Posted inNews

Coinbase domain name reportedly used by scammers in high-profile attacks

July 7, 2023No Comments


Update (July 7 9:33pm UTC): This article has been updated to include Coinbase's response.

Coinbase users have been taking to Twitter to report scams and phishing attacks involving the company's services and apps in recent weeks, including claims that scammers are using the cryptocurrency exchange's domain name.

The most recent case was revealed on July 7 by a Twitter user identified as Daniel Mason, who allegedly received text messages and emails from scammers with links under the Coinbase.com domain.

The scammer contacted Mason using a real phone number, then sent an email from a Coinbase.com domain, followed by a phishing text message directing him to a Coinbase subdomain URL, before verifying the address. , Mason's social security number and driver's license number.

As Mason points out, the scammer was well-spoken and a native English speaker. The scammer reportedly said during a phone call that Mason would receive an email from Coinbase about an alleged breach of his account. Immediately, an email arrived from help@coinbase.com. โ€œHe created a case on my behalf? Or access Coinbase mail servers?" Mason commented on Twitter.

Mason's experience is one of many on the social media platform reporting security incidents involving crypto sharing. A brief look at Coinbase's support page shows users complaining about various types of scams, including Coinbase Wallet phishing and criminals using the company's web address.

Cointelegraph spoke to a victim of a similar approach. The person, who asked to remain anonymous, claims to have called Coinbase's support line to verify the authenticity of an email about the user's account being compromised. The employee later confirmed that it was a real communication, but the email was the work of a hacker.

โ€œA Coinbase employee authenticated a hacker as a Coinbase employee, who then stole my crypto. They then hung up on me before not taking responsibility, even though I had a witness, the time and date of the call, and the employee I spoke to," the individual said. The case is now under litigation. Between the frozen and stolen funds, the victim claims to have lost approximately $50,000 in assets.

The reports follow the same pattern as the stroke on Twitter user Jacob Canfield. Canfield reportedly received a text message and phone calls from a scammer on June 13, citing an alleged change to his two-factor authentication (2FA).

I was then sent to the 'security' team to verify my account to avoid a 48 hour suspension. They had my name, my email and my location and they sent an email with a 'verification code' from help@coinbase.com to my personal email," Canfield explained, adding that the criminal "got angry and hung up the phone " when they told him the code. it would not be sent.

The email help@coinbase.com is list on the exchange support page as a trusted and official address. The company blog also states that its staff will never ask users for passwords or two-step verification codes and will not ask for remote access to devices.

In a statement to Cointelegraph, Coinbase said it has "extensive security resources dedicated to educating customers on preventing phishing attacks and scams." We work with international law enforcement to ensure that anyone who defrauds Coinbase customers is prosecuted to the fullest extent of the law."

Security specialists recommend strong, unique passwords for cryptographic accounts and enabling 2FA in apps.

Magazine: $3.4 Billion Bitcoin in a Popcorn Can: The Silk Road Hacker Story