Scam Detective
Scam verdict · Educational pattern check
Scam Detective research desk · Updated August 2026
No — scam

I got a text with a Coinbase withdrawal code telling me to call a number — is it real?

No. A nationwide wave of fake “withdrawal code” texts impersonates Coinbase and other exchanges: the code is invented, and the phone number reaches the scammer, whose script ends with you reading out your real login codes or moving your crypto to a “safe wallet” they control. Coinbase does not send withdrawal alerts that ask you to call a number. Delete the text, and if you want to check your account, open the exchange's own app — never the number in the message.

Educational verdict from documented scam patterns — not a live report. For a 0–100 risk score on the exact link in your hand, run the checker.

Check a URL freeRead the full guide

From the research desk — this pattern is one of those documented in This Week's Scam Wave, in Numbers — August 19, 2026 →

Why now · August 2026

Why you’re seeing this now

Because a nationwide smishing surge is still in progress. Through 2025 and 2026, county consumer-affairs offices and sheriffs' departments across the US have issued alerts about texts carrying a fake Coinbase “withdrawal code” and a callback number — the number reaches the scammer, whose script ends with you reading out your real login codes or moving your crypto to a “safe wallet” they control. The August 2026 wave is hitting people who have never owned crypto at all: the text is a lure, not an account alert.

The script · As it arrives — text message, then the phone call it baits

The exact words they use

Quoted from documented versions of this script so you can recognize it on sight. The words are the scammer’s — the patterns inside them are what give the con away.

“Coinbase: A withdrawal of 2.417 BTC ($284,113.06) was initiated on your account. Verification code: 882914. If you did NOT authorize this, call Coinbase support immediately: +1 (888) 555-0142.”

“Thank you for calling Coinbase security. I can see the withdrawal you reported — we have about fifteen minutes before it confirms on the blockchain.”

“To verify you are the account holder, I am sending a code to your phone now. Please read the code back to me.”

“Your account has been compromised. To protect your remaining balance we need to move it into a secure wallet. I will walk you through it — do not hang up.”

Script language quoted for recognition — if the message in your hand reads like this, you already have your verdict.

The checklist

Five red flags — any one is enough

A withdrawal alert arrives as a text with a phone number to call — real exchanges alert you inside their own app and never ask you to call a number from a message.
The “agent” answers already knowing about the transaction — you reached them at the number they sent, on a line they control.
You are asked to read out a code that just arrived on your phone — that code is your real login or withdrawal approval, and reading it out hands it to the caller.
Any instruction to move crypto to a “safe” or “secure” wallet — there is no such process; the wallet belongs to the scammer.
A countdown — “fifteen minutes before it confirms” — plus pressure to stay on the line and tell no one.
What to do now

Your next three moves

1
Do not call the number in the text. Open the exchange's own app — or type its address yourself — and check your account there. If nothing shows, nothing happened.
2
If you read out a code or moved funds: change your password from the official app, sign out all sessions, and contact the exchange through its published support channel right away.
3
Report the text — forward it to 7726 (SPAM) and file it at reportfraud.ftc.gov — then delete it.
Instant URL Check · $2, one-time
Holding the actual message? Check the exact link, number, or sender.
Paste it into the instant check — free risk signal in 60 seconds, then the full report for $2: a 0–100 scam risk score, a plain-English verdict, the top 5 red flags found, and a 3-step what-to-do-now list. No subscription.
Run the $2 instant check
Follow-up questions

People also ask

Does Coinbase ever send withdrawal codes by text?

Coinbase can send sign-in verification codes, but it does not send withdrawal alerts that ask you to call a phone number. Any text that pairs an alarming “code” with a callback number is the scam — check your account only inside the app or at an address you type yourself.

I called the number but didn't share anything — am I safe?

Yes, if you read out no codes and moved no funds. Do expect more attempts — calling confirms your number is live and answered. Block the number, and stay off any callback line a message hands you.

I read the 6-digit code to the caller. What now?

Treat the account as compromised: that code approved a login or a withdrawal. From the official app, change your password, revoke all sessions, and contact the exchange immediately — then report the theft to the FBI at ic3.gov.

The text knew an exact withdrawal amount — how?

It didn't. The amounts in these texts are invented to look specific; a made-up figure costs the scammer nothing and panics you into calling. Your real account activity is only visible inside the app.

Related verdicts

People asking this also asked

Is lumonel.com a scam?Yes — scamA stranger texted me by mistake and keeps chatting — is it a scam?Yes — scam openerIs that video of a celebrity promoting an investment real?No — deepfake
← Browse all 95 answers
$2, one time
No subscription, no account, nothing to cancel.
Verdict in minutes
Full report on screen and as a PDF, usually within minutes.
Honest verdicts
If it looks safe, we say so — a clear “safe” is worth $2 too.
Got a link of your own?

Sixty seconds of checking beats a four-figure mistake.

Paste any URL for a free instant preview — the full 0–100 report is $2, one-time. No subscription.

Check a URL free
Spot the scam before it spots you.
For businesses · $29, one-time
Is someone impersonating your brand?

The costume in these scams — a lookalike domain, a copied storefront, a spoofed sender — is exactly what the brand impersonation audit researches for your company: lookalike domains, typosquats, and copycat sites trading on your name, each with evidence and a risk rating, plus a ready-to-send takedown-request template.

Audit my brand — $29
Free brand scan first — you only pay for the full audit.