Coinbase Text Scam: The $57,000 Withdrawal Code Trap You Need to Know
A Coinbase text scam can look surprisingly ordinary: a short message arrives on your phone, a withdrawal code appears, and the sender warns that money is about to leave your account. The instinctive reaction is usually to panic and call the number in the message.
That reaction is exactly what sophisticated scammers want.
In one case reported in July 2026, a victim was reportedly left facing a loss of around $57,000 after a scam centred on a genuine Coinbase withdrawal code. The important detail is that the code was not necessarily fake. The attack worked because criminals had already obtained enough account information to trigger a legitimate security process and then used the resulting message as part of a social-engineering attack.
That changes the way people should think about suspicious crypto messages.
A genuine-looking SMS does not prove that the person contacting you is Coinbase. It may only prove that someone has interacted with your account. Coinbase itself warns that its support staff will never ask for passwords, two-factor authentication codes, seed phrases or instructions to move cryptocurrency to a new address.
For UK crypto users, the distinction matters even more because cryptocurrency losses do not automatically receive the same protection as ordinary bank fraud. Understanding how the scam works, what Coinbase is doing about these threats and where UK reimbursement rules stop can make the difference between a suspicious message and a devastating financial loss.
What is actually happening, step by step
The most dangerous part of a Coinbase text scam is often the social engineering, rather than the SMS itself.
The scam can begin before the victim receives a single message.
Step 1: The attacker obtains information
Criminals may obtain an email address, password, leaked credentials or other personal information through phishing, password reuse, malware, data breaches or previous scams.
They do not necessarily need complete control of an account immediately. Sometimes they only need enough information to make their next move convincing.
If an attacker has obtained a Coinbase password, for example, they may attempt to sign in and trigger a legitimate security process.
Step 2: A real security message can be generated
This is where the scam becomes particularly convincing.
A victim may receive a genuine Coinbase security or withdrawal-related code because someone has actually initiated an action involving the account.
The victim sees the familiar brand name and a real-looking message. They may assume that because the code is genuine, the person calling them must also be genuine.
That assumption is dangerous.
The authenticity of a code does not authenticate the person asking for it.
Step 3: The criminal contacts the victim
The attacker may then call or text, pretending to be Coinbase support or a security department.
The conversation is designed to create urgency.
The victim might be told that someone is attempting to withdraw funds, that the account has been compromised or that the only way to stop the transaction is to provide the code.
The criminal may even know some basic information about the victim, making the story appear more legitimate.
Step 4: Fear takes over
This is the psychological centre of the attack.
When someone is told that tens of thousands of pounds or dollars could disappear within minutes, rational decision-making becomes much harder.
The scammer may deliberately use phrases such as “security breach”, “unauthorised withdrawal”, “fraud department” or “account lockdown”.
The objective is not simply to steal a code.
It is to make the victim stop verifying and start reacting.
Step 5: The victim gives away the final piece
Once a victim reads out a two-factor authentication code or follows instructions from the criminal, the attacker may be able to complete an action that would otherwise have been blocked.
This is why Coinbase explicitly states that it will not ask customers for passwords or 2FA codes and will not instruct customers by phone or text to transfer funds to another destination.
The safest response to an unexpected code is therefore not to discuss it with the person who contacted you.
Instead, stop communicating and access Coinbase independently through the official app or website.
Why a genuine Coinbase code can make the scam more dangerous
People are naturally taught to look for obvious signs of fraud: spelling mistakes, strange links, fake logos and poorly written messages.
Modern scams can be much more sophisticated.
A genuine security code can create a false sense of legitimacy.
Imagine receiving a message containing a code that you recognise as coming from Coinbase. Seconds later, someone calls claiming to be from Coinbase security.
The victim thinks:
“They know about the code, so they must be genuine.”
But the logic is backwards.
The attacker may know about the code because they caused the security event in the first place.
This is one reason the Coinbase text scam deserves attention beyond the traditional definition of SMS phishing. Coinbase describes phishing as an attack in which criminals impersonate legitimate organisations and attempt to persuade people to disclose sensitive information. The company specifically warns users about suspicious texts, calls and websites.
The lesson is simple: never use the incoming message as your method of verifying the incoming message.
If the SMS tells you to call a number, do not call it.
If someone calls you and says they are Coinbase, hang up and contact Coinbase through a channel you opened yourself.
What Coinbase and the wider industry are actually doing
Coinbase has repeatedly published guidance aimed at reducing phishing, account takeover and social-engineering attacks.
Its current security guidance says customers should never provide passwords, 2FA codes or seed phrases to alleged support agents. Coinbase also recommends strong two-factor authentication, with hardware security keys described as the strongest option, and recommends withdrawal allow-listing where available.
The company also provides a mechanism for reporting phishing attempts.
