Just a day ago, I decided to stake ETH for the very first time.
Either someone was able to know about this (extremely unlikely), or just by coincicence they sent me an email saying that in order to receive my stake, I needed to provide more details. I thought nothing of this, since I constanly receive emails from Coinbase, and the sender was Coinbase (anyone can make up a sender name that appears in your email, of course).
Email details:
[Action required] Verification Request #92658231
The emails is not displaying correctly in the above cut and paste, but it looked like a genuine Coinbase email.
Without even thinking, I just clicked on the "Verify now" button. I was transferred to what I thought was the Coinbase website, and entered my login and password. When it didn't work, I immediately checked my records to verify that I had entered the right information. When I confirmed that the information was correct, I immediately knew this was a phishing scam.
I panicked and immediately opened the Coinbase app on my phone, and found the "lock account" button. I pressed it immediately. There was absolutely no tiime to change my password, as the scammers could be accessing my account immediately.
I received texts saying my account was locked, and indeed I was locked out. I went through the verifcation process to unlock my account which involved texts, emails, copies of front and back of id, and video face authentication.
I then was required to change my password, re-enter it, and then re-authenticate via email and text code.
Thankfully, I was able to change my password, and my account was not hacked. But the sheer panic of losing everything was so devastating.
I believe 2 factor authentication would have required the scammer to enter a code that was sent to my phone, but sometimes this extra secuirty measure is not triggered.
Anyway, just be very careful. I am well aware of these scams, and don't know why I fell for it. The bottom line is that you should never, ever enter your account and pasword manually.
I still can't figure out how they were able to send an email about requiring information for staking payment, immediately after I staked. It can't be a coincidence, as I've never staked before, and never received an email about staking before from Coinbase. My guess is that it's an inside job. Someone was able to find a list of people who recently staked for the first time, and was able to provide that list to the scammers. If so, this is a major breach.
I have received many emails saying that I need to provide more details from Coinbase before for tax purposes, or some other reason, so this email seemed very normal. In order to receive income from staking, your personal details are needed.
Either someone was able to know about this (extremely unlikely), or just by coincicence they sent me an email saying that in order to receive my stake, I needed to provide more details. I thought nothing of this, since I constanly receive emails from Coinbase, and the sender was Coinbase (anyone can make up a sender name that appears in your email, of course).
Email details:
[Action required] Verification Request #92658231
Hi Coinbase Customer, | ||||||||||
Your account is missing some information that we need to collect in order to comply with financial regulations. As a result, effective today, we are unable to pay out your staking rewards until that information is received and verified by us. | ||||||||||
Your staked balances will remain staked. You can request to unstake your assets at any time. Standard unstaking periods apply.1 | ||||||||||
Please take a moment to provide your information today. | ||||||||||
Here is what you need to do: | ||||||||||
| ||||||||||
Reward payments on your staked assets will resume once your updated information is verified. | ||||||||||
Thank you, | ||||||||||
The Coinbase Team | ||||||||||
|
The emails is not displaying correctly in the above cut and paste, but it looked like a genuine Coinbase email.
Without even thinking, I just clicked on the "Verify now" button. I was transferred to what I thought was the Coinbase website, and entered my login and password. When it didn't work, I immediately checked my records to verify that I had entered the right information. When I confirmed that the information was correct, I immediately knew this was a phishing scam.
I panicked and immediately opened the Coinbase app on my phone, and found the "lock account" button. I pressed it immediately. There was absolutely no tiime to change my password, as the scammers could be accessing my account immediately.
I received texts saying my account was locked, and indeed I was locked out. I went through the verifcation process to unlock my account which involved texts, emails, copies of front and back of id, and video face authentication.
I then was required to change my password, re-enter it, and then re-authenticate via email and text code.
Thankfully, I was able to change my password, and my account was not hacked. But the sheer panic of losing everything was so devastating.
I believe 2 factor authentication would have required the scammer to enter a code that was sent to my phone, but sometimes this extra secuirty measure is not triggered.
Anyway, just be very careful. I am well aware of these scams, and don't know why I fell for it. The bottom line is that you should never, ever enter your account and pasword manually.
I still can't figure out how they were able to send an email about requiring information for staking payment, immediately after I staked. It can't be a coincidence, as I've never staked before, and never received an email about staking before from Coinbase. My guess is that it's an inside job. Someone was able to find a list of people who recently staked for the first time, and was able to provide that list to the scammers. If so, this is a major breach.
I have received many emails saying that I need to provide more details from Coinbase before for tax purposes, or some other reason, so this email seemed very normal. In order to receive income from staking, your personal details are needed.
Last edited:
