Bitcoin Forum

Hello this is my 1st post here. I am fairly new to BTC and have dabbled a little and have an account with Coinbase. I made a small amount of profit and it is held in cash in my coinbase account ATM. This morning I received an e mail from Coinbase telling me I had to immediately move it into an online wallet and gave a link. It all looked v legit until I looked at the e mail address - events@byhealthmeans.com needless to say I won't be transferring the funds but has anyone else had such an e mail from this address before? It was far more professional than other phishing e mails I have had.

Different scammers use different domains and emails to send phishing emails to their targets, good thing is that you didn't fall for it despite it being curated very well.

Scammers are getting smarter day by day, but no matter how smart they become, there will always be some things that they can't bypass and those are the things that will let people know about them, just like the email address in your case which made you realize that it is a phishing email and not an official email from Coinbase.

Since you have seen it already and pretty much know about it in advance, make sure you stay vigilant all the times because this industry is full of scammers and there will be times when you might not even notice and they will run away with your funds, that is how fast and good they can be sometimes, but as long as we are aware and in all our sense at all times, they can't do anything.  :)

I have also fallen victim of this and sometimes, I just warn my friends to be careful not to click any verification emails that they might receive claiming to verify their Coinbase account. In my case, I do not have a Coinbase account so it was clear that these scammers were trying to open Coinbase accounts using the email addresses of other people.
As users of any account on the internet, always exercise caution, be slow to click on links instead verify the sender's domain, enable additional security 2FA and stay updated with new scams strategies.

Coinbase won't send you emails unless they have major changes to their service or announcement.

Why not post the link he provided?
For me, if it was from other email and not directly from Coinbase then it's 100% a phishing site so be careful don't access the link he provided it might force your browser to do it or the link will redirect you to a phishing wallet that looks legit.

I have lots of emails the same as this all of them are in my spam inbox report it as spam so that you won't see them again in your main inbox.

If you got one then twenty two more are on their way to your inbox.
You've used that address for some free coins or drops and now they've sold it, I would move all my account to a new email and enable 2fa just to be sure.

Disregard the email, It's from a scammer and not from Coinbase. Let me guess the reason the scammer gave for you to transfer your funds, that your account has been compromised and you need to transfer your funds immediately to avoid losing it. Lol, I'm glad you didn't fall for it but you should be more worried on how your email address was gotten. It could be that you posted it online or Coinbase had a data breach.

Like what others say the best thing you can do is disregard the email if you have nothing to with it. You also did the right thing by being careful with the email you got. It's smart not to click on any links or send money if you feel not safe. If you're unsure about an email, it's best to check directly with Coinbase. They can help you figure out if it's real or not. But it's obvious that this is scam or fake so you don't have to. lol

I'll be suspicious how scammers got access to your email and knew you registered on coinbase if you did it all just very recently. Have you been engaged in any online activity that required you to submit your email recently or giving off any other financial information?

If you're certain you'll stay vigilant then you can keep using same email address and carefully vet any mail you get before acting on it or not. Or you can change your email address to a new one you've not used on anything before and never share that for any other purpose.

Just make sure that you don't click the link address sent to you, they may use that alone in tracking you for an attack, ignore the message and block the email, the email is not from Coinbase first, secondly, they wouldn't have requested from you to do such a thing, after this, you need to be very careful from the websites you visited or the kinds of links you're clicking from other online websites, such could be dangerous to you safety.

I am not a coinbase user but still can sure you that it's a phishing link because that's how they work i.e. they create an environment of pressure for you where you have to think fast and have to react quickly. Like lesser time remains to win 1 BTC or you are asked to move funds from your main account to scammer site via some link otherwise your funds will be lost in 1 or 2 hours. Well. they are awesome in there field haha I should not admire them.

But still, if a newbie is joining the crypto sphere then he/she should definitely learn about phishing scams, and how these scammers are advancing there techniques. A smart dude named Faisal2202 said (haha), that when bull run starts, more scammers are active. It's like there season to make some money. So be vigilant just like you became when saw the email address. I mean the scammer should have make a more formal email or office types email haha.

I never received any email from that address but I receive a lot of them daily. A person who is not aware of such things or doesn't have enough knowledge might get easily scammed through such emails because there are newbies who don't even know how to check the sender's email address to know whether it is official or not because the content of such emails are always as good as a professional email sent directly from the platform it is impersonating.

I sometimes wonder how they get our email addresses or how they know we are a member of a certain platform, and then I think that these platform sell our emails to third-party websites or services that then add our emails in a directory of emails that they sell and scammers buy those emails and randomly send emails to try their luck.

