untrappable

Coinbase text scam: is that message real?

Editorially reviewed · Last updated July 21, 2026

Yes — this is a scam. Coinbase doesn't text you links to “verify” your account.

Text Message · Today 9:06 AM
from +1 (332) 555‑0147
Coinbase: We blocked a $4,200 withdrawal request. If this wasn't you, verify your account now: coinbase-secure.app/verify
The Text message, as received
Example 2 · The “withdrawal code” call-bait version
Text Message · Today 8:47 AM
from +1 (555) 014-8821
(COINBASE) The OTP code for your withdrawal is 402113. If this was not you please call us on +1 (555) 019-4402. Ref: CB55317.
Example 3 · The “account suspended” deadline version
Text Message · Today 6:12 PM
from +1 (555) 016-3350
Coinbase Security: Your account has been temporarily suspended due to unusual activity. Verify your identity within 24 hours to avoid permanent closure: coinbase-restore.app/verify
Example 4 · The “new device sign-in” version
Text Message · Today 11:03 AM
from +1 (555) 012-7719
Coinbase: A sign-in from a new device (Chrome, Ohio) was detected. Not you? Secure your account now: cb-device-alert.net/secure

Other versions you might get: A one-time “withdrawal code” with a phone number to call, a login from a new device, a code to “confirm” a transaction you never made, “Your Coinbase account is locked” — or a “wallet migration” that hands you a recovery phrase. Same playbook, same fix: the app is the only real Coinbase.

Word-for-word versions going around

Each of these is a real text, quoted exactly as people received it. If yours matches one — even loosely — it’s the same scam.

  • “(COINBASE) The OTP code for your withdrawal is 736191. If this was not you please call us on +1 (877) 338-9228. Ref CB97405.”
    Documented by KOLO 8 News Now (Washoe County Sheriff’s Office alert) · May 2025
  • “Your Coinbase withdrawal code is: 611835. Please do not share this code with anyone. If you have not requested this, please call : (908) 975-9814. REG: CB77190.”
    Documented by Yahoo News · July 2025
  • “Coinbase Alert: Unusual login attempt detected. Verify your account immediately at coinbase-secureauth.com”
    Documented by MalwareTips · October 2025
  • “Your account will be suspended in 24 hours if not verified. Log in here to keep access: cb-verifywallet.net”
    Documented by MalwareTips · October 2025
  • “Coinbase: We have noticed a login attempt from Beijing, China, If you did not authorize this login please call us immediately on (866) 524-**** Ref:CB9032”
    Documented by Reddit r/Scams · August 2025
  • “Coinbase: Your Withdrawal Code is 41****. Please do not share this code with anyone. If you have NOT requested this, please call: INSERT NUMBER for support. REF:CB10778”
    Documented by Reddit r/Scams · September 2025
  • “[CB.payments]- Your approval is currently required for a pending withdrawal of $1,862.75. If you were not expecting this, call [removed phone number that is 3-2-5 digits]”
    Documented by Reddit r/Scams · June 2026

What to do right now

  1. Don't tap the link or call any number in it. Don't reply — even “STOP” tells them the number is live.
  2. If you already entered anything: change your Coinbase password from the app, turn on (or reset) 2FA, and check Settings → Security for unknown devices.
  3. Report it. Forward the text to 7726 (SPAM), then file at reportfraud.ftc.gov.
  4. Delete the message.

How to make sure it never bites you

You got this because your number is on a list scammers buy and resell. The fix is to get it removed and add a layer between you and them — see how to stop spam texts for good.

Every current version of the Coinbase text

Four scripts cover nearly every “Coinbase” text in circulation. The withdrawal code you never asked for: “(COINBASE) The OTP code for your withdrawal is 736191. If this was not you please call us on…” — the version the Washoe County Sheriff’s Office warned about in May 2025, with the same script hitting New Jersey by summer. There is no withdrawal; the “code” exists to panic you into calling. The new-device login: a sign-in “detected” on a device you don’t own, plus a link to “verify your identity.” The locked account: “temporarily suspended,” a 24-hour deadline, and a look-alike domain such as cb-verifywallet.net. The wallet migration: the cleverest — a message claiming Coinbase is “transitioning to self-custodial wallets” that hands you a recovery phrase for your “new wallet.” The phrase is pre-generated by the scammer, so any funds you move into that wallet are already theirs — which is why Coinbase states it “will never send you a recovery phrase.” Notice what all four share: each supplies the contact channel — a link, a phone number, or a phrase — so you never touch the real coinbase.com.

