Phishing Attacks Thwart MFA to Steal Money from Coinbase Customers

Phishing attacks, such as the attack that recently hit cryptocurrency exchange Coinbase, can be devastating to companies and their customers alike. The best way to defend against phishing attacks, however, may be multifactor authentication (MFA). MFA adds an extra layer of security on top of a username and password when logging into an account. However, in some cases, phishing attacks can get around MFA by doing more than just asking for usernames and passwords; they may ask for additional information from customers, such as security questions or credit card details.

Some Background on Two-Factor Authentication

Two-factor authentication (2FA) is an additional layer of security used to verify your identity when logging into online accounts. 2FA typically requires the user to enter a one-time code, which is generated by an app on their phone, in addition to their username and password. This makes it much more difficult for hackers to gain access to your account, even if they have your login credentials. As a result, many companies now require two-factor authentication before granting access to sensitive information. For example, banks are now moving towards requiring customers sign up for 2FA before being able to do anything with their account. Recently though there has been an increase in phishing attacks that attempt to steal money from Coinbase customers through this method. What these attacks do is send out emails with subject lines like Verify Your Login Details or Recover Account Access or something similar.

A Brief History of Why Two-Factor Authentication Was Not Implemented

In the past, two-factor authentication was not implemented because it was believed that it would be too difficult to implement and maintain. Additionally, there were concerns that two-factor authentication would be too easy to bypass. However, recent phishing attacks have shown that two-factor authentication can be bypassed, and that it is possible to steal money from Coinbase customers. As a result, it is important to implement two-factor authentication in order to protect your money. If you use other sites or services, make sure you take note of their security settings and adjust them as necessary. It is also recommended to change passwords periodically and never give out personal information such as date of birth or social security number over the phone.

The Attack

On March 16, 2021, a phishing attack was used to thwart MFA and steal money from Coinbase customers. The attackers used a fake website that looked like the real Coinbase website to trick users into entering their login credentials. Once the attackers had the login credentials, they were able to bypass MFA and gain access to the victims’ accounts. They then transferred the money out of the accounts and into their own account. The victims did not realize they had been attacked until it was too late.

After contacting customer service, they learned their accounts had been emptied. A few hours later, customer service got back in touch with them and told them that all the funds have already been transferred out of their account due to an external phishing attack. To prevent such attacks in the future, Coinbase offers two-factor authentication (2FA) which sends you a text message every time someone logs in or tries to log in from your account.

Solutions Moving Forward

There are a few things that Coinbase and other companies can do to help prevent phishing attacks in the future. First, they can educate their customers on how to spot a phishing email. Second, they can add an extra layer of security, such as two-factor authentication, to make it more difficult for attackers to gain access to accounts. Third, they can create a security team that is dedicated to monitoring and responding to attacks. fourth, they can work with law enforcement to track down and prosecute the attackers. Fifth, they can offer users different account types with varying levels of security so people who want to be more secure have that option. Sixth, they can increase user awareness by sending out periodic notifications about new updates or changes to the system.