Fake logins and account theft · stamped DANGER

The "cancel this withdrawal" code pageDANGER

A real scam people fell for this year, next to the real thing. The numbers mark the three things to check: hover or tap one to see what it tells you.

Safe
CCoinbase - Sign in×
https://login.coinbase.com/signin
coinbase
Enter your 2-step verification code

We sent a code to your phone ending in 47. It expires in 10 minutes.

• • • • • •
Continue

Didn't get it? Resend code

ScamDANGER
CCoinbase - Cancel withdrawal×
https://coinbase-cancelrequest.com/withdrawal/cancel
coinbase
A withdrawal was requested

A withdrawal of 0.42 BTC (about $27,300) to an outside wallet was requested from your account.

If this was not you, enter the 2-step verification code sent to your phone to cancel it.

• • • • • •
Cancel withdrawal

Always check the code.

It wants the 2-step code Coinbase just texted you, on a site Coinbase does not own. That code is the last lock on your account: whoever types it in gets in.

Always checkThe real oneThe scam
1Where it livesIs it the real company's or person's own address or number?

login.coinbase.com is Coinbase's own sign-in page.

coinbase-cancelrequest.com has Coinbase in its name, but Coinbase doesn't own it.

2What it asks you to doCheck firstDoes it want a password, a payment, a call, or a tap?

It asks for the code you just got, on Coinbase's own sign-in page, right after you signed in yourself.

It wants the code from your phone typed into a stranger's page.

3How hard it pushesIs there a deadline, a threat, or a surprise charge?

No scare, no withdrawal you didn't make.

A 0.42 BTC withdrawal you didn't ask for, and "cancel it now".

RememberA code from a text or an authenticator app only ever goes into the company's own site or app. Never into a page you reached from a message.

Would you have spotted it?

10 pairs like this one, three minutes, a score to share. Then find out who in the family is the easy mark.

Take the testNext scam: The real Dropbox page with a fake "secure viewer" →