What happens if you tap

The page behind the link is a faithful copy of the Coinbase login screen — and it isn’t passive. In campaigns TechRadar documented, credentials typed into the fake page were “relayed to the actual Coinbase site” in real time, “and then the crooks ask for the 2FA code as well.” The two-factor code that’s supposed to save you gets phished in the same motion as your password. From there the timeline is minutes, not days: the attacker signs into the real account, changes recovery options, disables security features, and transfers coins to wallets they control. This is what makes crypto phishing crueler than bank phishing — an on-chain transfer has no dispute button. No issuer to call, no chargeback, no 60-day window: once coins leave the account, neither Coinbase nor your bank can pull them back. One reassurance, because you may need it: if you tapped the link but typed nothing, you’re almost certainly fine. Opening the page doesn’t compromise you. Close it, delete the text, and check your account by typing coinbase.com yourself.

Coinbase’s actual security rules

Coinbase has published rules that make every scam text self-identifying. On recovery phrases: “We will never send you a recovery phrase, and you should never enter a recovery phrase given to you by someone else.” On credentials: Coinbase will never ask for your two-factor codes or private keys — not by text, not by phone. And the FBI’s guidance for any “exchange security” contact is blunt (alert I-080124-PSA): “Hang up. Call the cryptocurrency exchange’s official phone number to verify if there is a problem” — and “if anyone asks for your account log-in information at any point, do not provide it.” The pattern underneath all of it: every real security control lives inside the Coinbase app or at coinbase.com, reached by you, on your own initiative. Any message that brings the destination to you — a link, a number, a phrase — is fake by definition. Report specimens by screenshotting the text and sending it to security@coinbase.com, then forward the text to 7726.

The follow-up call scam

The text is often only act one; the phone call is where the money moves. The FBI issued a dedicated warning about criminals posing as crypto-exchange support: an unsolicited call or message “conveys urgency,” claims “someone is attempting to compromise the victim’s account,” and walks you into handing over login details — or moving your crypto to a “safe” wallet the caller controls. What makes the current calls convincing is that the caller may genuinely know things about you. Coinbase disclosed in May 2025 that criminals bribed overseas support contractors to leak data on roughly 69,000 customers — names, addresses, phone numbers, the last four digits of Social Security numbers, government-ID images, even balance snapshots and transaction history. No passwords, private keys, or funds were exposed; the haul was fuel for impersonation. So a caller reciting your balance hasn’t proven they’re Coinbase — they’ve proven your data was in a breach. Flip the logic and it protects you: knowing things about you is exactly what a scammer would do now. Coinbase employees will never call you to move funds. The moment a caller mentions transferring, “verifying,” or “safeguarding” your assets, you’re talking to the thief — hang up mid-sentence.

If your crypto is already gone

Honesty first: cryptocurrency transfers are irreversible, and most stolen crypto is never recovered. Anyone who promises otherwise is lying to you — more on that in a moment. What’s worth doing, today: Lock what’s left. From the app, change your password, reset two-factor authentication, and remove any device or API key you don’t recognize. Tell Coinbase at security@coinbase.com, with screenshots, timestamps, and the destination addresses. File at [ic3.gov](https://www.ic3.gov) with transaction hashes, wallet addresses, amounts, and a timeline — this is the report that matters, because the FBI aggregates cases and can sometimes freeze funds where scammers cash out. Call your bank if a card or account is linked. Then brace for the second wave: “crypto recovery services.” The FBI warns (alert I-081123-PSA) about companies that advertise to scam victims, charge “an up-front fee and either cease communication with the victim after receiving an initial deposit or produce an incomplete or inaccurate tracing report and request additional fees.” Remember: “Law enforcement does not charge victims a fee for investigating crimes.” Anyone sliding into your DMs with a guarantee found your name the same place the first scammer did.

Untrappable · Public service advisory

Stop the next one at the source

You got this because your details are on lists that get bought, sold, and leaked. You can't unspill that, but you can make it useless to a scammer. Start with the free steps — they do most of the work.

Optional — if you'd rather it was handled for you

If you'd rather have it watched for you, an identity-protection service monitors your accounts, SSN, and the dark web, warns you the moment something new appears, and helps you recover if someone gets through.

