Consumer complaint received 2021-02-22
Product: Money transfer, virtual currency, or money service — Domestic (US) money transfer
Issue: Other transaction problem — 
Company: Coinbase, Inc. (WI)

Dear CFPB, The following correspondence is an email from me to Coinbase regarding CFPB complaints # XXXX and XXXX which were unsatisfactorily resolved. The emails I received from Coinbase, and to which I responded to, today are included below. I believe the response you received from Coinbase was incomplete and untruthful. Please be patient when reading the text as it my verbatim response to Coinbase 's earlier email to me today, and ends with my response. So, it may appear to be in reverse order. I copied and pasted the emails in the order they were sent and received.

The bank reversed the transaction because you or someone else unknown to me attempted to transfer money to Coinbase using my account, and I noticed an unauthorized transfer request from my account ( and other accounts we hold at other institutions ) before it could be completed, and cancelled it. The other institutions, as well as you, have always in the past, reviewed these requested transactions, pended them for review, and notified me that a request for transfer was made. And, requested authorization before removing funds from my account. You neither notified me of this unauthorized transaction or sent me an email to verify. Instead, against your own established procedure for my account, you bought bitcoin on your own, without following the usual and sensible step of even seeing if there was money in my account. This error is on you. The other institutions were responsible and followed procedure. 

In addition to the above, immediately before I instructed you to lock my account and correct this error, see your email from you on XXXX ( Hi XXXX XXXX, We received your request to disable sign in to your Coinbase account. At this time, we have signed out all sessions for your account, disabled any new sign-ins, revoked API access, and cancelled any recurring payments that were configured. This is a security precaution for when you believe unauthorized access or activity has occurred. ). You then instructed me to take a number of steps to create new account with different passwords, etc. and inferred in the previous email that fraudulent activity or any activity on this account was canceled and would be prevented. See your email from XXXX ( Hello XXXX, Thank you for contacting Coinbase and providing us with information regarding your issue. We appreciate your patience while we work through a high volume of support tickets. 
Before we can restore access to your account, we need you to confirm that you have taken the following security precautions : 1 ) Scan your devices with anti-virus software and ensure that your devices operating systems are up to date. 
2 ) Reset your emails password to something that is long, random, and unique to your email account. You should also enable 2-step verification if you have not already done so. Additionally, please check for any unfamiliar rules, filters, forwarding addresses, or recovery emails.

3 ) Reset the password to your Coinbase account here : XXXX XXXX Please be sure to create a password that is long, random, and unique to your Coinbase account. Do not reuse the same password across multiple online accounts. ( Please note : password resets can be completed regardless of the account being disabled. This step does not unlock the account automatically. ) 4 ) Contact your mobile service provider to inquire about security measures you can enable on your mobile account to prevent unauthorized changes such as a SIM swap or phone port. 

For additional guidance on securing your online accounts, please reference this help center article : XXXX XXXX XXXX We will keep your account disabled until you are certain your mobile number, devices, and online accounts are secure. Please reply back to this email when you are ready to restore access to your account. If you no longer have access to your mobile device or original phone number, please let us know so that we can assist you with additional steps for account recovery. Please note that all digital currency transactions are irreversible. Coinbase has no way of reversing transactions confirmed on the blockchain network from your Coinbase account. 

If you have any additional questions, please include them in your reply. Thank you for your cooperation and understanding. 

