password or 2FA code: change your Coinbase password immediately, reset two-factor, and check for unknown devices under Settings → Security. Move funds only after the account is re-secured.
All 5 steps ↓

Got a message like this?

Check it privatelyAlready tapped it?

Exhibit · Email

Withdrawal of 0.84 BTC is pending — action required
C
Coinbase Security
no-reply@coinbase-account-alerts[.]com
7:22 AM
A withdrawal of 0.84 BTC was requested from your account. If you did not request this, verify your account within 24 hours to cancel the transfer: coinbase-account-alerts[.]com/cancel
Cancel withdrawal
Illustrative email · not an original screenshot

Other versions you might get: “Your account has been locked,” a “new device sign-in,” a fake purchase receipt, or an “updated terms — re-verify your identity” notice. The text version is the Coinbase text scam; same playbook by email.

What to do right now

  1. Don't click the link or the button. Don't reply.
  2. Check independently. Open Coinbase yourself and review activity. If anything is unfamiliar or you exposed credentials, follow its official compromised-account and locking instructions; do not assume the withdrawal is absent.
  3. If you already entered your password or 2FA code: change your Coinbase password immediately, reset two-factor, and check for unknown devices under Settings → Security. Move funds only after the account is re-secured.
  4. Report it. Forward the email to security@coinbase.com, then file at reportfraud.ftc.gov.
  5. Delete it and mark it as phishing.

Reduce the risk of another scam

If you exposed Coinbase credentials or sent funds, contact official support promptly and follow its account-locking instructions. Preserve transaction hashes and destination wallet addresses and report to IC3. Crypto transfers generally lack a card-style chargeback, but reporting and provider action may still help; recovery is not guaranteed.

● Public service · free steps first

Take the free protection steps first

A suspicious message does not tell us how someone found your details. If you shared personal information, start with the official recovery guidance. You can also freeze your credit for free.

Decide what protection you need

Start with the free controls above. Compare what a paid service would add only after deciding which problem remains.

Compare free and paid protection →

No purchase needed. How we use evidence.

Frequently asked

Does Coinbase send emails about pending withdrawals?
Coinbase sends legitimate notifications and scammers imitate them. Do not use an unexpected link to cancel or verify activity. Open Coinbase independently to review the account and contact official support if the claim is unclear.
I clicked the link and entered my Coinbase login — what now?
Move fast. Change your Coinbase password immediately from the app or coinbase.com (typed yourself), reset your two-factor authentication, and review Settings → Security for unknown devices or API keys. If any crypto has already moved, contact Coinbase support right away — transfers are hard to reverse, so minutes matter. Then report the email at reportfraud.ftc.gov.
How can I tell a real Coinbase email from a fake one?
Check the full sender address: real ones end in @coinbase.com exactly — not coinbase-account-alerts[.]com or any hyphenated variant. Real security emails tell you to open the app; fakes give you a button and a deadline. When in doubt, ignore the email entirely and check your account by typing coinbase.com yourself.
Why am I getting Coinbase emails if I don't have a Coinbase account?
Impersonation messages can reach people who do not use Coinbase. Receiving one does not establish how your email was obtained. Do not follow its links; report and block it. If you suspect an account was opened using your identity, contact Coinbase independently rather than using the sender’s route.

Related scams

TextScam

Coinbase text scam: is that message real?

Got a text about a Coinbase login, withdrawal, or verification code you didn't request? Here's the verdict and exactly what to do.

EmailScam

Phishing email examples: 7 illustrations, annotated

Seven illustrated phishing emails impersonating familiar organizations, with annotated warning signs, independent checks, and steps after exposure.

EmailScam

PayPal invoice scam: paypa1 emails and “Norton” charges

A PayPal invoice for Norton you never ordered, an email from “paypa1,” or a tiny payment from “SJ3 Norman Enterprises” with a number to call? Here's what to do.

TextScam

Crypto scams: guaranteed returns are the giveaway

An “investment manager,” a can't-lose trading platform, a fee to withdraw your profits? Here's the verdict and what to do.

Sources

  1. 01What to know about cryptocurrency and scams· Federal Trade Commission
  2. 02How to recognize and avoid phishing scams· Federal Trade Commission
  3. 03Official security and fraud guidance· coinbase.com
  4. 04What To Do if You Were Scammed· consumer.ftc.gov

Pass it on

Help protect someone else

If this could have fooled you, it can fool someone you know: a parent, a friend, the family group chat. It's safe to forward, and stands on its own as a record for a bank or the police.

Got a message like this?

Check it privatelyAlready tapped it?