Coinbase slammed for what customers say is horrible customer support after hackers drain their accounts

For Tanja Vidovic, it was a second of panic: She had obtained a sequence of alerts about somebody altering entry to her cryptocurrency account. And she or he realized, as she stared at her laptop display screen, that almost all of her $168,000 in holdings was gone — vanished earlier than her eyes.

She was shocked.

Practically 4 months have handed, and it has but to sink in, she mentioned.  

Tanja and Jared Vidovic jumped into cryptocurrency investing in 2017 and watched their funds practically quadruple over 4 years.

The Vidovics used Coinbase, the nation’s largest cryptocurrency trade, for his or her plunge into the digital foreign money. On exchanges resembling Coinbase, customers can deposit U.S. {dollars} and commerce them for cryptocurrencies, resembling bitcoin and ethereum, which the couple bought.

“I appeared into Coinbase, and it appeared prefer it was one that everyone used and trusted,” Tanja mentioned.

The rising funding was a welcome boon for the Security Harbor, Florida, couple and their three kids. However in late April, Tanja, a firefighter, opened her laptop to a barrage of safety alerts and password change notifications.

“I signed onto the crypto. And I mentioned, ‘It is gone,'” Tanja mentioned.

The Vidovics mentioned they tried to contact Coinbase however they could not get anyone on the cellphone.

Interviews with Coinbase clients across the nation and a evaluation of hundreds of complaints reveal a sample of account takeovers, the place customers see cash instantly vanish from their account, adopted by poor customer support from Coinbase that made these customers really feel left hanging and offended.

Making the difficulty even worse, cryptocurrency transactions can’t be reversed, in response to the FBI. Consultants say as soon as criminals entry an account, funds may be drained in minutes.

Coinbase, which went public in April, has a market cap of about $65 billion, has greater than 68 million customers in 100-plus international locations, greater than 2,100 full-time workers and $223 billion in held property, in response to the corporate.

“Hopefully, Coinbase going public and having its direct itemizing goes to be considered as type of a landmark second for the crypto house,” CEO Brian Armstrong instructed CNBC in April, when the corporate went public. “Folks not should be fearful of it like within the early days.”

Whereas the cryptocurrency trade firm has grown quickly, complaints have continued to come up. Since 2016, Coinbase customers have filed greater than 11,000 complaints in opposition to Coinbase with the Federal Commerce Fee and Client Monetary Safety Bureau, largely associated to customer support.

Former workers instructed CNBC the corporate’s customer support practices shifted over time, with representatives struggling to maintain up with demand.

The Vidovics’ account had risen to $168,596 on April 28 when the hacking occurred, in response to account statements the Vidovics shared with CNBC. That quantity was basically worn out, with solely a $587.15 steadiness proven the following day.

Just like the Vidovics, Ben, a Virginia resident who requested that his final identify be withheld, mentioned he noticed hundreds of {dollars} vanish. He logged onto his Coinbase app in March, verifying his identification with two-factor authentication, however over a four-minute stretch virtually $35,000 in varied cash disappeared from his account, he mentioned.

In a response to his frantic e mail, Coinbase instructed Ben his laptop had been hacked and there wasn’t something the corporate may do.

“I actually am baffled,” he mentioned. “It simply appears to me that Coinbase did completely zero analysis and simply mentioned, ‘Hey, yeah, sorry.'”

The CFPB responded to one in every of Ben’s ensuing complaints with a solution from Coinbase’s Regulatory Response Staff. The e-mail famous that transactions on the blockchain are irrevocable and mentioned Coinbase’s insurance coverage coverage doesn’t cowl theft from particular person accounts.

“There is no such thing as a credible or supportable proof that the compromise of your login credentials was the fault of Coinbase,” the message mentioned. “Because of this, Coinbase is unable to reimburse you to your alleged losses.”

Ultimately, the corporate despatched a $200 credit score, telling Ben, “your Coinbase expertise and your watch for a response to your formal criticism was lower than our requirements.”

Consultants say SIM swapping, the place fraudsters seize management of a sufferer’s cellphone quantity and SIM card by their cellphone firm, is accountable for lots of the cryptocurrency thefts.

“The issue with SIM swapping and cryptocurrency is the second you lose entry to your cellular phone, skilled hackers will steal your whole cash in lower than 30 minutes,” mentioned David Silver, an legal professional who focuses on cryptocurrency.