Actually, this is your second post and not the first one; you made your first post in . 2020  (https://bitcointalk.org/index.php?topic=5234566.msg54074391#msg54074391) is still about Coinbase and how to buy coins from there. 
 
Just getting email from any domain aside from the usual ones you receive mail from is a clear indication that they are scams. Without looking at it twice, you can just discard the email and put it where it belongs.
 
First, I must say you are smart enough to suspect there was something wrong with the mail. The scammer didn't even stress themselves to look for a bit of an identical domain to use, which could have made it less suspicious. 

I guess this explains how his email got leaked - I was wondering how does a newbie how’s fairly new to bitcoin gets a phishing email? But it seems like he got careless during his early days and exposed it.

Back to the Op, since you’re now aware that your email has been leaked - you should be very care about any mail you receive because it could be a phishing attack again, and if you have used this email for other service that allows you to change your email I’ll advise that you consider changing the email to a different one for more security.

No matter how good they try to replicate, when common sense kicks in it won't be difficult to realise why the platform want the crypto in their platform asks you to move out?

Probably your email got leaked in any of the data breaches that may or may not be related to coinbase so one who have the details sending their email to mass audience with the hope few of them actually try and give their money.

Thank you for all the kind replies. Actually I (plus many others) was the victim of a huge data breach a little while back from my pension provider. What concerned me about this e mail was that whoever it was seemed to have inside knowledge about the state of my account and the e mail did not go into SPAM.
But many thanks again to everyone and Nwada001 - you are v observant - I didn't realise I had posted before lol
This is what the e mail said if anyone is interested - the sense of urgency at the bottom is another giveaway:

Coinbase has been required to migrate over to self custodial wallets as of 05/06/2024. To provide some clarity on this situation, a class action lawsuit was recently filed by a serial crypto litigator on behalf of its customers alleging Coinbase sells unregistered securities and operates as an unlicensed broker/dealer. We have come to an agreement that allowing users to be in charge of their own wallets is in the best interest of both parties, and will allow Coinbase to operate as a registered broker. You will still be able to purchase crypto currency through Coinbase, but all assets must be transferred over to Coinbase Wallet.
The unique recovery phrase provided in this email is your Coinbase Identity and will hold access to your funds. Write down this recovery phrase, and keep it safe. This recovery phrase will hold access to your assets. You can import your recovery phrase on Coinbase Wallet by entering each word followed by a space.
1. able
2. struggle
3. runway
4. horse
5. limit
6. frequent
7. client
8. cash
9. hungry
10. speak
11. drastic
12. famous
mail
Step 1
Download the Coinbase Wallet on a mobile device as an app and/or download the Coinbase Wallet extension on a browser.
Import the recovery phrase by selecting the option, "I already have a wallet".
When importing the recovery phrase, enter each word followed by a space, in order from word 1 to word 12.
mail
Step 2
For each asset you own, click on "Receive" within the wallet app/extension.
Click on "Receive from Coinbase".
Click on "Add crypto with Coinbase Pay".
Transfer all your assets via Coinbase Pay.
mail
No time to wait:
We advise our users to follow through with this integration as soon as possible. We have set a deadline for our users to integrate into their own self custodial wallets by 05/19/2024. After this deadline, Coinbase will not be held accountable for any lost assets.

Such emails are easy to be detected because at a point the scammers will always leave a trace where you discover that the email is fraudulent and fake, just like in this case you discover that the email was faked because of the originating e-mail was not representing Coinbase.


As a newbie you need to be very careful on the kind of email you attend to and how you follow up with updates from various platforms, also mind where you sign up your email address because that is the way those scammers get access to the address before spamming you with possible pitching e-mails.

This is a very cheap trick from the scammers, and i am pretty sure their targets are newbies, as they are prolly the only ones that can fall victim to this scam. Seeds phrases are not pre-generated, you have to generate your seeed phrase by yourself and back it up. The scammer wanted you to enter the seed phrase they gave you into your Coinbase wallet and because they also have the seed phrase and are in control of the wallet, they'd drain any funds you send into there.

Coinbase and other exchanges have an email that have their own domains. If someone is giving you a link in different platforms or emails and instructs you to withdraw your money because of some problems, you knew it right that it was a scam attempt. Good to hear that you didn't bite the bait because it's mostly a phishing link that will ask you to login with your credentials and then, they'll be the ones to login your account and will withdraw your funds. Always verify the emails that you receive because if a gullible person reads one, it is possible that they're going to take the bait and they'll their funds easily.

