Quick answer
Hang up before you share a code, a phrase, or your screen
Open support only from a bookmarked official app or typed URL. Coinbase, Kraken, and Binance all say legitimate support will not ask for a seed phrase, password, or two-factor code, and will not ask you to install remote-access software. If someone claiming to be support needs those things, end the contact and check the account yourself. For the phone-call script specifically, see Coinbase support scam calls.
How the contact starts
Impersonators copy the anxiety of a real alert
IC3 groups tech and customer-support impersonation with government impersonation because the same groups often use both scripts. The exchange name can be Coinbase, Binance, Kraken, or a smaller venue. The request is usually the same: act now, prove you are the account holder, then hand over a code, a recovery phrase, or control of the device.
Search ads and lookalike numbers
The FBI Internet Crime Complaint Center warns that customer-support numbers found through open search, especially sponsored results, are often advertising for impersonators. Kraken says it does not publish a direct-dial support number, and any number found online claiming to be Kraken Support should be treated as a potential phishing scam.
Unsolicited calls, texts, and emails
Coinbase says scammers set up fake support lines and impersonate companies, regulators, and law enforcement, then pressure people to move funds. Kraken says it will not call without first arranging contact through email or in-app chat. Coinbase also warns that callers can spoof a legitimate-looking number.
Social DMs and lookalike websites
A logo, similar username, or paid checkmark is not proof of official support. Kraken documents fake sign-in pages that request a username, password, 2FA code, or seed phrase. Binance documents “support” chats and clone sites that ask for a recovery phrase under urgency about a wallet error or migration.
Official limits
What current first-party pages say support will never request
- Coinbase customer-service agents will never ask for a password, 2-step verification code, or seed phrase; will never ask you to install software or grant remote access; and will never ask you to send crypto to an external “safe” address.
- Kraken Support will never ask over the phone for a password, 2FA code, device-approval code, wallet address or seed words, Master Key, remote access, or a change to security settings.
- Binance’s security guidance is that no legitimate service will ever ask for a seed phrase or private key, including sites that claim to fix a wallet, bridge, or migration error.
A callback is not automatically fake if you already opened a ticket. Coinbase says that if a genuine support call drops, the agent may call the same number back within five minutes and re-verify identity. That exception does not authorize sharing a 2FA code, seed phrase, or remote-access session. For self-custody wallets, see Ethereum wallets, recovery phrases, and hardware signing.
Before you continue the conversation
Eight checks that keep control of the account
- 1
Start from a bookmark or typed official URL
Do not use a link, QR code, pop-up, or search ad to reach support. Kraken recommends bookmarking its sign-in and support pages. Coinbase says to contact it only through the phone number or email listed on its official Contact us page.
- 2
Treat unsolicited first contact as hostile until proven otherwise
If you did not request the call, hang up. Kraken says unexpected callers claiming to be support should be ended immediately, then verified in the app. IC3 says not to call a number supplied in a pop-up, text, or email.
- 3
Refuse remote access, screen sharing while signed in, and extra software
Coinbase and Kraken both say support will not ask to install software or control your device. Kraken lists AnyDesk, TeamViewer, Quick Assist, UltraViewer, and similar tools as a reason to end the conversation.
- 4
Never read out a 2FA, device-approval, or recovery phrase
Those values exist to prove control of the account. Anyone who needs them during a support chat is trying to take that control. There is no customer-support reset for a leaked seed phrase.
- 5
Do not move funds to a “safe wallet” or pay a release fee
Coinbase says staff will never ask you to send cryptocurrency to an external address. Kraken calls a request to move funds to a protected wallet a scam script, not a real security procedure.
- 6
Ignore urgency, blanked screens, and requests to look away
IC3 and the FBI both tell people to resist pressure to act quickly. Kraken says a request to blank the screen “while we work” is a reason to hang up.
- 7
Check the live account from a device the caller cannot see
Type the official URL or open the official app yourself. Look for sessions, devices, withdrawal addresses, and pending approvals. Do not confirm what the caller already claims to see.
