Scam alert · September 30, 2026
The Fake Text Arrived During a Real Support Conversation
A new federal case shows how a perfectly timed fake account alert can lead to account takeover. Learn the rule that protects passwords and verification codes.
Read this in five minutes. Then talk about it with someone you care about.
The victim was already exchanging legitimate emails with Coinbase when a text message arrived that appeared to come from the same company.
That timing made the message fit the moment.
According to a civil forfeiture complaint announced by federal prosecutors in Massachusetts on September 28, the fraudulent texts persuaded the victim to share login credentials, a password, and other information. Scammers then gained access to the cryptocurrency account and removed funds without permission.
Federal authorities traced and seized cryptocurrency currently valued at about $47,000. The government is seeking to recover it through a civil forfeiture action. The allegations still must be resolved through that legal process.
The case is about a cryptocurrency account, but the family lesson applies to banks, email, payroll, social media, health savings accounts, and almost any service protected by a login.
Why the message feels real
Most scam education focuses on strange messages that arrive without context. This one arrived while the victim was already dealing with the company.
The timing could make two separate conversations feel connected. A text mentioning a security issue, case number, or account problem may seem like a natural continuation of the real support request.
Scammers also use familiar logos, sender names, and urgent language. They may say a transfer is pending, a new device signed in, or an account will be locked. The message gives the target a task that feels protective: confirm the account, cancel the transaction, or verify an identity.
But the “security step” is the theft. The link leads to a fake sign-in page, or the person posing as support asks for information that allows access to the real account.
Two-step verification helps protect an account, but a code cannot help if it is handed to the person attempting the login.
Warning signs to notice
Pause when an account alert or support message:
- Arrives by a different channel during an existing support conversation.
- Includes a link and says you must sign in immediately.
- Asks for a password, two-step verification code, private key, recovery phrase, or remote access to a device.
- Uses fear about an unauthorized transfer or new login to keep you from slowing down.
- Tells you to move money or cryptocurrency to a “safe” account or wallet.
- Provides a phone number that does not appear inside the official app or website.
- Uses a case number, employee name, or accurate account detail as proof of identity.
- Discourages you from ending the conversation and contacting the company independently.
An accurate detail does not authenticate the sender. Personal information can come from data breaches, public records, compromised email, or earlier conversations.
The 60-second defense
Give your family this rule:
Account alerts send us to the official app. They never get our password or verification code.
Do not tap the message link, call its phone number, or reply. Open the company's app yourself or use a bookmark you created before the alert arrived. Check the account activity and contact support from inside that trusted channel.
If the account uses Coinbase, the company says its employees will not ask for passwords, two-step verification codes, email access, remote access, or payment to resolve an account problem. Coinbase also recommends bookmarking Coinbase.com and using the bookmark instead of links in messages.
The same habit works across other accounts: leave the incoming message and start a new session through a channel you control.
Use a unique password for every important account. Secure the email account connected to financial services, because password resets often flow through email. When available, consider a passkey, security key, or authenticator app instead of relying only on text-message codes.
If information was already shared
Act from a device you trust. Lock the financial or cryptocurrency account if the provider offers that option. Change the account password and the password for the connected email address. Review active sessions, authorized devices, recovery addresses, forwarding rules, and recent transactions. Remove anything you do not recognize.
Contact the company through its official app or website. Tell the bank, exchange, or payment provider that the account was taken over and ask what can be frozen, traced, or recovered. Do not send more money to anyone who promises to unlock or recover the account.
Save the text, website address, phone number, emails, transaction records, and wallet addresses. Report cyber-enabled theft to the FBI's Internet Crime Complaint Center at IC3.gov. Cryptocurrency users can forward suspicious communications claiming to be Coinbase to security@coinbase.com.
Move quickly without blaming the account holder. The message was designed to appear at the moment help was expected.
Talk about it tonight
Ask: “If a security text arrives while you are already talking to support, how will you verify that the two conversations are connected?”
Practice the answer: do not use the text. Open the official app independently.
If an account alert, support message, or login request feels suspicious, describe it in The Scam Hotline Scam Detector. Do not include passwords, authentication codes, private keys, recovery phrases, account numbers, or other sensitive information. The free tool can help identify warning signs and organize the next verification step.
Scammers want silence. Families talk. Talk to yours today.