Coinbase asks users who encounter phishing sites to report the URL to its security team. For suspicious SMS messages, it recommends sending a screenshot to its security email address and, for US mobile users, forwarding suspicious texts to 7726.
The broader cryptocurrency industry is also moving towards stronger authentication, transaction monitoring and anti-fraud controls.
But technology cannot eliminate the human element.
A security system may correctly identify an unusual login. It may correctly send a verification code. It may correctly demand two-factor authentication.
None of those protections can completely stop a criminal if the victim is persuaded to hand over the final authentication factor.
That is why the industry increasingly treats social engineering as a security problem in its own right.
The data: why crypto absorbs a loss that banking now refunds
The financial difference between traditional banking fraud and cryptocurrency fraud is becoming increasingly important in the UK.
The UK’s rules for certain Authorised Push Payment (APP) scams changed significantly on 7 October 2024. Under the mandatory reimbursement framework, eligible victims can receive reimbursement from their payment service provider, subject to the rules and applicable limits.
The Payment Systems Regulator reported in June 2026 that, during the first 15 months of the policy, 89% of money lost to in-scope APP scams — approximately £243 million — had been reimbursed. Around 243,000 claims were in scope during that period.
That is a major difference from the world of crypto.
If a victim voluntarily transfers cryptocurrency to an address controlled by a scammer, recovering the assets can be extremely difficult. A blockchain transaction generally cannot simply be reversed in the same way as a disputed bank payment.
The FCA also distinguishes between unauthorised payments and payments that a customer was tricked into authorising. Its guidance tells consumers to contact their bank or payment service provider immediately when they discover a fraudulent payment.
This creates a complicated situation.
Suppose a UK consumer is manipulated by a fake Coinbase support agent and ends up transferring cryptocurrency.
The victim may feel that the payment was “fraudulent”, but the legal and operational treatment can depend heavily on how the money moved, which payment service was involved, who authorised it and which rules apply.
A bank transfer into a crypto exchange is not automatically equivalent to a cryptocurrency transfer out of the exchange.
That distinction is crucial.
The regulatory tension
The UK is trying to strengthen consumer protection while also developing a regulatory framework for digital assets.
That creates an obvious tension.
Regulators want consumers to be protected from fraud. At the same time, crypto transactions can be deliberately designed to move quickly across borders and between wallets without a central authority capable of reversing every transaction.
Traditional banking systems have spent decades developing fraud-monitoring and reimbursement mechanisms.
Cryptocurrency operates differently.
A bank may be able to freeze or recall certain transactions. A blockchain generally does not have a central customer-service department that can reverse a confirmed transfer because the sender says they were deceived.
This does not mean crypto consumers have no protection.
It means the point at which protection operates is different.
The UK banking system has increasingly placed responsibility on payment providers to detect and respond to APP fraud. The PSR’s latest data indicates that the reimbursement system has produced high repayment rates for eligible claims.
But crypto users need to be careful about assuming that those protections automatically follow cryptocurrency wherever it goes.
They do not.
That is one reason a Coinbase text scam can have such severe consequences.
Why scammers are targeting crypto users so aggressively
Cryptocurrency offers criminals several attractive characteristics.
Transactions can be rapid.
Wallet addresses can be difficult for ordinary users to connect to a real-world identity.
Funds may cross borders within minutes.
And victims can be pressured into believing that immediate action is necessary.
The psychological side of crypto scams is also powerful.
A scammer can claim that a victim’s Bitcoin, Ethereum or stablecoins are about to be withdrawn. Because cryptocurrency markets operate around the clock, the victim may believe there is no time to wait.
That creates the perfect environment for social engineering.
The scammer does not necessarily need to defeat Coinbase’s security systems.
They may only need to convince the customer to help them pass those security systems.
That is a fundamentally different threat.
What happens next
The next phase of the Coinbase text scam problem is likely to involve more personalised attacks rather than crude mass messages.
Artificial intelligence makes it easier for criminals to create convincing written communication, imitate professional language and conduct long conversations with victims.
The message may contain the victim’s name.
The caller may know the approximate value of the account.
The scammer may already know that a login attempt or security code has been generated.
The result can feel almost indistinguishable from genuine customer support.
That means the old advice — “look for spelling mistakes” — is no longer enough.
The stronger rule is:
Never trust an incoming communication simply because it contains information that appears to be private.
A real-looking message can still be part of an attack.
The crypto industry is also likely to continue strengthening account protection, transaction warnings, withdrawal controls and identity verification.
For consumers, however, basic security behaviour remains one of the strongest defences.
Use a unique password.
Enable strong two-factor authentication.
Prefer a hardware security key where practical.
Do not share authentication codes.
Never install remote-access software because a supposed support agent tells you to.
Never transfer cryptocurrency to a new wallet because someone claiming to be Coinbase tells you to.
And never call a phone number supplied by an unexpected SMS.
