Skip to content
Reported stories

Account-support impersonation · United States

A Coinbase email exchange was followed by fraudulent texts

The person was already corresponding with Coinbase by email. Then texts using Coinbase's name sought information that gave access to the account, according to a civil forfeiture complaint. An existing email exchange did not authenticate the new channel.

By Olevo · Reviewed

The detail to carry with you

A new message needs its own check, even when you recently contacted support. Keep passwords and account codes private and return to the provider through an official route you choose independently.

From the public record

An existing email exchange did not verify the new texts

Report published: by US Attorney's Office, District of Massachusetts.

Incident timing: The September 28, 2026 announcement says some funds were seized in August 2026. It does not date the victim's email exchange or the fraudulent texts.

The US Attorney's Office for the District of Massachusetts announced a civil forfeiture action on September 28, 2026. According to the complaint described in the release, a Massachusetts victim received fraudulent texts claiming to be Coinbase while corresponding with the exchange by email. The texts induced disclosure of login and other account-access information.

The release alleges that funds were then removed without the victim's consent and that some funds were traced and seized in August. It describes allegations in a civil proceeding, not a criminal conviction or a confirmed return of money to the victim.

Read the original report

A closer reading · Analysis

Recent support contact can explain why a message gets attention

When someone is already seeking help, a follow-up can seem connected to work in progress. The useful boundary is between that context and actual authorization. Knowing that you have an account issue does not establish that a new caller or text sender belongs to the same support exchange.

Return to the provider through its official app or Help Center and check the specific new request. Avoid moving the conversation simply because the incoming sender supplies a case reference or says the matter is urgent. You can investigate a genuine account problem while keeping the new contact unverified.

The request for access changed the decision

This account concerns information that allowed access to an existing account. It is different from a story about someone choosing a new investment or intentionally making a payment. That difference matters: the next practical question is what was disclosed and which account now needs securing.

Coinbase's support guidance says not to give support agents passwords, account codes, or recovery phrases. If a similar request arrives, end the incoming conversation and use the official account-security process. If information was already shared, tell the real provider which kind of information it was, without repeating the secret in another unverified channel.

Seizure and return to the victim are separate stages

A public announcement about seized cryptocurrency can sound like the end of a case. The release itself describes a civil forfeiture process in which claims must still be resolved. We should not turn that announcement into a promise of repayment or imply that every account takeover has the same outcome.

For someone dealing with a similar loss, preserve the messages and transaction references and report promptly through official routes. Check any later recovery approach independently. A person who knows about the incident does not thereby have authority to recover funds or ask for more account access.

Before a new support message receives account access

Keep the password, code, and recovery information private. Reopen the provider's official support route and verify the specific request outside the incoming text.

Three questions to keep nearby

  • Did I reach this support route independently?
  • Is the new contact asking for information that grants account access?
  • What needs securing now if anything was already disclosed?

If something similar has happened

Contact Coinbase through its official account-security process promptly if access information was shared. Use a trusted device, preserve the messages and transaction references, and report internet-enabled fraud in the US at ic3.gov. Follow the affected provider's instructions about securing the account. A civil filing, seizure, or report does not establish that funds have been returned.

Sources and scope

Sources checked October 25, 2026. We summarize the public record and label our own analysis. The reporting organization has not endorsed Olevo.

See a factual error or a broken source? Send a correction.

Common questions

Does contacting support make a new text or call trustworthy?

No. An existing support exchange provides context, but it does not authenticate another contact. The Massachusetts release describes fraudulent texts arriving during an email exchange. Verify the specific new request through the provider's official route and keep passwords, account codes, and wallet recovery information private.

Did the announcement confirm that the victim received the funds back?

No. The September 28, 2026 release describes a civil forfeiture action and an earlier seizure. It explains that claims must be resolved before property can be forfeited and returned. We do not treat that stage as confirmation of reimbursement or a criminal conviction.

Keep reading

More reported stories