Coinbase “New Device Registered” Scam – What Victims Need to Know

Phishing emails and fake security alerts have become one of the most dangerous online threats. Among the most widespread examples is the Coinbase “New Device Registered” scam, which tricks unsuspecting users into thinking their account has been compromised. The scam message looks convincing, using Coinbase branding and urgent wording to pressure recipients into calling fake support numbers. Once contact is made, scammers attempt to gain remote access to the victim’s device and steal personal information, crypto funds, or even demand gift card codes.

If you have received an email warning of a new device login on your Coinbase account, it is crucial to know how this scam works, why it is effective, and what to do if you have already interacted with the fraudsters. This article provides a detailed breakdown of the scam, how it operates, and practical steps to stay safe.

Scam Overview

The Coinbase “New Device Registered” scam is part of a broader wave of phishing and tech support frauds. It preys on the fear of unauthorized access to valuable financial accounts, such as those linked to cryptocurrency. The fraudulent message typically mimics Coinbase’s branding, subject lines, and language style to make it appear authentic.

The scam email often carries subject lines like:

• “New Login Detected – Spain (Madrid)”
• “Coinbase Security Alert: Unrecognized Device”
• “Your Account May Be Compromised”

Inside the message, the structure is simple but effective. It warns the user that a new device has signed in to their Coinbase account from an unusual location. In most cases, the location is set to a foreign country, such as Madrid, Spain, to trigger alarm. The message goes on to list details like:

• Location of the suspicious login
• Browser used (e.g., Safari, Chrome, Firefox)
• Device type (MacOS, Windows, iPhone, Android)

At the bottom, the email urges the recipient to call a customer support number immediately if they did not authorize the login. This is the key to the scam. The phone number does not lead to Coinbase support. Instead, it connects directly to scam call centers posing as Coinbase security representatives.

Why the Scam Looks Convincing

Several elements make this scam particularly dangerous:

1. Use of Fear and Urgency
   By claiming someone has logged in from another country, the scammers create panic. Users are more likely to act impulsively to “secure” their accounts.
2. Professional Design
   The email often mimics Coinbase’s logos, fonts, and formatting. To an untrained eye, it looks legitimate.
3. Technical Details
   The inclusion of specific details like browser and operating system makes the message feel personalized and authentic.
4. Direct Call-to-Action
   Instead of asking users to click on a suspicious link (a common phishing tactic), the scammers direct them to a phone number. This adds a false sense of legitimacy, since many users trust phone calls more than links.

The Role of Fake Support Numbers

The most dangerous part of this scam is the phone number provided. When victims call, they are greeted by professional-sounding “support agents” who use scripts to gain trust. These agents often claim:

• Your Coinbase account is under attack.
• Hackers have gained remote access to your funds.
• Immediate action is required to secure your assets.

From here, the fraud escalates. The scammers push victims to download remote access tools like Anydesk, TeamViewer, or LogMeIn, claiming they need to “secure” the account. Once connected, they can monitor activity, steal sensitive information, and manipulate crypto wallets.

Potential Consequences for Victims

Falling for the Coinbase “New Device Registered” scam can result in:

• Stolen cryptocurrency from wallets or exchanges.
• Loss of banking information, if scammers gain access to online banking.
• Identity theft, by harvesting personal documents, passwords, and emails.
• Gift card scams, where victims are instructed to buy gift cards and provide codes.

The scam is highly dangerous because it combines phishing, tech support fraud, and social engineering into one.

How the Scam Works

To understand the full danger of the Coinbase “New Device Registered” scam, it is important to break down the process step by step. Scammers follow a deliberate path designed to confuse, frighten, and ultimately rob their targets.

Step 1: The Fake Security Email or texts

The scam begins with a fraudulent email or text. The subject line typically references a suspicious login to the victim’s Coinbase account. The message is crafted to resemble an official Coinbase security alert.

Example details include:

• Location: Madrid, Spain (or other foreign location)
• Browser: Safari or Chrome
• Device: MacOS, Windows, iPhone

This information is fake but is chosen carefully to sound realistic.

Example:

Subject: New Login Detected – Spain (Madrid)

coinbase

New Device Registered

A sign in to your Coinbase account was detected from an unusual location that does not match your typical usage pattern.

Location: Madrid, Madrid, Spain

Browser: Safari

Device: MacOS

If this wasn’t you, contact our Support team right away.

Customer Support Line
+1 (888) 419 3004

Step 2: Emotional Manipulation

The recipient, upon reading the message, is made to feel panic. Cryptocurrency accounts often hold significant funds, and the fear of unauthorized access drives immediate action. Scammers exploit this emotional response.

Step 3: Urgent Call-to-Action

The email provides a customer support line and urges the victim to call if they did not authorize the login. Unlike typical phishing that relies on malicious links, this scam uses voice phishing (vishing). This tactic is harder to detect because many users believe calling a phone number is safer than clicking on a link.

