CNBC’s vice president of news details how hackers tried to steal his Coinbase account

Last week, Jason Gewirtz, the vice president of news at CNBC, received a phone call that nearly led to his Coinbase account being taken over. The call came around 1:30 p.m. His iPhone showed a 650 area code linked to San Francisco Bay.

According to Jason, he answered the call, and the man on the line introduced himself as Brian Miller from Coinbase security and immediately claimed there was “suspicious activity” on Jason’s account. He asked if Jason was trying to log in from Frankfurt, Germany, using an iPhone.

Jason replied, “No, I haven’t been in Germany in 20 years, and I never use my cell phone to log into my Coinbase account.” The allegedly said someone using the email address “Mohamad25@gmail.com” was inside the account and had already tried to make a transfer.

Scammer escalates pressure with personal data and fake activity

Brian told Jason that the person claimed they lost their phone on a conveyor belt at the Frankfurt airport and needed access. He paused, then said another transfer attempt was happening in real time. He added that the attacker had Jason’s Social Security number, phone number, and email address.

Brian also claimed the attacker submitted a photo that matched Jason’s Coinbase face scan. Jason responded, “I never gave Coinbase my photo.”

Brian pushed back. He said Jason would have had to submit a photo to open the account due to know-your-customer rules. He then claimed the account was on hold and another transfer was blocked. Jason asked for proof that the call was real. Brian said an email with a case number had already been sent.

One message came from “no-reply@mail-coinbase.com via sportuel.com.” The other came from “support@info.coinbase via live-coinbase.com.” The addresses were different. Brian’s name was not on either message.

Brian then asked when Jason last used Coinbase, and Jason replied, “Shouldn’t you know that?”

According to Jason, Brian then said confidentiality rules prevented him from seeing balances. Jason gave a wide range and felt uneasy.

Fake support pushes hard wallet and blocks password changes

Brian told Jason he needed a “Coinbase Hard Wallet.” Jason said he did not know what that was. Brian offered to help him set it up. Jason asked if he should change his Gmail password. Brian said that was probably a good idea. Jason then asked if he should change his Coinbase password.

Brian hesitated. He said it was not recommended. He claimed changing the password would freeze the account for up to two weeks.

Jason said he had a meeting in five minutes and asked how long the wallet setup would take. Brian said 20 minutes. Jason said he had to go but suggested talking again at 3 p.m. Brian agreed to call back.

Jason said:-

Jason contacted a former Coinbase public relations employee. She told him she no longer worked there but said it was likely a scam. She added that Coinbase does not call customers. She forwarded the details to the current team. Within minutes, Jason received a real call and text from Coinbase confirming the attempt was fraudulent.

Coinbase and recovery firms warn about AI-driven scams

Jason told the Coinbase representative he would write up the entire 15-minute call so the company could warn others. He then decided it could also run as a news article.

Coinbase agreed. A spokesperson said the company monitors accounts for unusual behavior, including large transfers or sudden sales from accounts that rarely move funds.

The spokesperson said, “We invest heavily in prevention, detection, and rapid response.” They also said Coinbase would never instruct customers to move crypto into a safe wallet. “If someone tells you to move funds to protect them, it’s a scam,” the spokesperson said.

The company also acknowledged that artificial intelligence is making scams harder to detect. It said attackers use bots and AI voice tools to create believable calls.

ZeroShadow, a firm that helps recover stolen crypto, reported a 1,400% increase in impersonation scams over the past year. Casey G., the company’s CEO, said attackers operate both inside and outside the United States. He said they often recruit young men or teenagers and train them using scripts and voice modulation devices.

ZeroShadow said it has recovered about $200 million for victims over the past four years. Casey said tracing stolen crypto is possible, but recovery often requires help from local authorities and remains difficult.

Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.