Consumer complaint received 2022-04-25
Company: Coinbase, Inc.
State: TX
Product: Money transfer, virtual currency, or money service
Sub-product: Virtual currency
Issue: Fraud or scam

Complaint:
XXXX XXXX XXXX XXXX XXXX XXXX XXXX Texas, XXXX Tel - XXXX XXXXXXXX XXXX XXXX  XXXX XXXX XXXX FBI XXXX XXXX XXXX XXXX XXXX To the Attention of Officer ( s ) In charge XXXX XXXX XXXX XXXXXXXX, TX XXXX Subject : Victim report and request for investigation of XXXX XXXX and theft of ~ {$30000.00} from Coinbase and Coinbase Pro on or around XX/XX/XXXX My name is XXXX XXXX XXXX and my address is XXXX XXXX XXXX, XXXX, Texas XXXX. A copy of my identification is attached. 
On or around Saturday XX/XX/XXXX I began to receive text Messages from my mobile phone carrier XXXX XXXXhat changes had been made to my account password if I had not made t I should contact XXXX. I attempted to log onto my T-mobile account and was successful once. Once in I discovered that my main phone number XXXX was no longer there. At the top of the page ( which I mistakenly did not print ) it said that the number had been ported out to XXXX XXXX. I followed up with a call to XXXX XXXX immediate response to me without hearing me out is that the number XXXX did not belong to me. A five hour back and forth of calls between my wife and I to XXXX  would then ensue. The XXXX  staff did not demonstrate the training to deal with this situation. In the end we spoke with someone who said that another department that hands the porting of number had to be contacted but they were closed and would not be opened until the next day ( Sunday ). 
Concurrent with the XXXX  alert texts I received an alert from XXXX stating that changes had been made to my account. I went to log onto my XXXX account and was unable to do so. The main email that I use for XXXX is XXXX and the password had been changed. I called XXXX to report the issue and I was told by the XXXX XXXX that they were unable to assist me because my account was flag and under the supervision of XXXX XXXX XXXX : XXXX - Case Manager, Executive Customer Relations. XXXX did not work on weekends and I would not hear back from XXXX until Monday XX/XX/XXXX to unlock my account. By then the damages had been done. 
I received an email from Coinbase on or around XX/XX/XXXX, indicating that I had transferred XXXX  and XXXX from my Coinbase account. Since I had not made or authorized these transactions I went immediately to log on to Coinbase. I was locked out of my account. I attempted to call Coinbase and was unable to get through to a live person and kept being referred to their website. I submitted a ticket on the website and then attempted a password recovery. The password recovery did not and would not work because Coinbase sends the six digit authentication code to the Mobile phone number on record. At this point I did not have possession of my XXXX phone number. The number had been ported to another carrier by the hacker. In order to regain access to my account I had to update the account with a new phone number. I submitted to Coinbase to replace my phone number. Coinbase demanded that I provide a copy of the front and back of my drivers license and a live photo of myself. I did so and updated the account with my wifes phone number ( XXXX XXXX XXXX ). Coinbase advised that it would take 48 hours to make the change. I regained access to my Coinbase account on or around XX/XX/XXXX,. During this period I had informed and advised Coinbase and Coinbase Pro that my account was compromised. Coinbase and Coinbase Pro took no actions to freeze my accounts. As the records from my accounts show, throughout XX/XX/XXXX Coinbase allowed the hacker to convert my asset to XXXX and to transfer it out of my account. I do not trade XXXX or XXXX and my account records support that. See statements, deposits and withdrawals attached. 
It took a long time to regain access to my Coinbase accounts. Coinbase refused to change my password and kept directing me to log into the account even though I had already told them that : ( a ) I was locked out and ( b ) I did not have possession for the phone number on file. After I submitted a request to Coinbase to add the new phone number to my account, I provided my identification and a live photo of myself ; it would take Coinbase 48 hours to return access to me. When I did receive access to my account on Monday XX/XX/XXXX, I was finally able to log on and I discovered that both my Coinbase and Coinbase XXXX accounts had been depleted. 
Repeated exchanges of email with Coinbase support went nowhere. Coinbase support subsequently sent me an email in which they said that I was not covered and they are not liable to reinstate my stolen funds because the account was accessed using my credentials. 
