Is this Coinbase withdrawal code text a scam?

How to spot the Coinbase scam

• You did not start a withdrawal. Coinbase generates a code only after you begin one in the app, so an unrequested code is not a warning, it is bait.
• The link is a lookalike: cb-secure.co, coinbase-secure.com, coinbase-help.org. Real Coinbase links sit on coinbase.com and nowhere else. Read the root domain, not the first word.
• The page asks for your password and 2FA code on one screen. Coinbase's real login never combines those steps.
• The text hands you a phone number at all. Real Coinbase alerts deep-link into the app; the scam needs you on a live call, so it prints a number.
• A number is printed for you to call, or one rings you. Coinbase's own guidance is that it will never ask you to contact an unknown number to reach them, and that if you get a call like this you should hang up. Caller ID showing Coinbase proves nothing either, because it is trivially spoofed.
• The caller knows your name, your balance, maybe your last transaction. Coinbase disclosed in May 2025 that bribed support contractors copied customer records. That stolen data is why this feels personal.
• You are asked to read back a 2FA code, or to move funds to a 'protected vault address'. Vault is a feature inside your own account. No Coinbase staffer moves your coins somewhere for safekeeping.
• There is a countdown. Minutes before a lock expires, before permissions unfreeze. Urgency exists to stop you opening the app and seeing nothing is wrong.

What to do now

1. Do not use the link or the number. Open the Coinbase app yourself and check Activity. No pending withdrawal means the text was invented.
2. If you think you gave anything away, hit Lock Account first, under Security in the app. It freezes transfers and signs every device out instantly, it is the fastest move available to you, and you can lift it once you are safe.
3. Then reset your password from a different device, sign out all sessions, and move remaining funds to a wallet created on a clean machine.
4. Rotate the 2FA secret itself, not just the current code, and switch to a hardware key if you can. A phishing page can replay an SMS code or a TOTP token; it cannot replay a hardware key.
5. Hang up on any caller claiming to be Coinbase, however much they seem to know about you. Support runs through in-app chat and email, and you have to start it.
6. Report it. Forward a text to 7726, and send the message, or a screenshot of your call log with timestamps, to security@coinbase.com so the domain or number gets taken down.