Consumer complaint received 2020-11-13
Product: Money transfer, virtual currency, or money service — Virtual currency
Issue: Fraud or scam — 
Company: Coinbase, Inc. (NC)

On XXXX XXXX, 2020, at XXXX, I received an email notification that someone had initiated an unauthorized transfer of bitcoin from my Coinbase account in the amount of {$9.00} ( a trial transfer before more significant transactions ). I tried to login to my account only to discover that someone had changed the password, and I had no way of logging in to access it. I immediately attempted to call Coinbase to notify them of unauthorized access/transactions on my account and to have my account immediately frozen. Apparently, Coinbase does not answer calls. The only option available is to report suspicion of a compromised account to an automated system, but, in order to do so, you are required to enter a temporary code that they text to your phone. My phone was not in working condition, so I had no way of receiving the text. Frantically, I went on the Coinbase website to see how I could freeze the account and notify the company. To my dismay, there is nothing anywhere on the website that makes it clear how to take such action. I wasted much time trying to figure out how to contact Coinbase about the matter. Finally, I found a support submission page and proceeded to submit my complaint. I explained that my account had been hacked, I couldn't login, and someone was conducting unauthorized transactions, and I needed the account frozen immediately to prevent any more fraudulent activity. Upon submission, a message popped up that said Coinbase would look into it and I should get a response in 3 days. Feeling utterly helpless, I submitted 2 more support tickets reiterating the matter, desperately begging and then demanding that my account to be immediately locked down. Here are some facts of the matter : 1 ) Coinbase failed to protect my account with the 2-step verification required to login from my phone which was in my possession. 

2 ) Coinbase failed to protect my account from access from unauthorized devices. Anytime a Coinbase account is accessed from a new device, an identity confirmation process is supposed to be required. Even when I went through the steps to recover my account, I had to verify my identity by providing the front and back of my driver 's license along with a live-captured photo showing it was actually me. I even had to do this a second time in order to change my password. It was this level of protection that made me trust opening an account with Coinbase in the first place. How in the world did someone successfully circumvent this security step?? 

3 ) Coinbase failed to notify me that any account changes had occurred. I received no email that my login credentials had been changed. I only discovered the hijacking of my account after receiving an email showing only one of the unauthorized transactions. 

4 ) Coinbase failed to notify me that new ( unauthorized ) accounts were being linked to my account. And, in my experience, it takes days for such changes to be completed. 

5 ) Coinbase failed to provide any timely actions to freeze activity on my account. As part of the support ticket submissions, I was required to check a box acknowledging that the account would be locked down upon submission ( 3 separate submissions ). Still, Coinbase allowed unauthorized transactions involving thousands of dollars to occur even as recently as XX/XX/XXXX ... XXXX days after I notified Coinbase and requested an account lockdown 3 times. 

6 ) Coinbase allowed the hijacking party to initiate multiple transfers of large sums of money ( {$300.00}, {$10000.00}, {$15000.00} XXXX from our linked personal bank account. Luckily, we were able to intervene in time with our bank before funds could clear. 

7 ) On XX/XX/XXXX, I received an auto-generated email from Coinbase telling me that, due to suspicious activity on my account, they increased the holding time for withdrawing funds by 9 days. So, 3 days after doing everything possible to report to Coinbase of theft in progress, they still didn't pay any notice, provide any assistance, nor take the matter seriously whatsoever. 

8 ) Even after my repeated notifications to Coinbase of fraudulent activity XXXX days prior, on XX/XX/XXXX, at XXXX, they sent me three emails demanding payment and threatening that, on XX/XX/XXXX, they were going to proceed with " recovering funds '' from me for the three unauthorized transfers that failed to go through. So, XXXX days after notifying Coinbase of the breach, they still act as if nothing happened. 

9 ) On XX/XX/XXXX, at XXXX XXXX, I received an auto-generated email from Coinbase telling me that they had ( 6 days later ) received my request to disable sign in to my account and had taken steps to secure it. 

10 ) I pleaded, requested, and then demanded that a Coinbase representative call me immediately to address the fraudulent activity and ensure proper steps were taken to protect my funds. To this day, XX/XX/2020 I have received no such call nor any email that isn't automatically generated. Coinbase has ignored me and this situation completely. Even after using the only means available to communicate fraudulent activity to Coinbase, multiple times, nobody from the company has even tried to communicate with me. 

11 ) Even after my explicit instructions to immediately lock down my account from all further activity ( until I had a chance to speak to a coinbase representative ), the system allowed me to go through the account recovery steps and regain access to my account which should not have been allowed per my demands. 

In total, at the time of the incident, we had over {$10000.00} in our account. {$4500.00} was sitting in the account as US Dollars, not invested in anything. The remaining was in .5 Bitcoin, then valued at over {$6100.00}. All of it, GONE! To make matters worse, I had a preset Sell order in place that would have triggered just days after the account was hijacked which would have sold half of our bitcoin and added significantly to our total holdings. Not only did Coinbase fail to ensure the efficacy of the very security methods clients rely on to protect their holdings, they failed to provide the appropriate notifications of account changes ; they failed to make available any effective and timely means of intervening or notifying/communicating with Coinbase at all regarding suspicious/fraudulent activity ; they allowed unauthorized access from unauthorized devices that should have required both sides of my driver 's license and live-capture photo of me to authenticate ; they ignored my frantic requests and demands to lockdown my account to protect from further unauthorized activity ; they allowed access and unauthorized transfers to occur with our personal bank account ; they allowed large transactions ( as high as {$15000.00} ) to continue even up to seven days after notifying them of the security breach ; they allowed me to regain full access to my account even after my explicit instructions to block all further activity until I speak with a representative ( which they have ignored entirely ) ; they repeatedly demonstrated through auto-generated emails that they had not paid any attention to my urgent situation ; and, they have threatened by email to take action to recover large amounts of money from me, the victim. 

I have never experienced such blatant disregard for fiduciary responsibility. And by the way they have treated the entire situation, I am suspicious that Coinbase could be in on the scam. They effectively allowed unauthorized access to our account, made it impossible for me to intervene in any way, disabled all practical means for contacting them, and ultimately allowed the criminals plenty of time to steal all of our funds. What makes things particularly suspicious is the fact that the only email I ever received regarding the unauthorized activity was ( according to Coinbase ) the last of four transactions that occurred. I received zero email notifications of the three initial ones. According to the Coinbase report, these were the suspicious transactions : XXXX XXXX XXXX : XXXX XXXX  XXXX XXXX XXXX : XXXX XXXX  XXXX XXXX XXXX : XXXX XXXX  XXXX XXXX XXXX : XXXX XXXX  This has financially devastated us and has put us through tremendous XXXX  and emotional distress. We are deeply disturbed by how Coinbase facilitated this crime and how little they show any concern or offer any assistance whatsoever. And we are willing to take any and all action necessary to hold them accountable.