Step 4: Fake Support Agents

When the victim calls, they are connected to scam call centers. These scammers are trained to sound professional, polite, and authoritative. They often introduce themselves as “Coinbase Security Specialist” or “Coinbase Account Protection Team.”

The scammer will:

• Confirm the victim’s name and email (information often guessed or extracted from the call).
• Reassure them that the problem can be fixed.
• Claim hackers are actively trying to steal their funds.

Step 5: Remote Access Setup

The scammer tells the victim that Coinbase requires remote assistance to secure the account. They instruct the victim to install remote desktop applications like:

• Anydesk
• TeamViewer
• LogMeIn
• Zoho Assist

These tools allow scammers full access to the victim’s device. They can then navigate files, log into wallets, and even monitor keystrokes.

Step 6: Fake Security Procedures

Once connected, the scammer pretends to perform a security check. They may:

• Open the Coinbase website and simulate activity.
• Create a fake “secure wallet” where they urge the victim to transfer their crypto.
• Display fake error messages that suggest the account is compromised.

In reality, all these steps are designed to move funds into scam-controlled accounts.

Step 7: Demands for Gift Cards

If the victim resists giving up crypto access, the scammer may pivot. They claim a temporary security fee must be paid to protect the account. They instruct the victim to purchase gift cards (Google Play, Amazon, Apple) and provide the codes. These gift cards are then resold or used by the scammers.

Step 8: Extraction of Personal Data

Beyond cryptocurrency theft, scammers also harvest personal information, including:

• Bank login credentials.
• Email account details.
• Passwords stored on the device.
• Private crypto wallet seed phrases.

This information allows them to commit identity theft, access other accounts, and launch future scams.

Step 9: Continued Harassment

Victims who comply may find scammers continue to call, email, or message them, demanding further payments. In some cases, victims are blackmailed with threats of account closure or stolen data exposure.

Step 10: Victim Realizes the Fraud

Often, the scam is only recognized once funds are stolen or the victim attempts to verify the incident with Coinbase directly. Unfortunately, at this stage, recovering lost assets is extremely difficult.

What to Do if You Have Fallen Victim to the Scam

If you have already interacted with the Coinbase “New Device Registered” scam, immediate action is required. Here is a step-by-step guide to minimize damage:

1. Disconnect Remote Access Software

If you installed Anydesk, TeamViewer, or similar software, disconnect immediately. Uninstall the program from your device and restart your computer.

2. Secure Your Coinbase Account

• Change your Coinbase password immediately.
• Enable two-factor authentication (2FA) if not already active.
• Review recent account activity and revoke any suspicious sessions.

3. Report to Coinbase

Log in to Coinbase only through the official website or mobile app. Contact Coinbase Support through their official help center, not through any phone numbers received via email.

4. Scan Your Device

Run a full system antivirus and anti-malware scan. Scammers may have installed malicious software to continue spying on your activities.

5. Change All Passwords

Update passwords for:

• Email accounts
• Banking accounts
• Any platform linked to your Coinbase account

Use unique, strong passwords for each account.

6. Check for Financial Loss

• Review your crypto wallets for unauthorized transfers.
• Check your bank and credit card statements.
• Monitor for unfamiliar charges or withdrawals.

7. Contact Your Bank

If you provided banking details, notify your financial institution immediately. Request to freeze or monitor accounts for suspicious activity.

8. Report the Scam

• File a report with your local law enforcement.
• Report the fraud to the Federal Trade Commission (FTC) if you are in the U.S.
• Forward the scam email to reportphishing@coinbase.com.

9. Protect Against Identity Theft

If scammers accessed personal information, consider placing a fraud alert on your credit file and monitoring for identity theft.

10. Educate Yourself for the Future

Review common scam tactics and learn how to verify communications. Remember: Coinbase does not provide support via phone numbers in unsolicited emails.

Is Your Device Infected? Run a Free Malware Scan

Slow performance, constant pop-ups, or strange behavior? These are classic signs of a malware infection. The fastest way to find out is to scan your device with Malwarebytes Free — one of the most trusted malware removal tools available.

The free version detects and removes the most common threats, including:

• Adware — the cause of those annoying pop-ups
• Browser hijackers — unwanted redirects and changed homepages
• Trojans and spyware — hidden programs stealing your data
• Potentially unwanted programs (PUPs) — software you never asked for

👉 Select your device below — Windows, Mac, or Android — then follow the simple steps to download Malwarebytes, scan your system, and remove any threats it finds. The scan usually takes 5 to 20 minutes.

Stay Protected: Block Ads and Malicious Sites

Now that your device is clean, keep it that way. Most infections start with a malicious ad or a fake download button — so blocking them at the source is your best defense.

We recommend AdGuard, which blocks malicious ads, phishing pages, and dangerous redirects before they can reach you.