On or around the XXXX of XX/XX/XXXX, we got a hold of a XXXXXXXX  member of the corporate Solutions team. He was in the XXXX and he gave his name as XXXX employee identification XXXX. We spent on and a half hours on the phone with XXXX  to preempt the finalization of porting of my XXXX number to XXXX That is, to interrupt the porting and to regain the number. XXXX did a thorough investigation and established how long I had owned the number ( since XXXX ), communicated theses facts to XXXX and recovered my telephone number for me. However, having recovered the number, I was still locked out from Coinbase and the hacker had already drained my Coinbase accounts. 
XXXX informed us that the hack took place somewhere on the XXXX XXXX of the XXXX. The hacker gained access to my XXXX account and via my XXXX account was able to hijack my XXXX account and to direcXXXX XXXX from within the account to make changes to my account. This we find strange because we have never been able to make change to the XXXX account without speaking to a live XXXX representative. Everything from activating a sim card, to adding a new number or changing a number. We have five lines with XXXXXXXX  and the XXXX is the main number. 
The other major issue is with XXXX. XXXX, XXXX, Coinbase, etc, all insist that customers use their email addresses as their user names. This policy in itself is a major security breach. Our email addresses and mobile phone numbers are all public information. Once a hacker knows a companys convention for user names ( in these cases email address ) 99 % of their problem to hack an account has been solved. They need only solve the password. In this instant, XXXX has culpability for allowing and giving the hacker access to my XXXX account. In keeping with current Corporate rules and practices, I have over XXXX user names that is based of XXXX. Once anyone gains access to my XXXX account they have access to all of my accounts. 
XXXX  has culpability for giving easy access to and for porting my mobile account number to XXXX  without taking steps to confirm the request was legitimate. This porting and transfer of the number occurred to very easy and it makes me fell vey insecure as a consumer. The porting of the number lead to the unlimited access to my Coinbase accounts. 
My Coinbase accounts have been raided and I am out of approximately {$30000.00} plus opportunity cost and lost opportunities. I hold the Coinbase Inc and its XXXX XXXX XXXX with ultimate culpability for this breach and compromise of my accounts. XXXX invented Coinbase and put the use of the email as the user name as the convention. Additionally this is not the first incident of hacking that Coinbase has faced. Upon regaining access to my Coinbase account I attempted to change my user name and it would not permit me to use an unique user id or to substitute a new email address. 
After regaining access to my Coinbase accounts, changing my password and mobile phone information, or around XX/XX/XXXX I received an email from Coinbase claiming that an attempt was being made to transfer money out of my account ( email attached ) and that I should take actions to change my password and to update my account. This request is stranges since I had already made changes to the account following the hack. 
TO LAW ENFORCEMENT I XXXX XXXX wish to press charges of fraud and theft of identity against XXXX. XXXX XXXX XXXX XXXX indicates that when you commutate with them you XXXX reference = LRC # XXXX XXXX. XXXX XXXX XXXX XXXX number foXXXX XXXXXXXX is XXXX and the account is registered to XXXX XXXX XXXX. Coinbase Inc. in the case of Coinbase Inc I am naming XXXX XXXX as the Primary suspect of the theft. Coinbase is so arrogant that it does not provide an account number. 
Coinbase XXXX, XXXX XXXX XXXX XXXX XXXX, DE XXXX United States CEO XXXX XXXX XXXX. I am requesting a formal investigation into Coinbase and Coinbase XXXX, XXXX and XXXX XXXX XXXX XXXX I have and I am attaching a DVD containing my account records and transactions as well as email communication exchanges with Coinbase as well as audio recordings. Where possible I wish to press charges for theft, breach of trust and common law fraud against all three actors. 
The Coinbase Platform willfully and deliberately prevents the user from printing the entire record of deposit and withdrawals and times and executions of trades. The victim is willing and available o meet with law enforcement to show the exact form of the transactions actions and the timing of the transactions from his account. 
Please advice. 
Sincerely, XXXX XXXX XXXX Coinbase XXXX Fraud Victim Enclosures : DVD containing account records, communications with XXXX XXXX XXXX and Coinbase. Coinbase has set things up such that one can not print a complete statement on paper. The statements are truncated. On the other had Coinbase demanded in its communications that the victim print the statements and encircle the transactions he did not perform.

Company response to consumer: Closed with explanation