Kind regards, Coinbase Support After I took all of the steps you required and asked that my account be restored a new account with new passwords and different two-factor authorization it appears that you transferred all of the fraudulent activity to my new, secure, account! You sent me this email on XXXX ( Hi XXXX XXXX, You've initiated account recovery on Coinbaseno further action is needed. This process generally takes 72 hours, and we'll notify you when account recovery is complete. Please note, the account recovery process will also reset your two-step verification. Important : If you believe your account activity is unauthorized, you can disable sign-in for your account ) Then you sent me this on XXXX, after you told me that the fraudulent activity on my account would be prevented ( The {$5000.00} buy you made on XX/XX/XXXX is now available to withdraw or send. Please login to view your total available balance. 
View Accounts Dont recognize this buy? Contact customer support. Please include your buy reference number, XXXX. Read more about available balances in our support center. ). Then, on XXXX you sent me this ( Suspicious activity detected on your Coinbase account Hi XXXX XXXX, Due to suspicious activity on your account, we have increased the holding time before you can withdraw your funds by 9 business days. This is meant to protect you against fraud by ensuring that you authorized this purchase. No action is required on your part. If you believe this is in error, please contact us by visiting https : //support.coinbase.com ). I immediately responded with the following email on XXXX XXXX Good Afternoon. 
On XX/XX/XXXX through the XXXX my bank account and coinbase account were hacked and resulted in numerous fraudulent transactions in both accounts. You will be hearing from my bank to resolve this. 

XXXX XXXX, XXXX XXXX XXXX XXXX XXXX XXXX XXXX, WI XXXX XXXX CONFIDENTIALITY NOTICE : This transmission and the materials enclosed/attached are private and confidential and are the property of the sender. The information contained is priviledged and confidential. You are advised that any unauthorized disclosure, copying, distribution, or taking any action in reliance on the contents of this information, without additional, express written permission of the sender, is strictly prohibited. ) Despite your assurances that everything was locked and no transactions could go through my account, and my following all of your instructions to secure and create a new account, you then began sending me emails saying I bought {$9000.00} Bitcoin. I logged into my account and noticed it on XXXX and instructed you to immediately lock my account, which you said you did, but I then logged in to my account and noticed that you transferred etherium to my bitcoin account and began frantically sending out to numerous places. And after going through going through all of this for weeks, and receiving erroneous emails from you saying things like the funds from your {$5000.00} buy are now available to you, and my efforts to notify you of all of the unauthorized activity and YOUR mistakes, now you have liquidated my account and are now demanding more money? Considering all of my efforts and the facts I presented, this whole episode should fall under the insurance policy on my account as none of the harm done was due to any action on my part, and was due to negligence on your part in handling the fraudulent transactions that occurred. I ask that you and your insurance make me whole. This may not be a lot of money to you, but was nearly all of the money I had to pay for the rest of my school program. 

Also, I am again requesting that you send me a printout of ALL transactions and ALL activity which occurred between XX/XX/XXXX and XX/XX/XXXX ( or later if there was any activity in my account after XXXX ) for my review, as I can not access my account records, and printouts showing what I described above and that were sent to the CFPB. Please let me know when you will comply with my request. 

Sincerely, XXXX XXXX, XXXX XXXX XXXX XXXX XXXX XXXX XXXX, WI XXXX XXXX CONFIDENTIALITY NOTICE : This transmission and the materials enclosed/attached are private and confidential and are the property of the sender. The information contained is priviledged and confidential. You are advised that any unauthorized disclosure, copying, distribution, or taking any action in reliance on the contents of this information, without additional, express written permission of the sender, is strictly prohibited. 



From : Coinbase Support XXXX Sent : Monday, XX/XX/XXXX XXXXXXXX XXXX  To : XXXX Subject : [ Reply ] Case # XXXX - Fraudulent charge Hello XXXX, Thank you for your patience. 

Reversed transactions from your bank lead to a balance owed because we've credited your Coinbase Digital Wallet and have not received successful payment. When your bank reverses a transaction, we're required to recover funds from your account. 

Consequently, Coinbase can not provide a credit or refund of fiat or crypto for steps necessary to resolve the negative balance on your Coinbase account. Customers are responsible for ensuring that the details of the transaction are correct, and that their payment methods have funds available prior to confirming a purchase. 

As previously mentioned, you currently have an owed balance of {$2500.00} which you will need to pay before you are able to use your Coinbase account. Per our user agreement, you are fully responsible for any transfer you initiate on your Coinbase account.

