Got a Coinbase Withdrawal Code Text? How to Tell If It Is a Scam

Scammers are texting fake Coinbase security alerts that claim a withdrawal was requested, show a six-digit code you never asked for, and tell you to call a number if it was not you; the person who answers is an impersonator trying to steal your password, two-factor code or crypto. The FBI warned about this exact pattern on 1 August 2024, and the texts surged through spring and summer 2025, when US county officials began warning residents. It sits inside a wave of crypto fraud the FBI says cost $9.3 billion in reported losses across 149,686 complaints in 2024, so treat any unrequested code as a red flag and never call or share it.

This explainer covers what a real Coinbase message looks like, why an unrequested code arrives, and the exact steps to take if you received or replied to one. For a plain walkthrough of the exchange itself, see our Coinbase review or the exchange hub.

What is the Coinbase withdrawal code text scam?

Scammers send an SMS that looks like a Coinbase security alert, telling you a withdrawal was requested and showing a six-digit code you never asked for, with a number to call if it was not you. The caller is an impersonator who tries to collect your password, two-factor code or crypto. The FBI described this exchange-impersonation script in a 1 August 2024 alert.

The FBI IC3 alert (I-080124-PSA) says a scammer makes unsolicited contact while pretending to be an exchange employee, creates urgency by claiming an account problem or possible compromise, then asks the victim to safeguard the account by providing login information, clicking a link or providing identification. Once the scammer has access, the cryptocurrency is stolen.

Coinbase’s own phishing guidance is blunt: no one will ever ask for your password or two-factor code, Coinbase will never call or text you a new seed phrase or wallet address, and Coinbase will never ask you to move, secure or access your funds. A request to read out a code is the clearest sign of a scam.

Yahoo News reported on 21 July 2025 that the script had been active for at least a year, with a clear uptick in reports from spring 2025. The message pairs a withdrawal code with a phone number and a reference such as REG: followed by letters and digits, and it reaches people who do not even have a Coinbase account.

The scale helps explain why these texts work. In its 2024 IC3 report, released in April 2025, the FBI counted 149,686 crypto-related complaints and $9.3 billion in losses, up 66 percent from 2023, with people aged 60 and over accounting for about $2.8 billion of that total, as CoinDesk summarised.

How do I tell if a Coinbase text is real?

Real Coinbase security codes are triggered by something you did, such as signing in or sending crypto, and you enter the code yourself; Coinbase will never text you a code and ask you to call a number or read it out. Coinbase’s help centre says no one will ever ask for your password or two-factor code. A message pushing you toward an unknown phone number is a scam.

Two details catch many people out. First, caller ID and sender names can be spoofed, so a message that appears to come from Coinbase may not. Coinbase’s impersonation guidance warns that scammers set up fake support lines and that real-looking numbers do not prove the caller is Coinbase. Second, Coinbase does not offer insurance products and will never call or text you to request account access.

Why did I get a verification code I didn’t request?

An unrequested Coinbase code usually means one of two things: a scammer is running the withdrawal-code script, or someone has your password and is trying to sign in, which triggers a genuine two-factor code. If a real code arrives with no action on your part, change your password and review your active sessions immediately.

A genuine two-factor code that you did not trigger is often proof the protection is working: without the code, whoever is trying to sign in cannot get in. That is exactly why you should never share it. A common phone tactic is for the scammer to trigger a real code while talking to you, then ask you to read it out to confirm your identity; Coinbase says to hang up and report instead.

The FTC adds the same test for any message: contact the company using a phone number or website you know is real, not the information in the message. Legitimate companies will not text you with a link to update your payment or account information.

What should users do now?

If you get a Coinbase withdrawal code text you did not request, do not reply, do not call the number and do not share the code. Delete the message, then sign in to Coinbase directly, never through a link in the text, and review your account. If anything looks wrong, lock the account and report it.

1. Do not reply, call, click or share the code.
2. Delete the text. In the US, forward it to 7726 (SPAM) to help your carrier block it.
3. Sign in at coinbase.com or in the app and check recent activity and withdrawals.
4. If a real code arrived but you did nothing, change your password and review signed-in devices.
5. Lock the account if you suspect access: in the app, Account & settings, then Security, then Lock Account. Locking signs you out everywhere.
6. Email a screenshot to [email protected].

Coinbase’s compromised-account page lists its real support lines for account lockouts: +1 (888) 908-7930 in the US and Canada, and +44 808 168 4635 in the UK, both 24/7. Use those numbers only for a genuine account problem, and remember Coinbase generally does not call you out of the blue. If you are weighing whether to keep funds on an exchange at all, see is it safe to keep crypto on an exchange.

What if I already called, replied or shared a code?

If you already called the number, replied, or read out a code, move quickly and in this order: lock your account, change your password, remove unfamiliar sessions and devices, and reset two-factor authentication. Then tell Coinbase and the authorities, and contact your bank or card company if you shared financial details.

1. Lock your account now: app, Account & settings, Security, Lock Account. This signs you out on every device.
2. Change your password to a new, unique one, then reset two-factor authentication, ideally to an authenticator app or a security key rather than SMS.
3. Review active sessions and devices and sign out anything you do not recognise.
4. Email [email protected] with a screenshot and what you shared.
5. If you shared bank or card details, contact your bank or card company.
6. Report to the FBI IC3 at ic3.gov and the FTC at ReportFraud.ftc.gov. If you shared identity details, go to IdentityTheft.gov.

Never share your seed phrase or private keys with anyone, including someone claiming to be support; our seed phrase guide explains how to keep them safe. And if you are moving funds off the exchange for the first time, read how to move crypto from an exchange to a wallet.

How do I report the scam?

Report a Coinbase withdrawal code text by forwarding the SMS to 7726 (SPAM) so your US carrier can block it, emailing a screenshot to Coinbase at [email protected], and filing with the FBI IC3 at ic3.gov or the FTC at ReportFraud.ftc.gov. Include any transaction details if funds actually moved.

• Coinbase: email a screenshot to [email protected].
• US carrier: forward the text to 7726 (SPAM).
• FBI IC3: file at ic3.gov, including any transaction information.
• FTC: file at ReportFraud.ftc.gov.
• Identity details shared: use IdentityTheft.gov for a recovery plan.

Crypto assets are volatile and this is not financial advice.