SECURE YOUR COINBASE ACCOUNT

Protect your exchange account, identity and crypto.

A Coinbase account can provide access to crypto assets, personal information and transactions. Protect the account itself before focusing on convenience or trading.

Start with authentication, then protect withdrawals.

Coinbase requires 2-step verification, but you can strengthen it with methods such as a security key, passkey or authenticator app.

After securing sign-in, review your devices, sessions, applications and withdrawal addresses. Crypto transfers can be difficult or impossible to reverse.

What should I never share?

Never give anyone your Coinbase password, 2-step verification code, passkey credentials, authenticator secret, email access or other authentication information. Coinbase says its employees will not ask for these secrets.

Why is SMS not the strongest 2FA option?

SMS depends on control of your phone number. Attacks such as SIM swapping or phone-number porting can allow an attacker to receive SMS codes. Coinbase recommends stronger methods such as security keys, passkeys and authenticator apps.

What if someone says they can recover my crypto?

Treat this as a major warning sign. Never send crypto, passwords, 2FA codes or remote access to someone who claims they can recover your account or funds. Use Coinbase's official support process.

COINBASE ACCOUNT SECURITY

Protect access, devices and withdrawals.

Work through these checks one at a time. After each important change, use the VERIFY section to confirm that the protection is actually active.

Use a strong, unique password

Your Coinbase password protects access to your account, personal information and crypto assets.

Click to see protection steps

Step-by-step

Sign in to your Coinbase account.
Open your Security settings.
Find the option to change your password.
Create a strong password that you do not use on another important account.
Use a long, random password where possible and store it in a reputable password manager.
Never share your Coinbase password with another person.

VERIFY: Confirm that the new password has been accepted and that you can sign in normally with it.

Upgrade your two-step verification

Coinbase requires 2-step verification and supports stronger methods such as security keys, passkeys and authenticator apps.

Click to see protection steps

Step-by-step

Sign in to Coinbase from a trusted device.
Open Settings → Security.
Open the 2-step verification settings.
Review the authentication methods available to your account.
Prefer a security key or passkey where appropriate.
An authenticator app is another strong option if a security key or passkey is not suitable for you.
Keep a secure backup authentication method so you do not lose access if your primary method becomes unavailable.
Treat SMS as a weaker option because phone-number attacks such as SIM swapping can affect SMS-based authentication.

VERIFY: Return to your 2-step verification settings and confirm that your strongest intended authentication method is active.

Set up a passkey

A passkey uses cryptographic authentication tied to your device or passkey manager and can reduce reliance on traditional passwords.

Click to see protection steps

Step-by-step

Sign in to your Coinbase account.
Open your Security settings.
Open 2-step verification.
Find Passkey under the available methods.
Select Add Passkey.
Follow your device's authentication instructions.
Use your device's approved PIN, fingerprint, face authentication or security key when prompted.
If your passkey is synced through a trusted password manager or platform account, make sure that account itself is strongly protected.

VERIFY: Confirm that the passkey appears among your active Coinbase authentication methods.

Use an authenticator app

A TOTP authenticator app generates time-based verification codes without relying on SMS delivery.

Click to see protection steps

Step-by-step

Install a reputable authenticator app on your trusted device.
Sign in to Coinbase using a trusted browser.
Open Security → 2-step verification.
Select Authenticator App.
Follow Coinbase's instructions to connect the authenticator app.
Enter the generated verification code.
Store any recovery information Coinbase provides in a secure location.
Do not photograph or send your authenticator setup secret to another person.

VERIFY: Trigger a Coinbase verification challenge and confirm that the authenticator app produces the required code.

Consider a security key

A physical security key can provide stronger protection against many phishing attacks because the attacker normally needs the physical key.

Click to see protection steps

Step-by-step

Obtain a compatible FIDO/WebAuthn security key.
Sign in to Coinbase from a trusted browser.
Open Security → 2-step verification.
Select Security Key.
Follow the prompts to register the physical key.
Give the key a recognizable name if Coinbase provides that option.
Consider keeping a second trusted security key as a backup if this is your primary authentication method.

VERIFY: Confirm that your security key appears as a registered authentication method and that you recognize it.

Enable mobile PIN or biometric protection

The Coinbase mobile app can use your device's PIN or biometric authentication to add another layer of protection.

Click to see protection steps

Step-by-step

Open the Coinbase mobile app.
Open your profile or account settings.
Go to the Security section.
Find Require PIN / Face ID or the equivalent security option shown on your device.
Enable the protection.
Allow the Coinbase app to use your device's fingerprint or Face ID if you choose biometric authentication.
Use a strong device screen lock as the underlying protection.

VERIFY: Close and reopen the Coinbase app and confirm that the configured PIN or biometric authentication is required.

Review active sessions and devices

Coinbase allows you to review active sessions, authorized applications, web sessions and confirmed devices.

Click to see protection steps

Step-by-step

Open your Coinbase Security settings.
Find the section showing your account activity, devices or sessions.
Review your active mobile applications.
Review active web sessions.
Review confirmed devices.
Check the available timestamps and device information.
If you find something you do not recognize, revoke its access.
If the activity suggests unauthorized access, change both yourCoinbase password and email password.

VERIFY: Confirm that every remaining session, application and device belongs to you and is still necessary.

Enable withdrawal address allowlisting

Allowlisting restricts crypto withdrawals to addresses that you have intentionally added to your Coinbase address book.

Click to see protection steps

Step-by-step

Sign in to Coinbase.com.
Open your Settings.
Find the Allow list or address-book security setting.
Turn on Allowlisting.
Complete the required 2-step verification.
Add only wallet addresses that you have independently verified.
Select the correct currency and enter the intended wallet address.
Give the address a recognizable nickname.
Remember that Coinbase currently applies a security waiting period before a newly added address becomes available for sends.

VERIFY: Review the Allow list and confirm that every approved address belongs to a wallet or destination you intentionally added.

Verify the wallet address before sending

Crypto transfers can be irreversible. Verify the destination and network before approving a transaction.

Click to see protection steps

Step-by-step

Open the Send function in Coinbase.
Select the asset you intend to send.
Enter or select the recipient's wallet address.
Check the network carefully.
Confirm that the receiving wallet supports that exact network.
Compare the beginning and ending characters of the destination address with the address you independently verified.
Check the amount before confirming.
Never change a saved address because someone suddenly sends you a message claiming the address has changed.

VERIFY: Before confirming the transaction, independently verify the recipient, asset, network and amount.

Protect your Coinbase email account

Coinbase uses email for device confirmation, important alerts and support communication, so your email account is part of your Coinbase security boundary.

Click to see protection steps

Step-by-step

Identify the email address connected to Coinbase.
Enable strong 2FA on that email account.
Review the email account's active sessions and devices.
Review email forwarding rules and filters.
Remove forwarding addresses or rules you did not create.
Review your email account's recovery phone numbers and email addresses.
Never give Coinbase email access to someone claiming to be Coinbase Support.

VERIFY: Confirm that your email account is secure, that no unauthorized forwarding rule exists and that its recovery methods are under your control.

Set up trusted contacts carefully

Coinbase allows eligible users to designate trusted contacts for account-recovery approvals. Choose these people extremely carefully.

Click to see protection steps

Step-by-step

Open your Coinbase 2-step verification settings.
Find Trusted Contacts if the feature is available to your account.
Choose only people you personally know and trust.
Add the required number of trusted contact email addresses.
Send the invitations through Coinbase's official setup.
Explain to your trusted contacts that they should never give an unsolicited person a recovery approval or code.
Never add someone simply because they claim to be Coinbase Support.

VERIFY: Confirm that every trusted contact is someone you personally know, trust and can reach independently.

Recognize fake Coinbase support

Fake support scams are a major threat because attackers may try to convince you to reveal credentials or transfer crypto.

Click to see protection steps

Step-by-step

Never give a supposed support agent your password.
Never provide your 2FA code.
Never give someone access to your email account.
Never install remote-access software because someone claiming to be Coinbase Support asks you to.
Never send crypto to a supposed secure or recovery walletbecause a stranger tells you to.
Do not trust phone numbers found in random search results, advertisements, social media or forums.
Open Coinbase through a trusted bookmark and use its official Help Center instead.

VERIFY: Before acting on a support request, independently open Coinbase through a trusted route and confirm the issue through official support.

Secure your account after suspicious activity

If you discover an unauthorized session, application, device, withdrawal or security change, treat the account as potentially compromised.

Click to see protection steps

Step-by-step

Stop approving withdrawals or security changes.
Open Coinbase directly through a trusted route.
Change your Coinbase password.
Change your email password as well if unauthorized access is suspected.
Review and revoke unfamiliar sessions, applications and devices.
Review your 2-step verification methods.
Review your withdrawal allowlist.
Review your phone number and recovery information.
Check for unauthorized transactions and preserve the relevant transaction details.
Contact Coinbase through its official support channelif you need assistance.

VERIFY: Do not resume normal transactions until your password, email, authentication methods, devices and withdrawal settings are under your control.

Something does not look right?

If you find an unfamiliar login, changed recovery information, unexpected security alerts or another sign that someone may have accessed your account, stop the normal security check and move to the recovery process.

I think my account is compromised →

Still need help?

If you have worked through the relevant settings and something still looks wrong, do not give your security secrets to someone promising to fix the account. Use the service's official support and recovery resources for service-specific account problems.

For broader cybersecurity problems, you can also use the professional assistance pathway on this platform.

Need Professional Help? →

Coinbase security is not a one-time task.

Review important account settings periodically, especially after a password change, device change, suspicious message or unexpected login alert.

VERIFY BEFORE YOU TRUST.

← Back to Secure Your Accounts