- 8
Use in-app verification when the venue provides it
Kraken’s current voice support is started from its mobile apps and shows an in-app banner or one-time code. If someone calls claiming to be Kraken and the app does not verify the call, hang up.
Stop immediately
Five requests that need no further debate
- A seed phrase, private key, password, 2FA code, or device-approval code.
- Remote access, a new support app, or a command pasted into Run or Terminal.
- Sending crypto to a “secure,” “vault,” or “recovery” address they provide.
- A phone number or chat link that arrived in a search ad, pop-up, DM, or unexpected email.
- A demand to disable 2FA, remove a Master Key, or change security settings during the call.
If you already shared a code or granted remote access
End the session, uninstall remote-access software, and use a different device if you can. On the exchange, reset the password, rotate 2FA, remove unknown sessions and withdrawal addresses, then contact support through the official app or typed URL. Coinbase also documents an in-app lock if the account looks compromised.
If a recovery phrase or private key was disclosed, treat that wallet as lost. Move remaining assets from a newly created wallet using trusted software or hardware, then review leftover token approvals. Save transaction hashes and report the incident at ic3.gov. IC3 warns that cryptocurrency transfers are irrevocable and that recovery services charging an upfront fee are another risk.
Fake exchange support FAQ
Will Coinbase, Kraken, or Binance support ask for my seed phrase or 2FA code?
No. Coinbase says agents will never ask for a password, 2-step verification code, or seed phrase. Kraken says support will never ask for a password, 2FA code, device-approval code, or seed words. Binance says no legitimate service will ever ask for a seed phrase or private key.
Can I trust a support number from Google, social media, or a text message?
No. IC3 warns that customer-support numbers found through open search, especially sponsored results, are often advertising for impersonators. Kraken says it does not publish a direct-dial support number, and any number found online claiming to be Kraken Support should be treated as a potential phishing scam.
Is every unexpected callback a scam?
Not automatically, if you already started a ticket. Coinbase says that if a genuine support call drops, the agent may call the same number back within five minutes and re-verify identity. Kraken says it will not call without first arranging contact through email or chat. In every case, refuse seed phrases, 2FA codes, and remote access.
Why is remote-access software so dangerous during a support call?
Remote control lets someone else operate your mouse and keyboard. Kraken says that once connected, an attacker can read codes and recovery phrases, use accounts you are already signed into, move funds, and leave the tool running. Coinbase and Kraken both say support will never ask to install software or take remote control.
Can stolen crypto be reversed if I report it quickly?
Usually not. IC3 and Kraken both state that confirmed cryptocurrency transfers are irrevocable. Report the incident at ic3.gov with addresses, amounts, transaction hashes, and contact details. Be wary of anyone promising guaranteed recovery for an upfront fee.
What should I do after I already shared a code or installed remote access?
End the session, uninstall the remote-access tool, reset the exchange password, rotate 2FA, and remove unknown devices and withdrawal addresses from the official app or typed URL. If a recovery phrase was disclosed, treat that wallet as compromised and move remaining assets with a newly created trusted wallet.
Evidence reviewed September 8, 2026
Primary sources
Support limits, callback rules, and remote-access warnings were checked against current Coinbase and Kraken help pages. Seed-phrase refusal language was checked against Binance Academy and Binance’s security blog. Loss and reporting context comes from the FBI’s April 6, 2026 Internet Crime Report release and IC3 crime-info pages. Support policies can change, so verify contact paths on the venue’s own site before acting.
- Coinbase Help — technical support and impersonation scams
- Coinbase — security tips: passwords, 2FA, software, and remote access
- Kraken Support — protect yourself from scams
- Kraken Support — how to contact Voice Support and reject numbers found online
- Kraken Support — risks of remote access software
- Kraken Support — how to tell if an email is from Kraken
- FBI — 2025 Internet Crime Report press release, April 6, 2026
- IC3 — tech/customer support and government impersonation
- IC3 — cryptocurrency complaint guidance and recovery-service warning
- Binance Academy — common cryptocurrency scams, updated April 22, 2026
- Binance Blog — blockchain rectification and seed-phrase traps, February 6, 2025