Sophisticated (Sort of) Phishing Attempt.

I had a pretty Ballsy attempted phishing call the other day and though I would post it here. I am including the URL's and codes but the site has been taken down now and just redirects to the main Coinbase site. I reported it to CB with all info and email headers, but this was a pretty ballsy attempt and honestly they "kinda" had me at first, but the red flags started popping up quickly. I will admit that I can see how some less techy users might fall for this, I received an automated phone call from 888-280-2666 saying that there was an attempt to change my password. The call asked me to press one if the attempt was not from me, I pressed 1 and I was told a member of the Coinbase Security team would call me back. About 30 minutes later I received a call from 818-724-9455, a very professional person without any accent verified that I did not attempt to change my password, I verified. He then verified my email address and my phone number. He explained that there had been an attempt to change my account had come from a IP address in Frankfurt Germany and they had also attempted to change my email address to mohammad481@gmail.com. I asked about the 2 factor authentication that I had setup and he explained that Coinbase had a breach last year and my personal information like my drivers license number and banking information had been compromised and they were attempting a MFA reset. He then explained that they recommended moving my funds to a Online Cold Wallet (really???) and they would send me directions via email. I then received an online security review via email, there was a link in the email https://378101coinbase.com. The person on the phone provided a security code to login to the site. Once logged in there was a place to input the amounts to transfer to the "Online Cold Wallet" but I could see the bitcoin addresses on that page that the funds were going to be sent. . The site looked very much like a Coinbase Site. I knew this was a phishing attempt but I decided to ask about the URL with the 378101coinbase.com and he explained that this was a one time secure site and the number was my ticket number and he said to verify this he would send me a verification email for the ticket, I then received an email with this in the body – Representative Verification Reference Number: REF-378101 To ensure you are communicating with one of our authorized representatives, please verify the information provided below. Representative: Mark Alvarez Ticket ID: #378101 Important: This information should not be shared with anyone. At this point I knew that was a Phishing attempt but I said I would call them back just to see hie response. He tried to provide a number but I said I already had the number for Coinbase, he said that the general support team would not be able to help me as fast and also not have the resources to stop the attack as quickly as his team would be able to assist,, The whole he was very "business" like and to the point, he had definitely done this many times. Anyway, be careful out there and HODL! submitted by /u/WilWat [link] [comments]

Jun 12, 2025 - 19:56

I had a pretty Ballsy attempted phishing call the other day and though I would post it here. I am including the URL's and codes but the site has been taken down now and just redirects to the main Coinbase site. I reported it to CB with all info and email headers, but this was a pretty ballsy attempt and honestly they "kinda" had me at first, but the red flags started popping up quickly. I will admit that I can see how some less techy users might fall for this,

I received an automated phone call from 888-280-2666 saying that there was an attempt to change my password. The call asked me to press one if the attempt was not from me, I pressed 1 and I was told a member of the Coinbase Security team would call me back.

About 30 minutes later I received a call from 818-724-9455, a very professional person without any accent verified that I did not attempt to change my password, I verified. He then verified my email address and my phone number. He explained that there had been an attempt to change my account had come from a IP address in Frankfurt Germany and they had also attempted to change my email address to mohammad481@gmail.com. I asked about the 2 factor authentication that I had setup and he explained that Coinbase had a breach last year and my personal information like my drivers license number and banking information had been compromised and they were attempting a MFA reset.

He then explained that they recommended moving my funds to a Online Cold Wallet (really???) and they would send me directions via email. I then received an online security review via email, there was a link in the email https://378101coinbase.com. The person on the phone provided a security code to login to the site. Once logged in there was a place to input the amounts to transfer to the "Online Cold Wallet" but I could see the bitcoin addresses on that page that the funds were going to be sent. .

The site looked very much like a Coinbase Site. I knew this was a phishing attempt but I decided to ask about the URL with the 378101coinbase.com and he explained that this was a one time secure site and the number was my ticket number and he said to verify this he would send me a verification email for the ticket, I then received an email with this in the body –

Representative Verification

Reference Number: REF-378101

To ensure you are communicating with one of our authorized representatives, please verify the information provided below.

Representative: Mark Alvarez

Ticket ID: #378101

Important: This information should not be shared with anyone.

At this point I knew that was a Phishing attempt but I said I would call them back just to see hie response. He tried to provide a number but I said I already had the number for Coinbase, he said that the general support team would not be able to help me as fast and also not have the resources to stop the attack as quickly as his team would be able to assist,, The whole he was very "business" like and to the point, he had definitely done this many times.

Anyway, be careful out there and HODL!

submitted by /u/WilWat
[link] [comments]