Coinbase Withdrawal Code Text: Scam or Real? What to Do Now

If a text gives you a Coinbase withdrawal code you never asked for and tells you to call a number if it wasn't you, treat it as a scam: do not call, do not reply and do not tap any link. The message exists to make you phone a fake support line, where someone posing as Coinbase talks you into moving your crypto to a wallet they control. Open the Coinbase app or type coinbase.com yourself if you want to check your account; never use the contact details inside the text. This page explains how the trick works, what genuine Coinbase contact looks like, what to do if you have already called, and where to report it. It is consumer-safety information, checked October 2026, and not financial or legal advice.

Short answer: if you didn't request a withdrawal, don't call or reply

The text is built on a single fear: that someone is about to empty your account. The "withdrawal code" is bait, and the phone number is the hook. Coinbase's own phishing help page, read on 10 October 2026, says it "will never ask you to contact an unknown number to reach us" and that "no one will ever ask for your password, 2FA codes, or for you to transfer assets to a specific or new address, account, vault, or wallet." The US Federal Trade Commission gives the same rule for any company: if you think a message might be real, contact the company "using a phone number or website you know is real. Not the information in the text message."

So the safe move costs you nothing. Leave the text alone, open your Coinbase app the way you normally do, and look at your recent activity. If nothing is moving, you have lost nothing. If you are still worried, change your password and review your security settings from inside the app. Then report the message (see the reporting section below) and delete it.

One rule covers almost every version of this scam: you contact Coinbase, Coinbase does not get you to contact a number it sent you. Any message that hands you a phone number is the first step of a theft.

What the text says and why it works

Versions differ, but the pattern is consistent. A scam alert from the Washoe County Sheriff's Office in Nevada quotes a typical example: "(COINBASE) The OTP code for your withdrawal is 736191. If this was not you please call us on" a US toll-free number, followed by a reference number such as "Ref CB97405." OTP means one-time password. The sheriff's office lists the giveaways: an unknown sending number, an OTP or withdrawal notice you did not ask for, a request to call a number to "verify" activity, and urgent wording. The wording is deliberately dull and official, because a plain message looks more like a real system alert than an obvious come-on.

It works for three reasons. First, it creates urgency: a withdrawal sounds like money leaving right now, so people act before they think. Second, it inverts the usual warning. Most of us have learned not to click links in texts, but calling a number to stop a fraud feels like the responsible thing to do. Third, the person who answers may already know things about you, such as your name, address or the fact that you hold an account, which makes the call feel genuine. The FTC describes exactly this family of messages: texts that "say they've noticed some suspicious activity on your account — but they haven't," or that tell you to get in touch "if you didn't authorize the purchase — but it's a scam."

How the scam plays out, step by step

The text is only the opening move. The money is taken later, on the phone, by a person reading from a script.

1. The bait. A text arrives with a code and a number to call "if this wasn't you."
2. The call. You ring the number and reach a calm, professional "support agent," sometimes after hold music and a menu, which adds to the act.
3. The scare. The agent confirms your fear: your account is compromised, a withdrawal is pending, or your funds are at risk from a hacker or a rogue employee.
4. The ask. To "protect" your money, you are told to move it to a new wallet or "vault," to read out a code that has just been sent to you, to install a remote-access app, or to give your password or recovery phrase.
5. The theft. The new wallet belongs to the scammer. Crypto transfers cannot be reversed, so once the coins move they are, in practice, gone.

Every one of those asks is on Coinbase's own list of things its agents never do. Its help page says customer service agents will never "ask you to secure, move, or access your funds," never provide or ask for a seed phrase, never "ask for your password or 2-step verification code," never ask you to install software, and never remotely access your device. The FTC's crypto-scam guidance adds the broader principle: "Only scammers demand payment in cryptocurrency," and calling back a number from an unexpected message connects you to a scammer, not to the company.

What real Coinbase contact looks like, and what it never asks

It helps to separate what a genuine security message can do from what the scam needs you to do. A one-time code is something you type into Coinbase's own app or website to confirm an action you started. It is never something you read aloud to a caller, and a genuine alert has no reason to send you to a phone number.

Coinbase's page makes several points worth knowing in its own words. It says it will "never call or text you to give you a new seed phrase or wallet address to move your funds to," and that if you get such a call you should hang up. It says to contact it only "through the phone number or email listed on our Contact us page." It warns that "scammers can spoof legitimate phone numbers," which means a familiar-looking caller ID proves nothing. And it notes one genuine exception that scammers cannot easily copy: if you are cut off during a support call that you started, an agent calls back within five minutes on the same number and re-verifies you with a security question before going on.

The same page recommends a protective setting many people never switch on: withdrawal allow-listing, which limits on-chain transfers to addresses you have approved in advance. With it enabled, a thief who gets into your account has a much harder time sending your coins somewhere new.

Did you already reply or call? Do these six things now

If you called the number, replied, or followed instructions, act quickly but calmly. Order matters: secure the account first, then the money, then the paperwork.

1. Hang up and stop all contact. Do not call back to "check," and ignore follow-up texts or calls that reference the first one.
2. Secure your login. Open the Coinbase app yourself, change your password, and confirm that 2-step verification is on and set to a method you control. If you use the same password anywhere else, change it there too, starting with your email account.
3. Check what changed. Look for new devices, sessions, API keys, linked accounts and allow-listed addresses, and remove anything you did not add yourself.
4. Protect any wallet whose phrase you shared. If you read out or typed a recovery phrase, assume that wallet is compromised. Set up a new wallet yourself and move what is left into it.
5. Tell Coinbase. Coinbase's help page says that if you were asked for any of the above you should "disconnect the call and email [email protected] immediately." Use the support options inside the app as well.
6. Report it and keep records. Screenshot the text, note the number that called you, and save any transaction IDs, then file the reports listed below.

If money has already left, be realistic and be careful. Crypto transfers generally cannot be reversed, and a fresh wave of "recovery" offers often follows a loss. The FBI's Internet Crime Complaint Center logged 10,516 complaints about fake fund-recovery services in its 2025 report, with $1.4 billion in reported losses, a figure IC3 notes may include losses from the earlier scam that prompted the contact. IC3 also says it will never contact you directly to ask for information or money. Anyone who calls promising to get your coins back for a fee is the second scam, not the cure.

Why scammers know your name: the 2025 Coinbase data breach

A cold caller who knows your name, address and roughly what you hold is far more convincing, and in 2025 a large amount of that kind of information was stolen. In a Form 8-K filed with the SEC on 15 May 2025, Coinbase disclosed that criminals had paid overseas support contractors to take customer data. According to the filing, the stolen data included names, addresses, phone numbers and emails, masked Social Security numbers (last four digits only), masked bank-account numbers, images of government-issued ID, and account data including balance snapshots and transaction history. Coinbase said passwords and private keys were not compromised and that the insiders could not access customer funds. It also said it had not paid the criminals' demand.

Why this matters for the text scam: Coinbase's annual report says the criminals used the stolen data for social-engineering attempts, that is, for persuading customers to hand over access or move their money. Coinbase preliminarily estimated the cost of the incident at roughly $180 million to $400 million and said it would voluntarily reimburse eligible retail customers who had sent funds to the scammers as a direct result. Its annual report for 2025, filed in February 2026, says it paid $311.2 million in cash during 2025 in connection with the incident, covering reimbursements and direct legal costs.

Two lessons follow. If a caller knows real details about you, that is not evidence that the call is genuine. And if you were a Coinbase customer in 2025, it is sensible to assume your contact details may be in criminal hands and to treat every unsolicited "Coinbase" message accordingly.

How big the problem is

Fake support is one of the larger crypto fraud categories in the FBI's numbers. IC3's 2025 annual report, published in 2026, counted 17,355 complaints about tech and customer-support scams involving cryptocurrency, with $1.226 billion in reported losses. IC3 does not attribute those to any particular exchange, so they should not be read as Coinbase-impersonation losses alone, but they show how well the "helpful support agent" story works. Across all crypto-related complaints, IC3 recorded 181,565 reports and $11.366 billion in losses for 2025. These are complaints people chose to file, not a full count of fraud, so the true totals are likely higher.

How to report the text and the call

Reporting helps phone carriers block the next wave and gives investigators the pattern. Here are the routes, with what each one is for.

• Your phone carrier (US): copy the message and forward it to 7726 (SPAM). The FTC and Coinbase both point to this free service, which helps carriers spot and block similar texts. Your messaging app's "report junk" option does the same job.
• The FTC: report the scam at ReportFraud.ftc.gov, as the FTC's text-scam page advises.
• The FBI: file at ic3.gov, the FBI's central hub for reporting cyber-enabled crime, especially if you lost money. Include transaction IDs and wallet addresses.
• Coinbase: email [email protected] and use in-app support, so the company can review your account and the number that was used.
• Outside the US: report to your national fraud or cyber-crime service and to your bank if card or bank details were shared.

The FTC also lists the CFTC and the SEC as places to report crypto fraud, which is worth doing if the caller pushed an investment or a "protected" account as part of the pitch.

Edge cases: when a code text might be genuine

Not every code is fake. Coinbase's help page on 2-step verification (read 10 October 2026) says 2-step verification is required on every account and that text message (SMS) is the default method, while calling it "the least secure option" and recommending that you add stronger methods, such as security keys or a passkey. So a genuine code can arrive by text. The difference is context. If you were signing in or sending crypto a moment ago, a code is expected, and you type it into the app or site in front of you, nowhere else. If you were not doing anything and a code arrives, two explanations are possible: it is a fake text, or someone has your password and is trying to get in. Either way the answer is the same. Do not call any number in the message, open the app yourself, change your password, and check that 2-step verification is still set to something only you control.

A few other variations are worth recognising. Some messages skip the code and claim a large purchase or a locked account. Some arrive as emails or as a voice call first. Some send you to a lookalike website; Coinbase's help page gives "c01nbase.com" as the kind of address phishers use. And some appear to come from a regulator or the police. The fixed point never changes: genuine staff do not ask you to move your crypto, read out codes, share a recovery phrase or install remote-access software. For a wider tour of the tricks aimed at newcomers, see our guide to common crypto scams for beginners, and for why a "safe wallet" offer is so dangerous, our explainer on crypto wallets versus exchanges.