Consumer complaint received 2022-09-02
Company: Coinbase, Inc.
State: NY
Product: Money transfer, virtual currency, or money service
Sub-product: Virtual currency
Issue: Fraud or scam

Complaint:
There is a chat for XXXX on XX/XX/22 Case number XXXX- the chat with the coinbase rep telling me to click the email link. Unauthorized started after the chat at XXXX XX/XX/22. 
From coinbase only XXXX XXXX was willing to provide her full name to me, the other individual I spoke with is XXXX, from coinbase one phone team. 
Main case number XXXX Initial case number XXXX Appeal complaint case number XXXX I received a suspicious email from coinbase on XX/XX/22 requesting ID verification that I interacted with on XX/XX/22 after I contacted coinbase support via chat messaging feature, this chat is available in the coinbase archive which I do not have access to, case number XXXX. This chat began at XXXX by relaying my concern for an email I received that is asking me to verify my ID, the coinbase representative instructs me to access the email via web browser and to go ahead and verify my ID that way. As per his instructions I clicked into the link to verify my ID. Then by retroactively checking my email records suspicious activity on my email account starts at XX/XX/22 XXXX from IP address XXXX. However, I did not receive notification of this by my email carrier, outlook. The next morning after interacting with the coinbase support agent on XX/XX/22, I received an email notification at approximately XXXX that my coinbase account has purchased {$25000.00} worth of XXXX XXXX via my personal bank account, an action I did not do ( I contacted my bank to not approve this and now I have a negative balance on my Coinbase account due to this ). I then open my email to which there were several hidden coinbase email notifications ( they had all been re-routed to archive instead of inbox ) stating that I had sold my XXXX holdings to USD and that 3 cash withdrawals were initiated ( 1. {$7800.00} reference code XXXX. 2. {$7800.00} reference code XXXX. 3. {$8300.00} reference code XXXX ) to XXXX XXXX ( XXXX XXXX  XXXX ), XXXX XXXX ( XXXX XXXX  XXXX ), and XXXX XXXX ( XXXX XXXX  XXXX ) which was then put into a XXXX XXXX  account ending in XXXX around XXXX on XX/XX/22, none of which I did ; none of these accounts are my bank accounts either. I called coinbase immediately around XXXX on XX/XX/22 to freeze the account to void the withdrawal attempts. I was assured by the representative that I spoke with on a recorded line that coinbase has ( case number XXXX ), my funds, and they are secured and were successfully voided/cancelled. However, later I coinbase said these withdrawals were not successfully voided/cancelled. Coinbase later said ( XX/XX/22 ) the unauthorized activity from my Coinbase account was done from IP address XXXX. 

All the calls I made were recorded by coinbase. Specifically, XXXX 1XXXX XXXX 17 min call, the coinbase representative confirmed withdrawal on XX/XX/22 were null and voided and will be refunded. And on XX/XX/22 XXXXXXXX XXXX - 38min call. coinbase rep confirmed withdrawals on XX/XX/22 were null and voided. 

The suspicious email that started all of this has been deleted from my email account, I did not delete this. My assumption is the hacker deleted the email after they gained access to the email when I followed the coinbase representative 's instructions. I looked into all possible places for this email including all folders such as recently deleted, and the folder where an email is placed prior to permanent deletion but could not find anything. The only proof I have of all of this the chat which is archived ( Case XXXX ) in coinbase which I do not have access to ( but do have a video recording with the coinbase rep confirming the timing and content of the chat ) and the IP address that did the unauthorized activity in my email and Coinbase account. I rebooted my laptop as a safety measure after the hack but that unintentionally deleted the browser history to where the email link destination could have been.

Company response to consumer: Closed with explanation