Fake Coinbase or Binance Support? How to Spot and Recover from Exchange Impersonation Scams
Last reviewed Sep 8, 2026 · Reviewed by our CEH-certified investigation team
A different kind of exchange scam
This is different from a fake trading platform that never existed, and different from a withdrawal-fee scam on a real account you control. Here, the exchange is real — Coinbase, Binance, Kraken, whichever you actually use — and the scammer's entire method is convincing you they work there.
Chainalysis's 2026 crime report found impersonation scams grew more than 1,400% year over year, part of roughly $17 billion in global crypto fraud losses in 2025, with the average payment into impersonation-specific scam clusters rising over 600% (CoinDesk). AI tooling has made the operations behind this dramatically more effective too — AI-enabled scam operations extract an average of $3.2 million per operation, versus $719,000 for scams without it (CoinDesk).
A federal case from December 2025 shows how convincing this has become: prosecutors in Brooklyn indicted a 23-year-old for allegedly impersonating Coinbase customer support and stealing approximately $16 million from users. Separately, a former Coinbase customer-service representative based in India was arrested for allegedly accepting $250,000 in bribes to supply stolen customer data — the exact detail that made the impersonation calls convincing enough to work (BleepingComputer).
How the call or message actually works
It typically opens with a message or call warning of "suspicious activity" or an urgent security issue on your account — sometimes referencing real account details, which is exactly what makes it credible. From there, the scammer either walks you through moving your funds to a "safe" or "verification" wallet they control, or requests remote access to your screen to "help resolve" the issue directly. Both paths end the same way: your funds leave your real account and go straight to the scammer, using your own login and your own confidence that you were speaking with real support.
- Any instruction to move funds to a new or "safe" wallet to resolve a security issue — real support never asks for this
- A request for remote screen-access software to "walk you through" a fix
- Contact that started with them calling or messaging you, rather than you initiating contact through the exchange's own official app or site
- Urgency about a supposed hack or freeze that will only be resolved if you act within minutes
- A request for your two-factor authentication code, seed phrase, or password over the phone or in chat
What a recovery investigation looks like
Because your login was real, this traces the same way any other crypto theft does from the point the funds leave your account: identify the receiving wallet, follow it across any further hops, and find where it lands at a compliant exchange that can act on a documented freeze request. See our guide on getting a crypto exchange to freeze scammer funds for exactly what that request needs to include, and our step-by-step recovery guide for the full timeline from report to resolution.
Frequently asked questions
How did the scammer know details about my real account?+
In some documented cases, impersonation rings have obtained real customer data through insiders — including a case where a former exchange customer-service employee was arrested for allegedly selling stolen customer data used to make the impersonation convincing. It's also common for scammers to work from data leaked in unrelated breaches, or to simply guess based on public information.
Is it ever legitimate for exchange support to ask me to move funds to a new wallet?+
No — real exchange support never asks you to transfer funds to a "safe" or "verification" wallet as part of resolving an account issue. That instruction is the scam itself, not a legitimate security step, regardless of how official the caller sounds.
I gave a scammer remote access to my screen — what now?+
Disconnect immediately, change your exchange and email passwords from a different, secure device, enable two-factor authentication if it isn't already on, and treat any account or wallet that was visible during that session as compromised.
Can the exchange itself get my funds back?+
It depends entirely on where the funds went. If they reached another account at a compliant exchange before being cashed out, a well-documented freeze request can sometimes succeed — see our guide on getting an exchange to freeze funds for what that process requires.
Talked to "support" and lost funds?
CoinTrace Pro offers a free, no-obligation case review. Our investigators respond the same day or next business day.
Sources for statistics cited above: Chainalysis 2026 crime report coverage, CoinDesk; BleepingComputer.