Consumer complaint received 2023-01-19
Product: Money transfer, virtual currency, or money service — Virtual currency
Issue: Fraud or scam — 
Company: Coinbase, Inc. (CA)

I'm a victim of online fraud. In XX/XX/2022, my Coinbase account was hacked and all my stock sold off because the company did not have necessary security measures in place. I've contacted Coinbase dozens of times since then, but they refuse to take responsibility for their involvement in this theft. 

The original fraudulent email came from XXXX. The recipient was XXXX, and my email address was BCCd. This email came in at Mon, XX/XX/XXXX at XXXX XXXX  The subject was " [ Coinbase Receipt ] - {$300.00} USD Withdrawal Succeed- Please review your account [ This is will be process ''. There was nothing in the body of the email, but a pdf was attached. The attachment was titled XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXX XXXXXXXX XXXX {$300.00} XXXX XXXX XXXX XXXX  It provided convincing looking details, and there was a big clickable button that said, " Cancel Withdrawal. '' I can provide this document to you. I clicked the link and proceeded to enter my password, thinking the email was actually from Coinbase and that I had already been hacked. 

Eventually, I went to the real Coinbase website to try to sign in to my account. It insisted on my verifying my identity, so I had to take a selfie and upload my ID. It then had to review my account for 24 hours, during which time I had no idea what was happening with my account. I then tried to call Coinbase, but the official customer service number wouldn't let me talk to a customer service representative. I then XXXX  the number and found this number : ( XXXX ) XXXX, which came up on the right side of the search page and said the headquarters was in XXXX XXXX, CA. I called this number and talked to a man with a foreign accent. I now believe that this man was a different hacker than the person who emailed me. He convinced me that my computer had been hacked and that my Coinbase as well as bank account had been compromised. Thinking he was helping me, I gave him my back account information. Once I realized what happened, I was able to contact my bank and eventually retrieve the funds that hacker took from my account in XXXX transfers. 

I thought everything was under control, but the next day, when my Coinbase account was back up and running, I was able to sign in. I saw that my balance was {$0.00}. When I looked at my statement, I saw that {$7700.00}, everything I had in my account, was sold the day before at XXXX XXXX Pacific Time. I changed my password on XX/XX/XXXX, but it was too late. I then searched in the spam box at my email account, and I found a read email from Coinbase, the real thing, asking me to verify a new device in XXXX, XXXX, XXXX address XXXX. I have never even been to XXXX. This email came in at XXXX XXXX, less than an hour before the funds were sold. I never saw this email. The hacker must have gained access to my email account and clicked the link to confirm the account himself before putting the email in Spam, so I wouldn't see it. As a precaution, I had changed my email password the day before as soon as I realized I was dealing with a hacker. When doing this, I saw that there had been a sign-in from a device in XXXX. That confirms that the Coinbase hacker had access to my email account. Now I'm out XXXX shares of link. Why did Coinbase not send me another email or a text message before allowing such a large transaction? I trusted Coinbase with my savings, and now I feel betrayed. While I was locked out of my own account, a hacker was able to run wild and steal all my money.