Please select your desired external payment method or use the digital/fiat currency that was credited to your Coinbase wallet. You can select a payment method using this link : XXXX XXXX XXXX After you deposit funds into your Coinbase account, our system will automatically reclaim the owed amount. If you would like to deposit digital currency, you can find your crypto addresses here XXXX XXXX XXXX We hope this clears up any confusion. If you are unsure about the reason your bank reversed the charge, please contact them for further explanation and to find out what is needed to avoid this situation in the future. 

Kind Regards, Coinbase Support -- -- -- -- -- -- -- - Original Message -- -- -- -- -- -- -- - From : [ XXXX XXXX Sent : XX/XX/XXXX XXXXXXXX XXXX  To : XXXX Cc : XXXX Subject : RE : [ Reply ] Case # XXXX - Fraudulent charge See my response from earlier today. BTW, I do not have a Coinbase app on any other device, so what are you talking about. 

XXXX XXXX, XXXX XXXX XXXX XXXX XXXX XXXX XXXX, WI XXXX XXXX CONFIDENTIALITY NOTICE : This transmission and the materials enclosed/attached are private and confidential and are the property of the sender. The information contained is priviledged and confidential. You are advised that any unauthorized disclosure, copying, distribution, or taking any action in reliance on the contents of this information, without additional, express written permission of the sender, is strictly prohibited. 



From : Coinbase Support XXXX Sent : Wednesday, XX/XX/XXXX XXXXXXXX XXXX To : XXXX Subject : [ Reply ] Case # XXXX - Fraudulent charge Hi XXXX, Thanks for your follow up. 

The first correspondence Coinbase received was case XXXX on XX/XX/XXXX. You disabled your account automatically on XX/XX/XXXX however the reported fraudulent transactions occurred on XX/XX/XXXX, which is 2 days before your account was disabled. 

As advised in our previous correspondence, the activity on XXXX was from an established XXXX XXXX  device that has been on the account since XXXX, using the XXXX address XXXX, XXXX, IL. This XXXX address has been used on your account from XXXX up until XXXX. 

This XXXX address, as well as several others showing the geolocation as XXXX, IL, is consistent with your account history. As a result, we have no reason to distrust this activity. 

Coinbase users may have multiple sessions signed in on different devices if they choose to be kept signed in during log in. This will put their account at risk if a person with malicious intentions gets a hold of the users device, or sign in with the users credentials confirming a new device. As part of our investigation process, Coinbase signs out of all sessions and revokes devices which is why you are asked to reauthorize a device or new location. 

Sometimes you may also be asked to reauthorize a device that you have previously authorized, which usually happens when you clear your internet cache/cookies, your IP address changes or you are using a different web browser. If this happens, you will need to reauthorize the device by clicking a device verification link in an email that was sent to you. 

To fix that, try the following : 1. Sign into your Coinbase account, visit your " Activity '' page and log out of all web sessions by clicking Sign out all other sessions - on the same page, visit the " Mobile Applications '' section and revoke access to all instances of your phone or mobile device XXXX XXXX XXXX XXXX 2. Sign out of your Coinbase account, and clear your browser 's cookies and cache.

3. Remove/Reinstall the Coinbase app from your phone, and try signing in again. You should be prompted to verify your phone from within the app. Once you've done this, you will not be prompted to complete this step again. 

We've transferred your case to a specialist who will be able to further help with regards to the clawback issue. 

We currently have a high number of requests, but our team is working hard to quickly get to yours. We will contact you as soon as your case is reviewed. 

In the meantime, if you have any other questions, replying back to this email is the best way to get an update submitting another inquiry for this issue will cause further delays. 

Thanks in advance for your patience. 

