Consumer complaint received 2022-05-05
Company: Coinbase, Inc.
State: NY
Product: Money transfer, virtual currency, or money service
Sub-product: Virtual currency
Issue: Fraud or scam

Complaint:
How Coinbase Global , Inc. XXXX XXXX XXXX Allowed Someone to Steal XXXX XXXX Worth of Investments from my XXXX XXXX On XXXX XXXXXX/XX/2022, my cell phone, email & Coinbase wallet were all hacked. 

At around XXXX PM I turned on my cell phone and realized it wasnt working- I couldnt make any calls and wasnt receiving any messages. When I got in contact with XXXX XXXX ( using my XXXX phone ), they had advised someone earlier in the day asked to switch the XXXX from my XXXX XXXX XXXX to their XXXX XXXX. I asked the representative who had called in to do so- they wouldnt provide any details, besides for admitting that the call came from a number that was not affiliated with our plan. 

I was shocked to hear how XXXX XXXX allowed someone to hijack my XXXX & take control of my cell phone number, without having my physical phone, which was in my possession. 

I had advised theres no way for the individual to know my PIN # ( which they make ME confirm every time I call ), so how was this person able to do so? The representative said they dont necessarily need the pin ; they can provide an email as well. 

What kind of security measures do they have in place for these kinds of things? We see the # is coming from a strange location, maybe its a fraud. The person is calling from an unknown number, thats not associated with the plan, maybe its a fraud. The person is asking to switch to an XXXX XXXX, but we see theres many other devices XXXX had bought and would have asked to use instead and being that we dont see he had ever used or bought this model phone before. They didnt send a single notification, email, text, etc. to anyone else on the plan, alerting of this change. 

Below is part of an article I found that explains how the fraud was conducted : Scammers abuse the support services of mobile network operator call centers by calling them and posing as customers to get a new XXXX card. The victim doesn't know a new XXXX card is connected to their phone number, which gives attackers the access they need. 

" Once the XXXX is swapped, the victim 's calls, texts, and other data are diverted to the criminal 's device. This access allows criminals to send 'Forgot Password ' or XXXX XXXX ' requests to the victim 's email and other online accounts associated with the victim 's mobile telephone number, '' the XXXX XXXX XXXX warns. 

" Using SMS-based two-factor authentication, mobile application providers send a link or one-time passcode via text to the victim 's number, now owned by the criminal, to access accounts. The criminal uses the codes to login and reset passwords, gaining control of online accounts associated with the victim 's phone profile. '' I finally regained access to my email and didnt see anything strange, until I looked in my trash folder. There I found XXXX emails, within a few minutes of each other, of all the transactions this person had done on my Coinbase account. 

While on the phone with XXXX XXXX, I had also called Coinbase to lock my account. However, the damage was already done. A day later, when I regained access to my Coinbase account, I was able to see all the trades this scammer had done. Through Coinbase, the scammer had transferred all my crypto investment to XXXX ( I never owned any XXXX mostly others & ETH ). The hacker then transferred the new XXXX holdings into my Coinbase Pro account ( which is supposed to be even more secure than Coinbase ). From there he had sent fractions of the total XXXX holdings & in XXXX ( clear fraud & suspicious ) transactions sent it all to unknown addresses/ wallets. 

Coinbase is considered ( which I now know is far from the truth ) the safest & most secure crypto currency exchange for protection. Its a public company & is XXXX insured. I had put most security measures in place- the only way to access my Coinbase was through XXXX factor authentication- every time I access the app, it sends me a single use code to my cell phone, and I must enter that code into the app. The hacker had control of my cell phone #, so the message now went to his phone. Ive also added Face ID authentication, and not sure how this person was able to get around this. Theres also a XXXX digit code thats needed to login to my Coinbase XXXX XXXX XXXX XXXX have this code written down anywhere ( only in my head ) and doubt the scammer was able to know this code out. 

Doesnt a company need to have proper security measures in place to become a public company? How are they FDIC insured? Thousands of transactions, within seconds of each other.. Did they not realize this was a computer program doing these transactions and have the account locked? Ive been on Coinbase for several years now & my total trading activity never came close to XXXX transactions, let alone in just a minutes time. 

Around {$70000.00} was stolen. The scammer offloaded all the XXXX in hundreds of transactions, {$15.00} at a time. Isnt it suspicious?? Who would do so many transactions to the same wallet? Isnt it obvious a fraud occurred? 

Below is XXXX of XXXX transactions Coinbase allowed a scammer to withdraw from my Coinbase XXXX XXXX my entire life savings .... 

fee : XXXX XXXX Destination Address : XXXX Transaction Hash : XXXX Coinbase refuses to help and there's no one to call, sorry, we can only interact via email. Ive sent multiple emails and all they say is we are looking into it, theres nothing we can do once the money has left your wallet and to call the authorities. I went to the authorities, and they need me to provide the hashtags/ transactions to where the crypto was sent. I asked Coinbase to investigate this for me, as I tried every way to do it myself on Coinbase Pro, and they responded, thats going to be very hard to do. As to how they let clear fraud and suspicious activity happen is beyond me. But maybe they dont care, as they made a lot of money on these transaction fees. They really need to investigated and held responsible. They do not have proper measures in place and soon enough it's going to happen to many more people.

Company response to consumer: Closed with explanation