If a text claiming to be from Coinbase says a withdrawal is pending, your account is locked, or someone changed your password, and it gives you a phone number to call, it's a scam. Don't call, don't tap any link, and don't reply. Open the Coinbase app yourself, or type coinbase.com into your browser, and check your account there.
That one rule covers most of these texts. The rest of this guide explains the different versions, what a real Coinbase message looks like, and what to do if you've already called the number.
Does Coinbase send text messages?
Yes, so a text from "Coinbase" isn't automatically fake. Coinbase uses text messages for two-step verification codes. SMS is its default verification method, though Coinbase itself calls it the least secure option.
What a real verification text doesn't do is give you a phone number to call, a link to "secure" your account, or a reference number for a case you never opened. Coinbase says it doesn't make unsolicited calls to customers, and its support team will never call or text you to give you a new wallet address or recovery phrase.
The Coinbase scam texts going around
The fake withdrawal code
This is the most common one. You get a text that looks like a security code for a withdrawal you didn't make, followed by a number to call if it wasn't you. In May 2025, the Washoe County Sheriff's Office in Nevada published one:
(COINBASE) The OTP code for your withdrawal is 736191. … please call us on [phone number]. Ref CB97405.
There's no withdrawal. The code is made up, and the "reference number" is there to make it look official. The whole point is to get you on the phone with someone pretending to be Coinbase.
The login, "suspended transfer" or "account problem" text
Others claim someone signed in from an unrecognized device, a transfer was suspended, or your account was flagged, and ask you to reply or call. Coinbase has described this exact pattern: a text about a suspended Bitcoin transfer, a reply from the customer, and then a call from fake "Coinbase Security."
The email version
The same scam arrives by email too, including a 2025 "migrate your funds" campaign that handed people a recovery phrase the scammers already knew. Our guide to Coinbase scam emails covers how to check an email and the versions going around.
Got a real code you didn't ask for?
Sometimes the code is genuine: a plain verification code from Coinbase, with no phone number and no link, that you didn't request. That usually means someone tried to sign in to your account or confirm an action, and Coinbase sent the code to your phone. They may already have your password.
- Don't share the code with anyone, including someone who calls you about it.
- Sign in yourself, change your Coinbase password, and check your list of signed-in devices.
- Change your email password too, since that's often how they got in.
- Switch from text-message codes to a passkey, security key or authenticator app.
What happens if you call the number
The person who answers says they're from Coinbase Security, and they often know a lot about you. In May 2025, Coinbase disclosed that criminals had bribed overseas support contractors to copy customer data: names, addresses, phone numbers, emails, the last four digits of Social Security numbers, ID images and account balances. Maine's breach notice puts the number of people affected at 69,461. No passwords or keys were taken, but details like these make a fake support call far more convincing.
From there, the script Coinbase has described goes like this:
- They tell you your account is under attack and your money has to move now.
- They walk you through installing a real self-custody wallet app.
- They give you a recovery phrase to use, or ask for yours.
- You move your crypto into that wallet, and they empty it.
Some ask for your password and the code on your screen instead, or ask you to install remote-access software. Every version ends the same way.
Blockchain investigator ZachXBT estimated in early 2025 that Coinbase users were losing about $300 million a year to scams like these. In December 2025, Brooklyn prosecutors charged a 23-year-old with allegedly taking nearly $16 million from about 100 people by posing as Coinbase support.
What Coinbase will never do
According to Coinbase's own support guidance, Coinbase will never:
- ask you to move your crypto to a "safe" or "secure" wallet or address
- give you a recovery phrase, or ask for yours
- ask for your password or your two-step verification code
- ask you to install software or let them control your device
- call or text you with a new wallet address or a support number to call
If anyone claiming to be Coinbase asks you to do any of these, hang up and email [email protected]. The one time Coinbase calls you is if your own support call drops: an agent may call back within five minutes, from the same number, and ask a security question. Scammers can fake caller ID, so a familiar number proves nothing.
What to do now
If you just got the text
- Don't reply, call or tap anything.
- Email a screenshot to [email protected], which is where Coinbase asks for phishing reports.
- Forward the text to 7726 (SPAM) to report it to your US carrier.
