Consumer complaint received 2023-11-13
Company: Coinbase, Inc.
State: PA
Product: Money transfer, virtual currency, or money service
Sub-product: Virtual currency
Issue: Fraud or scam

Complaint:
On XX/XX/2023 I was the victim of a sophisticated phishing attack that led to the loss of XXXX XXXX  from my Coinbase account. The attacker leveraged an exploit on Coinbase 's website. This exploit allowed the attacker as a third party to create a legitimate support ticket on my Coinbase account, this support ticket was verified as legitimate through their mobile app and had vague information associated with it with no warnings that it did not originate from Coinbase or that they would not contact me for that request. This support ticket gave me a false sense of security that the representative I was speaking to was in fact a Coinbase support employee. After they verified themselves they sent a " secure portal link '' to verify my credentials and restore my account back to normal. They were able to use those credentials instead to transfer my funds out of my account. I was able to identify this as a scam immediately after the transfer was initiated and I immediately hung up the phone, called back a real Coinbase support phone number, and changed all of my credentials as soon as possible. I used Coinbase 's automated system to lock my account, at the automated systems direction since my account was compromised, however, that meant that I could not do anything more on my account for a XXXX period. I then pleaded with the customer support agent I was able to contact within XXXX minutes of the transfer to cancel the pending withdrawal as they confirmed it was still in a pending status and I could not actually do anything on my locked account. The customer support agent put me on hold and said they were going to escalate it to the relevant party that could help and a couple of minutes later came back on the phone assuring me that the pending transfer would be canceled as they had between XXXX - XXXX minutes to cancel that transaction before it because irreversible. After my XXXX lockout period was up and I was able to regain access to my account I saw that the transaction was not reversed and then had to file a local police report and an XXXX with the FBI for the fraud that I was subjected to. 

What do you think would be a fair resolution to your complaint? 

I followed up with Coinbase support a few times the week following the event as well to help identify how this person was able to create a support ticket on my account and eventually I discovered the steps necessary to replicate the issue. For all but one of Coinbase 's support tickets, over XXXX in total, it made you as the account owner verify your identity by sending you a six-digit code to your email before the ticket is created on your profile. However, Coinbase had one option anyone could create a generic ticket on an account without verifying the identity of the account holder by simply having their email address. I took this information and submitted a XXXX  XXXX for the issue as it seemed like an error on Coinbase to have that as an option. I used the XXXX website, information for that service was provided by Coinbase, and I submitted how to replicate the XXXX, which I was able to replicate until the XXXX of XXXX. Coinbase had approved my XXXX  XXXX request paying me a fee of {$50.00} with the attached response " Hello and thank you for your report. We have done some internal research and this particular issue has been previously triaged by our engineering teams and there is a slated fix which should be XXXX within our next code commit. For your efforts we will award a XXXX time bonus of {$50.00} for reporting this to us. We look forward to seeing future submissions from you. '' This tells me that Coinbase identified this as an issue, most likely due to me hounding them about it after my incident, and that they are at fault. They have also since completely overhauled their support options and they no longer create tickets on accounts that do not verify their identity on the website. They still have this support request as an option but the account holder gets an email and that email has very strong verbiage around the support ticket received and states " If you DID NOT authorize a sign-in attempt Immediately take these security steps to secure access to your Coinbase account : 1. Remove email forwarding in your email settingsoften these third parties use email forwarding to intercept future emails 2. Create a new unique and complex email password 3. Add 2-step verification to your email ( highly recommended ) 4. Reset your Coinbase password at www.coinbase.com/password_resets/new after your email is secure 5. Respond directly to this email for account recovery instructions once these steps are complete " I attempted to go through Coinbases complain program, filing my first complaint on XX/XX/XXXX and it took until XX/XX/XXXX to get a response, in which they stated " After an extensive review, weve determined that your sign-in credentials were used to access your account and transfer the funds in question on XXXX XX/XX/2023, as explained in case XXXX. 

The Coinbase User Agreement states that users are responsible for maintaining adequate security and control of any and all access methods and codes used to access Coinbase. Here, you allege that a third-party gained access to your account and sent the funds in question to an external blockchain address. The same User Agreement provides that Coinbase is not responsible for any loss suffered due to compromise of account login credentials due to no fault of Coinbase. 

As a result, Coinbase is unable to reimburse you for your loss. Additionally, due to blockchain protocol, Coinbase is not able to reverse this transaction. 

If you have not already done so, it is imperative that you report this incident to law enforcement agencies in your jurisdiction immediately through this link : XXXX XXXX XXXX. Be sure to include as much detail as possible in your report. Coinbase fully cooperates with law enforcement investigations. 

We hope this information is helpful to you in showing why Coinbase came to this decision. 

As a result, Coinbase considers your complaint closed. 

Thank you for your time and attention in pursuing this issue with Coinbase. '' I then immediately filed a follow-up complaint to provide additional context and waited to get back this response from their complaint team on XX/XX/XXXX " Thank you for submitting a Formal Complaint through Coinbase. We noticed that you previously submitted a Formal Complaint regarding this issue and we answered as such with a XXXX Notice. Please refer to that information as was provided previously and feel free to contact our Coinbase Support Team if you have a new issue that needs our attention. '' I have since filed a complaint with the XXXX  and they have directed me to the CFPB.

Company response to consumer: Closed with explanation