Unfortunately, BleepingComputer was told that threat actors use these erroneous error messages as part of social engineering attacks that attempt to breach Coinbase accounts by making targets think their credentials are compromised. Coinbase is fixing a misleading account activity message that has caused confusion and anxiety, making users think their credentials were compromised. However, it turns out that the "second_factor_failure" or "2-step verification failed" account activity messages are shown in two different scenarios—when a user incorrectly enters the wrong 2FA code or when someone tries to log into their account with the wrong password. After receiving Coinbase phishing emails or texts, they logged into their accounts and checked the activity log, finding numerous entries stating "second_factor_failure" or "2-step verification failed" with login attempts from unusual locations. BleepingComputer was able to confirm this by logging into someone's account with the wrong password and the person telling us that their account activity page soon showed the mislabeled 2FA error. Coinbase has told BleepingComputer that they are looking into changing the error message when an incorrect password is entered but that there is no time frame as to when this occurs. As a reminder, Coinbase will never text or call you about suspicious activity on your account, so if you receive a phone call or text message, just ignore it and do not engage with the scammers. Coinbase account activity showing 2-step verification failed message. Making matters worse, these users claimed to have a complex, unique password at Coinbase, and there were no signs of malware on their devices, making them believe that Coinbase had been breached. Two-factor authentication prompts usually occur after a user successfully logs in with their credentials, so they immediately thought that their passwords were compromised and that only 2FA saved them from their account being hacked. Over the past couple of weeks, numerous people have contacted BleepingComputer about concerns that they think Coinbase has a serious security issue. Lawrence Abrams Lawrence Abrams is the owner and Editor in Chief of BleepingComputer.com. Lawrence's area of expertise includes Windows, malware removal, and computer forensics. "I think they mean that the error doesnt [sic] give any actual detail of what happened," a Coinbase customer posted to Reddit.
This Cyber News was published on www.bleepingcomputer.com. Publication date: Sat, 05 Apr 2025 15:40:16 +0000