If an account appears compromised, open the official Coinbase app or independently navigate to the official Coinbase website rather than following the instructions contained in the suspicious message. Coinbase specifically recommends accessing its genuine website directly rather than using potentially deceptive addresses.
What UK Coinbase users should do after receiving a suspicious text
If you are in the UK and receive a Coinbase message that you did not expect, treat it as a potential security incident.
First, do not reply.
Do not click links.
Do not call the number contained in the message.
Do not provide a withdrawal code, login password or 2FA code.
Instead, open Coinbase independently using the official app or a trusted bookmark.
Check your account for unusual logins, withdrawals or security changes.
If you believe your credentials may have been exposed, change your password and strengthen your authentication.
If cryptocurrency has already been transferred, contact the relevant exchange or financial institution immediately and preserve evidence.
Take screenshots of the SMS.
Save emails.
Record telephone numbers.
Keep transaction IDs and wallet addresses.
Do not delete evidence simply because the scammer has stopped contacting you.
Coinbase says suspicious phishing attempts can be reported to its security team.
UK victims should also consider reporting fraud through the appropriate UK reporting channels and contacting their bank or payment provider immediately if a bank payment was involved.
Speed matters because fraud investigations can depend on how quickly providers are alerted.
Most importantly, beware of a second scam.
After losing money, victims are often desperate to recover it. Criminals can exploit that desperation by offering fake “recovery” services, claiming they can trace blockchain funds or hack the scammer’s wallet.
Anyone demanding an upfront payment to “unlock” or “recover” stolen cryptocurrency should be treated with extreme caution.
FAQ’s
What is a Coinbase text scam?
A Coinbase text scam is a fraudulent attempt that uses SMS messages, often while impersonating Coinbase, to trick a customer into revealing credentials, authentication codes, clicking a malicious link or transferring cryptocurrency.
Is a Coinbase withdrawal code always fake if I did not request it?
No. An unexpected code can potentially be genuine. That does not mean the person contacting you is genuine. An attacker may have triggered a legitimate security process after gaining access to account credentials.
Will Coinbase ask for my 2FA code?
No. Coinbase states that its customer service agents will not ask for your password or two-factor authentication code.
What should I do if someone calls claiming to be Coinbase?
End the call. Do not provide information or authentication codes. Access Coinbase independently through the official app or website and verify your account there.
Can Coinbase reverse cryptocurrency stolen in a scam?
Cryptocurrency transactions can be difficult or impossible to reverse once confirmed on a blockchain. Contact Coinbase immediately if you believe your account has been compromised, but do not assume that a completed crypto transfer can be reversed.
Does UK bank fraud reimbursement cover crypto scams?
It depends on the payment route and circumstances. UK APP reimbursement rules cover eligible payment fraud within their scope, but they should not be assumed to provide automatic reimbursement for every cryptocurrency loss. The PSR reported high reimbursement rates for eligible APP scam claims under the current framework.
Should I click the link in a Coinbase security SMS?
No. If a message is unexpected, avoid clicking its links. Open Coinbase independently instead. Coinbase advises users to access the genuine website directly rather than relying on links supplied by suspected phishing messages.
What if I already gave a scammer my withdrawal code?
Treat the account as potentially compromised. Immediately access Coinbase through an independent route, secure the account, change compromised credentials and contact Coinbase through its official support/security channels. If money has already moved, preserve all evidence and contact the relevant financial provider immediately.
Can a scammer use a real Coinbase SMS to make a scam look legitimate?
Yes. The important point is that the authenticity of an SMS does not prove the identity of the person who is contacting you. A genuine security event can be exploited as part of a social-engineering attack.
What is the biggest warning sign?
Urgency combined with a request for a security code or transfer.
If someone says you must provide a code immediately or move your cryptocurrency to “protect” it, stop. Coinbase states that it will not instruct customers to transfer funds to a new address or ask for security credentials.
Conclusion:
The biggest lesson from the Coinbase text scam is that a scam does not have to look fake to be fake.
A genuine-looking Coinbase message can still be used by a criminal who has already gained access to part of an account. A real withdrawal code can therefore become part of a convincing social-engineering attack rather than proof that the caller is legitimate.
The reported $57,000 case is a warning about how quickly trust can become expensive.
For UK crypto users, the financial consequences can be particularly complicated because the reimbursement protections that apply to eligible bank-payment scams do not automatically translate into protection for completed cryptocurrency transfers.
The safest strategy is therefore simple: never give a security code to an incoming caller, never move cryptocurrency because someone tells you to, and always verify a security warning through an independent official channel.
In crypto security, taking an extra five minutes to verify a message can be worth far more than the assets sitting in the account.
Meta Description:
Coinbase text scam explained: learn how a $57K withdrawal code trap works, what UK users should watch for and how to protect their crypto.