👉 Download AdGuard and browse safely

The Bottom Line

The Coinbase “New Device Registered” scam is a dangerous form of phishing and tech support fraud. It manipulates users into believing their account is compromised, then directs them to fake support centers where scammers attempt to steal funds, personal data, and even gift card codes.

Understanding how the scam works is the best defense. If you receive a suspicious email, never call the number provided or download remote access tools. Instead, verify directly with Coinbase through official channels.

Crypto accounts hold valuable assets, and scammers know how to exploit fear to get what they want. Stay vigilant, stay informed, and always double-check before acting on urgent security messages.

Frequently Asked Questions About the Coinbase “New Device Registered” Scam

What is the Coinbase “New Device Registered” scam?

The Coinbase “New Device Registered” scam is a phishing and tech support scam where fraudsters send fake security alerts that appear to come from Coinbase. The email claims that a new device has logged into your account from an unusual location, such as Madrid, Spain. It lists details like the browser and operating system used, making the alert look convincing.

The message then urges you to call a customer support number. However, the number connects to fake tech support centers run by scammers. These fake agents attempt to gain remote access to your computer or mobile device, steal cryptocurrency from your wallets, harvest banking information, or trick you into buying gift cards and sharing the codes.

How can I recognize the Coinbase “New Device Registered” scam email?

Several red flags can help you spot this scam:

1. Suspicious sender email address – Often the sender is not from an official Coinbase domain but from random addresses like @hugtaproom.jp.
2. Urgent warnings – The email pressures you with claims that someone logged into your account from a foreign location.
3. Phone number provided – Coinbase does not use unsolicited phone numbers in emails. If you see one, it is a scam.
4. Generic greetings – Instead of addressing you by your registered name, the email may start with “Dear Customer” or no greeting at all.
5. Poor grammar or formatting – Many of these scams contain minor mistakes in wording or layout.

Does Coinbase send emails about new device logins?

Yes, Coinbase does send security alerts when a new device or location accesses your account. However, legitimate emails:

• Come from an official Coinbase domain (such as @coinbase.com).
• Do not include phone numbers to call for support.
• Direct you to the official Coinbase app or website to review account activity.

If you are unsure, log in to Coinbase directly using the app or by typing www.coinbase.com into your browser. Never click links or call numbers in suspicious emails.

What happens if I call the number in the scam email?

If you call the number, you will reach scammers posing as Coinbase support agents. They will:

• Pretend your account is under attack.
• Convince you to download remote access software like Anydesk or TeamViewer.
• Request your login details, recovery phrases, or banking information.
• In some cases, ask you to transfer funds to a “secure wallet” that they control.
• Demand that you purchase gift cards and share the codes as a “security measure.”

Calling the number can quickly lead to stolen funds and identity theft.

What should I do if I already gave scammers remote access?

If you installed remote access software and allowed scammers to connect to your device, take these steps immediately:

1. Disconnect from the internet and turn off your device.
2. Uninstall any remote access applications you were instructed to install.
3. Run a full antivirus and anti-malware scan to detect and remove hidden software.
4. Change your Coinbase password and enable two-factor authentication (2FA).
5. Update your email, bank, and crypto wallet passwords to prevent further misuse.
6. Contact your bank and credit card provider to alert them of possible fraud.
7. Report the scam to Coinbase, the Federal Trade Commission (FTC), and your local authorities.

Can scammers steal my cryptocurrency without my seed phrase?

Yes. Even without your seed phrase, scammers can steal your cryptocurrency if they:

• Gain remote access to your device and log in to your exchange account.
• Trick you into transferring funds to a fake “secure wallet.”
• Obtain your login details or intercept your two-factor authentication codes.

Your seed phrase is the master key to your wallet, but other forms of access (such as your exchange login) are also valuable to scammers.

What if I already sent gift card codes to the scammers?

Unfortunately, once you provide gift card codes, they are usually redeemed instantly and cannot be recovered. You should:

• Keep records of the transaction, including receipts and communications.
• Report the fraud to the gift card issuer (Google Play, Amazon, Apple, etc.) to see if the balance is unused and can be frozen.
• File a police report and report the scam to the FTC or your local cybercrime authority.

How can I protect myself from the Coinbase “New Device Registered” scam?

Here are key prevention steps:

• Never call phone numbers listed in unsolicited emails.
• Verify all Coinbase alerts by logging into the app or official website.
• Use two-factor authentication (2FA) on your Coinbase account.
• Install reputable antivirus and anti-phishing protection on your devices.
• Educate yourself about common crypto scams, including phishing, tech support scams, and recovery scams.

Will Coinbase ever ask me to install remote access software?

No. Coinbase will never:

• Ask you to install remote access programs.
• Request your seed phrase through email or phone.
• Ask you to transfer funds to a different wallet for “security reasons.”
• Demand payment in the form of gift cards.

If anyone claiming to be from Coinbase asks you to do these things, it is a scam.