Silver, whose agency represents the Vidovics, mentioned the highest complaints from potential purchasers are getting locked out of their cryptocurrency trade platform account and SIM swaps.

“Most individuals who contact me would let you know it is poor customer support,” Silver mentioned. “They’re being virtually victimized twice. As a result of they themselves have virtually no potential to contact Coinbase and take care of them instantly, they’re pressured to retain professionals.”

Etay Maor, senior director of safety technique for cybersecurity firm Cato Networks, mentioned he is seen cybercriminals on the darkish net discussing the right way to break into accounts, together with these of Coinbase customers.

As soon as hackers break into Coinbase accounts, they put them up on the market on the darkish net, in response to Maor. He mentioned whereas bank cards promote for just a few {dollars}, hacked Coinbase accounts can promote for $100 to $150.

“These exchanges have to speculate closely, spend money on safety in the event that they need to take it significantly, identical to the banks have completed and have discovered the onerous means,” Maor mentioned.

Account takeovers are on regulation enforcement’s radar.

“When the attacker withdraws these funds from the trade, that is not a transaction that you may take again,” Ali Comolli, a administration and program analyst on the FBI, instructed CNBC.

Comolli mentioned the FBI tries to assist victims of account takeovers recuperate their stolen cash.

“It is clearly a huge effect on the victims, which is extremely tough for them,” Comolli mentioned.

After a evaluation of Coinbase’s complaints, the Higher Enterprise Bureau in March decided the corporate has a “sample of complaints from clients who state they’re locked out of their accounts, even after offering required info or updates.” The group has obtained 1,128 complaints previously three years, in response to its web site.

BBB mentioned it despatched a letter to Coinbase with the intention to handle the purchasers’ complaints and obtain suggestions from any applied enhancements.

The group has “not heard a response from this enterprise, concerning the state of affairs, sample of complaints for the final three years,” Alma Galvan, a advertising and marketing and communication supervisor with the group, mentioned in an e mail to CNBC.

Some clients with misplaced funds flip to social media to hunt assist from Coinbase or discover group with different disgruntled customers. Members of a 941-person Fb group known as “Coinbase Corruption/Scandal Consciousness Group” replace the web page with their struggles to recoup cash and accounts.

One poster referred to the group as a “unhappy social gathering,” and a number of other have brainstormed new locations to report their complaints and new strategies to stress Coinbase into making them complete.

Complaints abound on Reddit and Twitter as nicely, the place the corporate’s assist accounts usually publicly reply to the messages, typically writing that they’ve “escalated” the difficulty to an applicable group.

The Coinbase Help account on Twitter additionally posts stay updates about modifications and short-term errors on the trade platform.

As the corporate has scaled into its large measurement, customer support practices have modified, former Coinbase workers instructed CNBC.

In Coinbase’s early years, workers spoke with clients by a stay assist chat.

Jason Rose, who labored part-time in customer support at Coinbase from 2014 till 2016, mentioned many shoppers requested for reassurance about cryptocurrency.

“They want that contact of someone being there whereas they are going by this advanced transaction,” he mentioned.

When Rose labored at Coinbase, he mentioned stay chat acted as a type of “launch valve” for complaints, notably useful in moments of crypto volatility.

As the corporate grew, Rose mentioned, his position modified. Coinbase began a repository of solutions to steadily requested questions with the intention to automate its customer support.

Rose mentioned when he left in 2016 Coinbase was beginning to part out stay chat.

“The choice to try this was disastrous as a result of the time that it took to reply again to emails took quite a bit longer than it will for a stay chat. So, we went again to the e-mail field, taking 5 days to finish an issue that would have been solved in a couple of minutes,” he mentioned.

Jacques Reulet additionally fielded buyer points and mentioned it was onerous to maintain up.

“We have been very diligent about ensuring that everybody who wrote in obtained a response, however issues have been getting slightly unresponsive in direction of the top [of my time there],” mentioned Reulet, who labored in operations and compliance at Coinbase from 2014 to 2015. “The sheer scale at which the corporate was rising was quite a bit to deal with. I did not see that we have been maintaining.”

On Jan. 15, Coinbase acknowledged that many new and current clients are experiencing delays of their response time.

