Fake Coinbase account locked emails: how to tell if your account is really restricted

"Your Coinbase account has been locked after a suspicious withdrawal attempt. Verify your identity to restore access." Crypto accounts are a direct route to money that can't be pulled back, so criminals copy Coinbase's security notices closely. A fake one either steals your login and 2-step code, or talks you into "protecting" your funds by sending them to a wallet the criminal controls. This guide shows how to check a Coinbase alert, what Coinbase says it never does, and what to do if you clicked.

What is a fake Coinbase account locked email?

A fake Coinbase account locked email is a phishing message that copies a Coinbase security or compliance notice. It claims your account is locked, restricted or under review, and tells you to sign in, verify your identity or call "support" to restore it. The link leads to a fake Coinbase sign-in page; the phone number reaches a scammer.

Coinbase describes this directly on its phishing help page: attackers "will brand themselves and pretend to be Coinbase in order to obtain sensitive information, such as passwords and 2FA codes." Its impersonation scams page adds that scammers "may pose as employees and try to pressure you into moving your funds."

Common versions of the lure

The withdrawal and "call support" versions are callback scams: the email exists only to get you on the phone. Our guide to callback phishing explains how those calls run.

Example of a fake Coinbase account locked email

This is an example written for this guide. It is not a real Coinbase email.

From: Coinbase Security <no-reply@coinbase-account-review.com>
Subject: Your account has been temporarily locked

We detected an unauthorized withdrawal request from a new
device (Windows, Kyiv, UA). To protect your assets we have
temporarily locked your account.

If you did not request this withdrawal, verify your
identity immediately:

[ Unlock my account ]

Or speak to a Coinbase security agent: +1 (8XX) XXX-XXXX
Case ID: CB-77341-SEC

Failure to verify within 2 hours may result in loss of funds.

The giveaways: a domain that isn't coinbase.com, a phone number in the email, a case ID meant to sound official, and a two-hour threat. The checks below work even when the fake looks perfect.

How do I know if a Coinbase email is real?

Close the email and open the Coinbase app, or type coinbase.com into your browser yourself. If your account works normally and shows no lock, pending withdrawal or verification request, the email is fake. Coinbase suggests using your browser's bookmarks to reach its sites, which also protects you from typos (Coinbase Help).

Then check the message against what Coinbase publishes:

1. The request. Coinbase says: "Emails from Coinbase never ask for your password, 2-step verification codes, or remote access to your computer" (Coinbase Help). If an email asks for any of those, it isn't from Coinbase.
2. The sender's full address. Coinbase says its addresses "always end with 'coinbase.com.'" At the time of writing (November 2026), its examples are @mail.coinbase.com, compliance-kyc@coinbase.com, contact@coinbase.com, contact@updates.coinbase.com, help@coinbase.com, info@cb.mail.coinbase.com, no-reply@coinbase.com, no-reply@info.coinbase.com and support@coinbase.com. The display name proves nothing; see display name spoofing.
3. The link. Hover over it. Coinbase's own example is a site at "www-coinbase.com", where a dash replaces the dot after "www". Our guides to lookalike domain phishing and checking if a link is safe show more patterns.
4. The phone number. Coinbase says it "will never ask you to contact an unknown number to reach us" and says to contact it only through the phone number or email on its Contact us page.

Real vs fake Coinbase emails

What will Coinbase never ask you to do?

Coinbase publishes a clear list. According to its impersonation scams page, Coinbase customer service agents will never:

• ask you to secure, move or access your funds
• provide a wallet seed phrase or ask you for your seed phrase
• ask for your password or 2-step verification code
• ask you to install software on your device
• remotely access your device to take action on your account

It also says: "We will never call or text you to give you a new seed phrase or wallet address to move your funds to. If you receive this call, hang up the phone." The FTC is just as direct: "Only scammers demand payment in cryptocurrency", and no legitimate business will demand you send crypto in advance, "not to buy something, and not to protect your money" (FTC).

What should I do if I clicked a fake Coinbase link?

Act in minutes, not hours. The FTC says "Cryptocurrency payments typically are not reversible", so the goal is to stop any transfer before it happens.

Do this now

1. Lock first. Coinbase's advice is "Lock first, ask later. If something feels off, lock your account in-app and email security@coinbase.com."
2. Change your email password, then your Coinbase password, from a trusted device. Coinbase tells phishing victims to secure the account by changing both (Coinbase Help). Whoever controls your email can reset everything else.
3. Hang up on any "agent" who called you, and don't move funds, read out codes or install software.
4. Contact Coinbase support through its official help site if you lost funds.
5. Strengthen sign-in. Coinbase recommends turning on withdrawal allow-listing, which lets on-chain transfers go only to wallets you know and trust, and strong 2-factor authentication, with hardware security keys as its top pick.
6. Report the loss to the FTC at ReportFraud.ftc.gov and to the FBI's IC3, which the FTC lists among the places to report crypto fraud.

If you entered a password you use anywhere else, change it there too. Our guide to what to do after clicking a phishing link covers checking your device.

Watch for recovery scams

After a loss, expect follow-up contact from people who claim they can recover your crypto for a fee, including fake law firms and people posing as government agencies. These are second scams. Our guide to crypto investment scam emails explains how recovery scams work.

How do I report a fake Coinbase email?

Email security@coinbase.com with the full URL of the phishing site. Coinbase's reporting page asks you to include the full email headers, because "Without them, Coinbase cannot complete a full investigation as we have no way of identifying which mail server is involved." Our guide to how to read email headers shows how to copy them in Gmail and Outlook.

For phishing texts, send a screenshot to the same address and forward the text to 7726 (SPAM). You can also report the email to the FTC at ReportFraud.ftc.gov, as the FTC's phishing guidance recommends, and see how to report a phishing email for your mail provider's report button.

Why do fake Coinbase emails matter to a business?

Fake exchange emails don't only reach personal inboxes. Staff get them at work, and a business that holds crypto in a treasury or accepts it as payment has company funds at stake. A finance person who calls a fake "Coinbase security" number from a work email is a business incident.

1. Find every copy. Search by sender domain and subject with Microsoft 365 message trace or Google Workspace email log search, then remove them from all mailboxes.
2. Block the sender and link domains. Never block coinbase.com if anyone uses it for work.
3. Ask who clicked or called. Anyone who entered credentials resets them; anyone who moved company funds follows the "do this now" list with your bank and legal counsel involved.
4. Require two people to approve any transfer of company crypto, and use withdrawal allow-listing on company accounts.

If your own brand is copied the same way, see what to do when customers are phished by a fake version of your company. An MX-level inbound filter checks mail for phishing, spoofing and lookalike senders before it reaches inboxes, with a quarantine each user can review; our small business email security page explains where it fits.

Next steps

1. Share the one rule: Coinbase never asks for passwords, 2-step codes or fund transfers, so check every alert in the app.
2. Turn on hardware security keys and withdrawal allow-listing for any Coinbase account you or your company use.
3. Save security@coinbase.com and the 7726 short code where you'll find them.
4. Paste the headers of a suspicious "Coinbase" email into the free Email Header Analyzer to see where it really came from, and if fake alerts keep reaching staff, see how iBlockSpam protects small business email.

Browse our other phishing and threat guides.