- Keep the screenshot, delete the text, then open the Coinbase app yourself to confirm nothing has changed.
If you called them or shared a code or password
Lock your Coinbase account right away. In the app, go to Account & settings, then Security, then Lock Account. On a computer, go to accounts.coinbase.com/security yourself. Locking signs out every device and pauses transactions, and crypto sends stay paused for 24 hours after you unlock it. Then change your Coinbase and email passwords, turn on a passkey or security key, and remove any remote-access app they had you install.
If you can't sign in to lock it, find the support number on Coinbase's compromised-account help page. Never use a number from a text, an email or a search ad.
If you already sent crypto or shared a recovery phrase
Treat any wallet whose recovery phrase they saw or supplied as compromised. On a clean device, with any remote-access app removed, create a new wallet with a new phrase and move what's left into it. Then:
- report the theft to Coinbase support through the help center, and keep the case number
- file with the FBI at ic3.gov and the FTC at reportfraud.ftc.gov
- save the transaction IDs, the addresses you sent to, the phone numbers and every message
If you sent funds to an Ethereum address, our free scam checker shows whether that address has been reported and lists its recent transfers. Our guide on how to recover stolen crypto walks through evidence, reporting and what happens when an exchange freezes funds.
Will Coinbase refund you?
It depends on what happened, and the rules are narrow.
- Losses tied to the May 2025 breach. Coinbase said it would voluntarily reimburse retail customers who sent funds to scammers as a direct result of that incident, for losses before its May 15, 2025 announcement, after reviewing each case.
- Coinbase One account protection. Paid Coinbase One members can claim up to $250,000 for eligible unauthorized account takeovers. The terms say it doesn't cover transfers you authorize by mistake, which is what most of these scams trick you into, and sharing your password or a verification code voids it. Coverage also requires a passkey or security key rather than text-message codes, plus both a police report and an IC3 complaint, filed within 45 days.
Outside those cases, don't count on a refund. Transfers on the blockchain can't be reversed.
Watch for the follow-up scam
Once you've lost money, expect more calls. The FBI warns about fake IC3 employees and fake law firms who reach out to victims, claim they've found the money, and ask for a fee to release it. Real agencies don't charge victims, and no law firm is an official government recovery partner.
Locked out of a wallet you own?
Crypto Asset Recovery doesn't recover funds lost to scams. What we do is help people get back into wallets they own but can't open, such as a Coinbase Wallet extension with a forgotten password. The cracking runs on offline, air-gapped machines, and you only pay if we succeed.
Frequently asked questions
Does Coinbase send text messages?
Yes. Coinbase texts two-step verification codes to accounts that use SMS. A real Coinbase text won't ask you to call a number, tap a link to secure your account, or move your funds.
What number does Coinbase text from?
Coinbase doesn't publish a list of the numbers it texts from, so don't judge a message by its sender. Judge it by what it asks you to do, and check your account by opening the Coinbase app yourself.
What is Coinbase's phone number?
Only trust a phone number you find yourself on Coinbase's official help pages at help.coinbase.com. Never call a number from a text, an email or a search ad, because scammers buy ads and plant fake "Coinbase support" numbers online.
Why did I get a Coinbase verification code I didn't request?
If it's a plain code with no phone number or link, someone may have tried to sign in to your account with your password. Don't share the code, change your Coinbase and email passwords, and switch to a passkey or security key. If the text includes a number to call, it's a scam and the code is fake.
Does Coinbase call customers?
Coinbase says it doesn't make unsolicited calls. The exception is a callback after your own support call drops. Anyone who calls out of the blue about a problem with your account is a scammer, even if the caller ID says Coinbase.
What if I clicked the link in a Coinbase scam text?
If you didn't enter anything, close the page and run a security scan on your device. If you typed your email, password or a code, lock your Coinbase account, change those passwords, and switch to a passkey or security key.
Will Coinbase refund me if I was scammed?
Usually not for transfers you approved yourself. Coinbase reimbursed eligible customers whose losses were a direct result of the May 2025 data breach, and Coinbase One covers some unauthorized account takeovers, but it excludes transfers you authorize by mistake.
Is Coinbase itself a scam?
No. Coinbase is a large, publicly traded US exchange. The scams use its name because so many people have accounts there.
