LOS ANGELES – After thousands of customer service complaints, Coinbase started a new live phone support line. But numerous customers remain frustrated with the company after its latest effort to address their concerns.
Take Erick and Molly Richardson, for example.
The text message on Erick’s phone alarmed him so much that he pulled over to the side of the road. It was a sunny afternoon in July.
The retired attorney clicked on the message which said someone had logged into his account. He logged on, and soon got an email that his two-factor authentication had been changed, meaning his security settings had likely been compromised.
Then the nightmare got worse.
He and his wife, Molly, had saved nearly $1.1 million in cryptocurrencies. Suddenly, a fraudster started withdrawing all their bitcoin investments, about $700,000, as Erick watched. And there was nothing he could do.
“I was panicked. It was that feeling I haven’t had in a long time,” Erick said, acknowledging the text message was likely a phishing attack to obtain his account information.
Coinbase customers Erick and Molly Richardson lost about $700,000 in cryptocurrencies when their account was taken over by a fraudster.
Source: CNBC
The Richardsons could not call Coinbase for help because when the account takeover happened in July, the company only offered email support. A CNBC investigation in August found thousands of customers’ accounts were hacked and they were left hanging by the company, according to government records and interviews. Coinbase, which went public in April, has a market cap of more than $50 billion.
Since 2016, users have filed more than 12,000 complaints against Coinbase with the Federal Trade Commission, Consumer Financial Protection Bureau and the Better Business Bureau, mostly related to customer service, according to public records. An additional 1,500 complaints have been filed since August.
Other cryptocurrency exchanges have faced similar complaints, but less numerous than the complaints for Coinbase, which is the largest exchange in the U.S.
Coinbase, responding to criticism that customers couldn’t talk to anyone at the company, set up the live support line in August. However, dozens of customers whose accounts were hacked and drained told CNBC the so-called help didn’t result in their problem getting resolved.
In the Richardsons’ case, Erick said it took only about 20 minutes for the fraudsters to withdraw 21 Bitcoin in 110 different transactions.
Erick reported the theft to Coinbase, which locked the account. But he said for more than two months, no one reached out to help the couple get their money back or unlock the account.
“I still have no idea how it happened,” he said.
In September, the Richardsons called the new Coinbase phone support line. The agent told Erick that he didn’t have access to the case file and suggested he respond to the last email from Coinbase, which he had already answered. The 10-minute call ended not with a resolution, but with more frustration.
“It was a joke; it just makes me a little more angry. And there’s nobody who has any decision-making power at customer service,” Erick said. “They just can’t help out a lot. You know what Coinbase did two days after I got hacked? They sent me a customer survey and they asked me to rate their service.”
Coinbase customers around the country told similar stories to CNBC since the live phone support began.
For example, customer Marc Boulos said in an email that “the live support is only for accounts that are actively locked; since my account is no longer locked, I can’t even reach live support even if I try to do so.”
“The system recognizes that the account associated with my phone number is not locked and doesn’t let me reach live support,” Boulos wrote.
Another customer, Don Pirtle, called the phone line “a joke.”
And after unsuccessfully trying to restore access to his account, customer Conrad Yiu said, “It seems like they’ve failed in every single part.”
A Coinbase spokesperson said in a statement that the company will deliver “global phone support for all customers, and live messaging by end of year. Our goal is to be the most trusted and easy to use platform in the crypto economy, but we recognize the challenges some of our customers have experienced with their Coinbase accounts. Improving our customer experience continues to remain a top priority.”
“In most cases, Coinbase does not cover any losses resulting from unauthorized access to Coinbase accounts due to a breach,” which is often a phishing attack, the statement said.
Earlier this month, in a note to Coinbase customers, the company disclosed that funds were stolen from about 6,000 customers in a phishing attack that took place from March to May 20. The hackers took “advantage of a flaw in Coinbase’s SMS Account Recovery process in order to receive an SMS two-factor authentication token and gain access to your account.”
A company spokesperson said: “We immediately fixed the flaw and have worked with these customers to regain control of their accounts and reimburse them for the funds they lost. These large-scale, sophisticated phishing attacks are on the rise, and we strongly recommend anyone that uses online financial services to remain vigilant and take the necessary steps to protect their online identity.”
Asked about the security of Coinbase accounts, the spokesperson said, “While some Coinbase customers unfortunately have fallen victim to phishing attacks and account takeovers, at no point have attackers breached Coinbase’s security infrastructure.”
Experts say there are alternative ways to store cryptocurrency that are essentially hack-proof.
A move that would have helped protect the Richardsons and others is moving cryptocurrency from an exchange, like Coinbase, to what is known as cold storage, or moving crypto offline.
“I’ve beaten myself up every day because I have my friends’ voices in my head. ‘Erick, put it on cold storage.’ And I just didn’t,” Erick said.
Nicole DeCicco, who helps clients secure their cryptocurrency through her company CryptoConsultz, says cold storage is virtually hack-proof. Crypto owners get a private key, which is like a password, to store that key offline.
“A cold storage or a cold wallet is completely disconnected from the internet. It is sometimes a device that you connect to your computer,” she said. “When you keep your funds in cold storage, you own those funds. … They’re offline, away from hackers.”
Nicole DeCicco helps clients secure their cryptocurrency through her company CryptoConsultz.
Source: CNBC
“I like to tell my clients that just like you might pull money out with your ATM card, you can always load from your cold storage wallet into a hot wallet. But if we’re talking a significant amount of money, really the best practice is to keep it in cold storage,” she said.
DeCicco said setting up exchange accounts is easy but setting up cold storage takes more work. To set up cold storage, many investors buy a device for this purpose. It then needs to be loaded with a private key and safely stored, such as in a vault.
While cold storage is more secure, it has its own issues. Owners can lose passwords, or the device can break.
The Richardsons, after more email exchanges with Coinbase, said access to their account was eventually restored. And the company did send them some money back.
But it wasn’t what they expected. The company put $500 worth of Bitcoin in their account.
“It felt like they kicked sand in my face,” Erick Richardson said. “Is there even anybody senior at Coinbase looking at this? Somebody make a calculation and said, ‘OK, this is what happened to this guy. He lost 21 bitcoin. Let’s give him $500.”
Please email tips to [email protected].
— CNBC’s Angelica Serrano-Roman and Nadine El-Bawab contributed to this report.