See identity protection →

Affiliate link — we may earn a commission at no extra cost to you. It never changes our verdicts. Why we can still be trusted.

Keep this · forward it to someone who needs it

Frequently asked

Does Coinbase send text messages about blocked withdrawals?
No. Coinbase doesn't text you a link to “verify” your account or approve a withdrawal. Real security alerts appear inside the Coinbase app, and they never ask you to tap a link or share a code. Any text with a “verify now” link is a phishing scam, however official it looks.
I tapped the link and entered my details — what should I do now?
Act fast. Open the Coinbase app yourself, change your password, then turn on (or reset) two-factor authentication and review Settings → Security for unknown devices. If you approved any transfer, contact Coinbase support and your bank right away. Then ignore any follow-up “refund” or “recovery” text — that's round two of the same scam.
What is coinbase-secure.app?
It's a look-alike phishing domain, not owned by Coinbase. The real site is coinbase.com, and the app is the only place you manage security. Scammers register near-identical names — coinbase-secure.app, coinbase-verify.com — to harvest logins. If the address isn't exactly coinbase.com, don't enter anything.
How do I report a Coinbase scam text?
Forward the text to 7726 (SPAM) so carriers can act on the number, then report it to the FTC at reportfraud.ftc.gov. Reporting won't recover lost funds, but it helps shut the campaign down for the next person.
Does Coinbase ever send text messages?
Yes — exactly one kind: a one-time sign-in code that you trigger yourself by logging in, if you use SMS two-factor authentication. That’s the entire list. Coinbase doesn’t text links to “verify” your account, doesn’t text phone numbers to call about withdrawals, and “will never send you a recovery phrase.” So the test is simple: a text you caused, arriving while you sign in, can be real. A text that arrives out of nowhere asking you to do something — tap, call, reply — is a scam, no matter how much it seems to know about you.
I got a Coinbase verification code I didn’t request — is someone in my account?
Not yet — and if the code is real, it means your two-factor wall did its job. An unrequested genuine code usually means someone has your email and password and got stopped at 2FA: change your Coinbase password from the app now, and anywhere else you reused it. But look at the message twice, because the current scam wave sends fake “withdrawal code” texts with a phone number to call — the Washoe County Sheriff’s Office documented one reading “(COINBASE) The OTP code for your withdrawal is 736191. If this was not you please call us…” A real code never comes with a phone number. Never call it, and never read any code to anyone, including “support.”
I called the number in a Coinbase text and gave them information — what now?
Treat the account as compromised, right now. Open the Coinbase app yourself — not any link or number from the text — then change your password, reset two-factor authentication, and remove devices you don’t recognize. Email security@coinbase.com with a screenshot of the text and exactly what you shared. If any crypto has moved, file at ic3.gov with the transaction details. The FBI’s rule for these calls is two words: “Hang up.” And expect a callback offering to “reverse” the theft or process a “refund” — that’s the same crew, taking a second pass.
Can Coinbase recover crypto stolen in a text scam?
Usually, no — and you deserve to hear that straight. Blockchain transfers are irreversible: once coins reach a scammer’s wallet, neither Coinbase nor your bank can pull them back. Report anyway — security@coinbase.com so the accounts and domains get flagged, and ic3.gov so the FBI can trace where the funds cash out; freezes and restitution do happen, but rarely, so treat any recovery as a bonus, not a plan. And be ready for “crypto recovery services” promising your coins back for an up-front fee: the FBI warns these are scams aimed at people who’ve already been scammed. “Law enforcement does not charge victims a fee for investigating crimes” — and nobody legitimate guarantees recovery.
Why am I getting Coinbase texts when I don’t even have a Coinbase account?
Because the blast isn’t aimed — it’s sprayed. Scammers text enormous purchased lists of phone numbers, betting that a slice of recipients hold Coinbase accounts; everyone else is free postage. A Coinbase text sent to someone with no Coinbase account is the scam confessing: there’s no account to lock, no withdrawal to block, nothing to verify. Delete it and forward it to 7726. If the texts keep coming, the fix isn’t Coinbase-specific — your number is on sold lists, and the answer is getting it off them: see how to stop spam texts for good.

Related scams

Sources

A public service

Help protect someone else

Scams spread because people stay quiet about them. If this could have fooled you, it can fool someone you know — a parent, a friend, the family group chat. Passing it on is the easiest good thing you'll do today. It's safe to forward, and stands on its own as a record for a bank or the police.