Your phone buzzes with a text that looks like it's from Coinbase, warning that your account will be locked unless you act now. Before you tap the link, pause. A wave of SMS phishing scams impersonating Coinbase is sweeping crypto users, and the messages are getting harder to tell apart from the real thing.

What Is the Coinbase Text Scam?

The Coinbase text scam is a type of smishing attack (SMS phishing) where criminals send fake text messages pretending to be from Coinbase support or security. The goal is simple: trick you into clicking a malicious link, handing over your login credentials, or handing over your two-factor authentication code.

These messages often arrive with alarming language like "unusual login detected," "withdrawal pending," or "your account will be suspended." The urgency is the point. Scammers want you to react before you think. Because Coinbase is one of the largest crypto exchanges in the world, its name carries weight, and a text appearing to come from the platform feels credible at a glance.

Unlike a generic spam email, SMS scams feel personal. They land on the same device you use for banking, work, and family chats, which makes them feel trusted. That psychological edge is exactly why these attacks are spreading fast.

How the Coinbase SMS Scam Typically Works

Most Coinbase SMS phishing campaigns follow a similar playbook. Understanding the steps makes it much easier to break out of the spell when a message arrives.

  • The bait: You receive a text claiming there's a security issue, a verification needed, or a withdrawal waiting for approval. Many include a short link that looks official.
  • The fake site: Tapping the link takes you to a lookalike website designed to mirror Coinbase's login page. The URL is usually slightly off, but on a small screen it's easy to miss.
  • The credential grab: You enter your email, password, and any two-factor authentication code. The site may even show a fake "verification pending" screen while the attacker uses your code in real time.
  • The drain: Once inside, the scammer triggers withdrawals, swaps your assets, or sets up new API keys to siphon funds to wallets they control.

Some scammers skip the fake website entirely and just text you directly, pretending to be a Coinbase agent. They may ask you to "confirm" a code that Coinbase legitimately just sent you. In reality, that code is the second factor on your account, and once you share it, they own your login session.

Red Flags That Give the Scam Away

Even polished phishing texts leave clues. Train yourself to scan for these warning signs before you ever tap, reply, or type a single character.

  • Strange sender IDs: Legitimate Coinbase alerts come from a short code or a verified business sender, not a random ten-digit phone number.
  • URLs that don't quite match: Look for subtle misspellings, extra words, or unusual domain endings like .cf, .tk, or odd subdomains.
  • Pressure and threats: Phrases like "act within 24 hours" or "your funds will be lost" are classic manipulation tactics.
  • Requests for codes or seed phrases: Coinbase will never text, email, or call to ask for your password, 2FA code, or recovery phrase. Ever.
  • Grammar and tone: Generic greetings, odd phrasing, or robotic language often hint at a mass-sent scam rather than a real support message.

Coinbase has repeatedly confirmed that it does not initiate support contact through SMS links. If a text claims to be from Coinbase support and asks you to click something, that alone is a major red flag.

What to Do If You Clicked or Replied

Mistakes happen, and fast action can limit the damage. If you suspect you've interacted with a Coinbase phishing text, move through these steps right away.

  1. Lock down your Coinbase account. Change your password immediately and revoke any active sessions from the security settings panel.
  2. Disable or rotate your 2FA. If you entered a code, switch your two-factor method and remove any unfamiliar authenticator entries or hardware key pairings.
  3. Contact Coinbase support directly. Use the official app or help center link, never a link from the suspicious message. Report the incident so the platform can flag related attacks.
  4. Check your linked bank or card. If you have fiat balances or linked payment methods, monitor them for unauthorized activity and consider removing compromised payment options.
  5. Report the scam. Forward the suspicious text to 7726 (SPAM) in the US, or your local equivalent, and file a report with the FTC or your country's consumer protection agency.

If funds were already taken, time matters. Coinbase's support and security teams can sometimes freeze withdrawals if notified quickly, especially when the destination wallet is on their monitored network.

How to Stay Ahead of Crypto SMS Fraud

Defense is mostly about habits. Treat every unexpected crypto-related text as guilty until proven innocent, and you'll shut down most scams before they start.

Enable the strongest form of two-factor authentication Coinbase offers, ideally a hardware security key or an authenticator app rather than SMS-based codes. Turn on withdrawal allowlists so funds can only leave your account to addresses you've pre-approved. Bookmark the official Coinbase site and only log in through that bookmark or the app.

Finally, slow down. The single biggest advantage scammers have is speed. A two-second pause to read a message carefully is often enough to catch a fake. Share scam awareness with friends and family in crypto; many victims are newer users who simply didn't know these attacks existed.

Key Takeaways

  • The Coinbase text scam is a smishing attack that uses fake SMS alerts to steal login credentials and 2FA codes.
  • Legitimate Coinbase messages never include login links or ask you to share verification codes.
  • Always verify suspicious texts by opening the Coinbase app directly rather than tapping embedded links.
  • If you've interacted with a scam, change your password, rotate your 2FA, and contact Coinbase support immediately.
  • Hardware keys, withdrawal allowlists, and a habit of pausing before clicking are your strongest long-term defenses.