A close look at the email will show that it is a scam. The easy means of checking how authentic the email is is to visit the Coinbase website and I think the email is well spelled out in the platform. This email looks like a hospital or a service provider contact. You can also check the validity of such emails by contacting the customer care of the exchange.

The bull run is also a period of increase in scams and fraud. I usually tell people that it is good to invest but it is more important to know how to keep it safe. We should always verify any information we see online before believing them.

Phishing attacks are not rare in the crypto market, especially when activity is involved with social media and crypto activities from the same sources, such as if you are following some news channels and some crypto influencers such as email are behind you. TBH when we carefully look at their strategies they play with the phycology even trapping the experienced crypto user over time.

For phishing emails I don't care much when it comes to phishing sites it is a big concern and a couple of times I just got trapped by phishing sites, because I've been actively hunting for some airdrops for a couple of months these people design same UI and trap user using their SEO optimization because mostly we click the link then check whether we are on spot or not without verifying the authentic domain, I almost got trapped 2 times in last month one was when I was claiming my airdrop tokens and secondly when in emergency tasks I didn't check the domain address and thanks god before connecting somehow my eye caught the invalid link format and I came back to my sense that its a trap, even though for security reasons in airdrop hunting I'm using different wallets still sometimes due to important airdrop we do connect our main wallet as well so I would suggest being very careful.

Phising mails are everywhere and common these days, we just have to be dealing with our problems one by one. One needs to be more wiser when making decisions, I know it's going to be challenging but everything will become ease with time. We just have to stay off from sectors we know nothing about and focused our time towards making solid stands in the system. Don't be left behind, scammers are topping up their game and they've been their very best efforts been channel towards their prey.

Never go to any links from an email unless its one you have requested yourself at that time such as when you ask to reset a password and they send you an email at that time. If you ever get an email you are not sure of, go to your web browser and visit the legit website yourself rather than using a link from the email.


The lot of us receive these emails all the time. Some will say my Binance account is closed or my paxful will be closed, I simply laugh when I read them because, I don't use any of them.

People should learn how to read and interpret the extended email headers (you have to look at the email's source text to view all email headers; if your email client can't show you all of them, ditch it). Nowadays all large and major email providers require proper DKIM and SPF setup (mostly). This makes it difficult to forge certain email headers.

A fraudulent email could be in perfect language and styling, but that shouldn't be a reason for you to click on links. The receive chain shows usually where the email came from and which mailservers passed it along. It is mostly pretty obvious that a fraudulent email doesn't come from the required email domain it pretends to come from.

Reading, analysing and interpreting the most important email headers is a skill which will benefit you not to fall on scammy email garbage. And it's a vital skill as long as email is basically broken.

I think that kind of link came from someone who knows you in person. Maybe they know you have joined cryptocurrency and you are a newbie, they wanted to try you. You could consider not telling people much about your investment.
It could also come from where you have linked your address before for a free coin or an airdrop. Ignoring such attempts is the safest thing you could do.

It is a phishing mail where the scammer pretending to be from coinbase or other websites so they can steal your funds. A person should always think that when someone asked you or when you read something where you must do something then it is a scam. As some websites say in their customer support chat that they never ask for your password or seed phrase. As what KingsDen explained that it cool be from someone who knows you and pretend to be from coinbase. Anyway, just ignore the email you received unless you are the one who requested.

What made you think so BTW? was it because they mentioned coinbase? because there's a good chance it's pretty random and they just happen to hit a bullseye with you. Scammers typically mass send scam emails to thousands of people so it's not impossible the email would be sent out to several people who happens to have an account at the platform in question.

From my experience, I happen to have gotten both kinds: phishing emails about a service I actually have an account and those where I've never touched lol but tbf, I think it's only a matter of time for everyone to experience the same.

I have even gotten some emails that state I have some balance that needs to be cleared on or before a particular date, with a link below for me to try and login.
 
Those links they send us are just a means to get the person's login details. If you make the mistake of trying to login to the exchange account, they claim to be using their own link. It's only those who are not wise enough and sometimes blinded by greed that easily fall into this guy's trap.

It is quite wise of you for you to be able to quickly understand that the email was never an original one.
Some persons could easily opt in and do what was ask and could find out later that they had been scammed. It is good we read some novel about some many ways these scammers are using to get funds from their victims. We shall never be a victim of scam but it is good we open our eyes and make sure that we don't put money in a place where we will not have to the comfort to remove it anytime. The  scammer wants you to send the fund to a particular wallet where you are not going to have access to it anymore.