“We acknowledge that is irritating. This isn’t the expertise we would like for you, our clients,” mentioned Casper Sorensen, vice chairman of buyer expertise, in a weblog submit.

A July weblog submit introduced the corporate’s intent to roll out stay chat messaging and cellphone assist this yr, in addition to to broaden its buyer assist group.

The customer support subject additionally got here up on an earnings name earlier this month.

“So proud to report that we’re doing a lot better [with customer service], however there’s at all times extra to do,” mentioned CEO Armstrong. “We have elevated the headcount 5 instances or so since January, starting of this yr, engaged on assist particularly.”

Coinbase, which declined repeated requests from CNBC for an on-camera interview, as a substitute mentioned in an e mail, “Over time, we have persistently up to date our buyer assist choices to assist us scale. In early 2020, we moved to e mail as our main channel of assist. A lot of our buyer inquiries require our brokers to conduct a big quantity of analysis to resolve the difficulty. And, to keep away from lengthy wait instances, speaking asynchronously by way of e mail was the popular methodology. Nonetheless, we acknowledge that clients need real-time assist, and that is why we’re rolling out cellphone assist for ATOs this month and stay messaging for all clients later this yr.”

Requested concerning the variety of customer support complaints, the corporate mentioned: “Over the previous a number of years, our buyer base grew exponentially. We grew from 43+ million customers on the finish of 2020 to 68+ million registered customers, as of June 30, 2021. By all this progress, a few of our clients sadly skilled challenges and delays reaching our assist group, which resulted in a detrimental affect for a few of our clients. Bettering our buyer expertise stays a high precedence for Coinbase.”

The corporate wouldn’t disclose what number of clients’ accounts have been taken over by fraudsters or the full quantity it has refunded clients because of hacks.

It added that since clients have a two-factor authentication, on the minimal, to entry their accounts, solely “a small quantity (lower than .01%) of our clients have been impacted by account takeovers.”

Marci Preble, a California-based marketer, mentioned Coinbase did credit score her account the approximate quantity of her authentic funding. However she mentioned that was after months of a nightmare of what appeared like countless emails.

Preble had saved sufficient cash to make the leap into bitcoin and ethereum earlier this yr, investing about $8,000. By April, her funding had grown to $12,000.

However in the future that month, when she was making an attempt to purchase extra crypto, it began disappearing, she mentioned.

“In entrance of my eyes, it went to $800,” she mentioned. Suspected fraudsters have been capable of one way or the other achieve entry to her account.

To this present day, she mentioned she nonetheless has no thought how they did it.

“Horrifying. And all I feel may assume is, ‘Wow, should not there be a greater firewall?'”

Just like the Vidovics, Preble mentioned she by no means spoke to a human — simply e mail after e mail.

Then, instantly in August, she regained entry to her account. There was simply $502 left in it.

However to her shock, the following day, she obtained an e mail from the corporate informing her that it had transferred $6,583 in ALGO coin.

“My query is how can a publicly traded firm on the New York Inventory Trade be doing this to clients? How can they not have a customer support devoted line worldwide?” Preble mentioned.

Tanja and Jared Vidovic mentioned they haven’t been capable of recuperate their stolen funds.

After CNBC inquired about what occurred to the couple, Coinbase despatched Tanja an e mail on Aug. 20 that mentioned the corporate “doesn’t have the power to reverse crypto transfers despatched off our platform. Not like conventional banks or bank card firms, as soon as crypto foreign money transfers are confirmed on the blockchain, they’re everlasting.”

“As a result of this assault was not the results of a breach of Coinbase safety or our methods, we can’t reimburse you for this loss. This assault was solely attainable as a result of the attacker had prior entry to your e mail account and entry to your 2-factor authentication codes (which means that they had entry to your cellphone quantity by a SIM swap) earlier than they tried to entry your Coinbase account,” the e-mail mentioned. 

Jared, a nurse, mentioned he knew a hack was attainable. “However you do not assume it’ll occur to you. You assume that so long as you are cautious along with your password, you do not have a virus in your laptop.”

In the event you assume you’re the sufferer of an account takeover, the FBI asks that you just report it to your native FBI workplace or the Web Crime Criticism Heart at IC3.gov.

Please e mail tricks to [email protected].