Thanks, Coinbase Support -- -- -- -- -- -- -- - Original Message -- -- -- -- -- -- -- - From : [ XXXX XXXX Sent : XX/XX/XXXX XXXX XXXX To : XXXX Cc : XXXX Subject : RE : [ Reply ] Case # XXXX - Fraudulent charge response XXXX Please refer to my previous correspondence with you and respond to the CFPB. The unauthorized activity was as I described. Keep my account blocked as I requested ( and you did not do until much later ) when I noticed the fraudulent and suspicious activity in my account. Why did you allow this to occur even after I notified you of this activity? 

I tried to go you the link you sent to look at the activity you in my account, and I tried to do so twice but each time I received an email saying you dont even recognize the IP address and that I needed to authorize this computer. Are you crazy? You tell me that the IP address associated with my account is the one from which transactions during XXXX, XXXX and XX/XX/XXXX originated, and you dont even recognize it? See below. 






New device access You recently attempted to sign into your Coinbase account from a new device or in a new location. As a security measure, we require additional confirmation before allowing access to your Coinbase account. 

1. Location : United States 2. IP Address : XXXX XXXX. Browser : XXXX XXXX XXXX XXXX If this was legitimate activity, you can authorize your new device below. 
Note that you need to access this email with the same device that you are confirming. 
I Authorize This Computer XXXX XXXX XXXXXXXX XXXX Or copy and paste the link above into your browser. 






Terms of Service Coinbase XXXX Coinbase , Inc . 
XXXX XXXX XXXX, XXXX  XXXX XXXX XXXX XXXX, CA XXXX XXXX United States XXXX Also, why did you put {$9000.00} of Bitcoin into my account after you were notified of suspicious/fraudulent activity, when I didnt even have that much money in the account you withdraw money from when I would buy Bitcoin? You always imposed a waiting period to verify that I had the money to buy bitcoin, and you always made me wait days before the bitcoin was available in my account? Why did you instantaneously put this in my account on XX/XX/XXXX, and then transfer it right out to numerous entities as your system showed after I notified you. 

Please send me records of all of the transactions you were party to involving my account beginning on XX/XX/XXXX, and to date. I am beginning to believe that you were either directly involved in this activity or were just plain harmfully negligent. 

XXXX XXXX, XXXX XXXX XXXX XXXX XXXX XXXX XXXX, WI XXXX XXXX CONFIDENTIALITY NOTICE : This transmission and the materials enclosed/attached are private and confidential and are the property of the sender. The information contained is priviledged and confidential. You are advised that any unauthorized disclosure, copying, distribution, or taking any action in reliance on the contents of this information, without additional, express written permission of the sender, is strictly prohibited. 





From : Coinbase Support XXXX Sent : Monday, XX/XX/XXXX XXXX XXXX To : XXXX Subject : [ Reply ] Case # XXXX - Fraudulent charge Hi XXXX, Thank you for your follow up. 

As advised in our previous correspondence, the activity on XXXX was from an established XXXX XXXX device that has been on the account since XXXX, using the IP address XXXX, XXXX, IL. This IP address has been used on your account from XXXX up until XXXX. 

This IP address as well as several others showing the geolocation as XXXX, IL, is consistent with your account history. As a result, we have no reason to distrust this activity. 

You can view this activity in the Account Activity section of your account : XXXX  : XXXX XXXX sends are not reversible due to the inherent protocols of digital currencies. Please remember that you are solely responsible for the security of your devices, passwords, email, and second factor codes. 

Kind regards, Coinbase Support -- -- -- -- -- -- -- - Original Message -- -- -- -- -- -- -- - From : Coinbase Support [ XXXX XXXX Sent : XX/XX/XXXX XXXX XXXX To : XXXX Subject : [ Reply ] Case # XXXX - Fraudulent charge Hello XXXX, We received your inquiry, and because you've previously written in about this same issue, we're consolidating your cases into this email thread. We've passed all new information on to an account specialist who is reviewing your case they'll reach out to you here ( review generally takes 4-5 business days ).

All future questions about this issue should be directed to this email thread so that our account specialist can better support you. 

Thanks, Coinbase Support