Scammers used social engineering to steal all my mother's Bitcoin from Coinbase in 5 minutes

​

TL;DR: After years of using Coinbase and amassing a large amount, my mother gave it all to thieves that convinced her they worked for Coinbase and her account was 'locked'. Now she won't report it beyond Coinbase's 'compromised account' report, and is afraid to tell anyone but me because she thinks they'll get divorced.

Obviously a throwaway account but wanted to share my sad, developing story.

I've been into bitcoin as a fascination since 2010, didn't buy until 2012 at around $980, and ATH at that point. At some point, maybe 2017, 2018, my mother asked me if I knew what Bitcoin was. This was surprising. My parents are aging and use me as their IT go to, but it has always tumultuous because their retention of knowledge on this subject is zero. For instance, I've shown them each how to upload photos from their phone at least three dozen times. The processes never changes, they just are incapable of learning new things, unfortunately. I told my mother I would not be responsible for teaching her anything about bitcoin and she would have to learn on her own, then come back to me with real questions and we could talk about it. I'm not a good teacher, I'm not patient enough, I know this.

Ultimately she did some research! I was impressed. I was willing to have some discussions about it and I explained that the best thing for her was probably to use Coinbase because it's the most similar to online banking and maybe they'd be able to use it, safely. My parents always have issues with remembering passwords. They each ended up having multiple facebook accounts. I've considered a password manager but even that seems like a nightmare versus their writing 200 passwords down in a document. They are obsessed with boogie men walking through their fancy neighborhood, getting on their wifi and 'stealing' their social security codes from the computer. Insane edge-case stories that I ask where they get this from. So they are aware of the dangers of hackers, identity theft. That doesn't mean they understand it or can confront it at all.

If it sounds like I'm talking down to my parents, just understand that I'm trying to paint a picture of my digital life surrounding them for the past decade or so. It's been trying and finally culminated with the event I'm about to get into. I still love them dearly, I just can't be there protect them from themselves 24/7.

As bitcoin rose and fell for the past decade, my mother would send me texts like "Did you see the price of bitcoin!?" and I'd say yeah, and we'd discuss philosophically what this could mean. It was actually kind of fun to have this discussion with my mother. One day though, I was home and we looked at her account. The value of it was over $900,000!!! This was near the recent ATH of over $50k. I had no idea she had gone that far into this. She is retired and has a bit of a nest egg. I do my best not to discuss major finances with my family unless necessary. This seemed dangerous to me. I recommended that she at least liquidate her cash that had been put into the bitcoin and continue on with her crypto life. She didn't. It's her money, I was not going to get much more involved but I definitely felt uneasy. At one point, I had tried to get her on a trezor hardware wallet, but as you can guess from the above paragraphs, as I was setting it up, I realized this was never going to work for her. And the last thing I wanted was for her digital assets to be locked onto a trezor because she fat fingered a password or digital key. Coinbase still seemed like the best bet, even though as we all know: not your keys, not your money.

This is the part that stings the most... I saw during the past year that Coinbase was having trouble. Lots of customer hacks and the company could even potentially fall like previous major exchanges have. I did send my mother a text again reiterating that maybe it's time to diversify those assets, which had since dropped considerably in value due to such a difference in value of BTC. I wish I had pushed this harder.

Fast-forward to earlier this week. I receive a call from my mother at an odd time. She asked if I'm busy and if I'm sitting down. I was. Worried about a family disaster or accident, my heart started beating faster. "My coinbase account was hacked and I lost it all" .... I could not believe it. My heart sank. Let's remember, none of this was my money but the fact that I had been in the know all along the way weighed on me. It still does. I asked how this happened. My mother wasn't even able to fully articulate what happened. I think it had just occurred. She said her account had been locked and she called the number on the website and talked to coinbase people but they ended up not being coinbase people. What I surmised from our brief exchange was that she had been socially engineered to hand over all the information someone would need to get into another person's account and transferred it all their own wallet. She said it was all gone. Matter of factly. I wanted to scream, I wanted to ask how could you be so fucking stupid. After all of the times I had in vain tried to warn her of the dangers of not being secure digitally. I was able to refrain from doing these things because I realized how this must feel. To have what could potentially be her life savings gone in an instant. I just said, "I'm so sorry." And then I wanted to get details, but she had to go.

We've talked a few times since. I don't live nearby, but I work and have young children. I can't just pick up and go. I wanted to go though, and just give her a hug. She is adamant that I tell no one else. I've been doing some research and have been urging her to go to 'the authorities' to report this theft. She made some major bonehead mistakes, but she is the victim of a crime. I keep telling her this. But she is embarrassed, obviously, and worried she will be put in the newspaper and her spouse will divorce her over this. So now I am left baring the weight of this immense secret and devastating loss.

She says it's gone, there's no way to get it back. If I was there, I would at least check the transaction log and try to follow the btc as best I could through the block chain. That's SOMETHING, but still, I am also a realist and know it's all gone. That's how this technology works. It is agnostic, it is sterile, it is unforgiving. This is not the world our parents grew up in and it's able to eat them for breakfast. It's so wild how long cons are definitely a thing of the past when you can do a quick con and become a millionaire in less than 5 minutes.

From what I've gathered in our brief discussions, this is what happened. I am missing lots of details but wanted to share just as a warning for others that may be preyed upon.

1. She received a "message" that her coinbase account had been locked. I do not know if this is an SMS, email, toast message on a website. I simply don't know, but I believe she clicked a phony link that sent her to a bogus coinbase locked screen.
2. On the bogus coinbase locked screen, she was prompted to call a number. she unfortunately did, instead of calling me. Which I had told her anytime something seems 'off' just call me first.
3. On the call, they convinced her they were coinbase officials and would help unlock the account. They then, unbelievably, convinced her to download anydesk onto her computer and literally commanded the computer while they were on the phone.
4. Unclear on how much personal information she gave them, but potentially everything. email, phone, SS#, DOB, who knows. I want to get this timeline written down and confirmed but can't do this until I am face to face with my mother. I'm avoiding making her relive the details by recounting everything to me over the phone. I'm also worried that as time passes, she will forget the details.
   
5. Unsure what happened after this, but perhaps after they got into the account and transferred the money, they simply hung up. At this point, my mother called me because she realized what had happened.

My guess is that had she just typed coinbase into her browser, or used an existing book mark, she'd have seen her account was not 'locked.' My mother isn't web literate enough to understand the difference. I can't help but feel somewhat responsible for not protecting my mother from her own lack of knowledge and I feel incredibly guilty. She has forbade me from telling anyone else, and I'm doing everything I can to not get angry because all that will do is make her feel worse. I think we are both experiencing swift and sudden depression over this. She keeps telling me she can't believe she was so stupid. While I deep down want to scream the same thing to her, there is no benefit from berating her anymore. The damage has been done.

I know this isn't over. I'm not sure what the long term impact of this upon my family will be. Whether the 'secret' gets out, or doesn't, neither have great implications for the future of my family. I'm only sharing this because I have no other way to do so, I'm not looking for sympathy. Maybe a little compassion and maybe even some advice. I understand if some feel the need to kick dirt in my face over this, if that makes you feel better fine. Ultimately, I believe this needs to be reported, even though we won't get the bitcoin back. By biggest fear is that coinbase suddenly 1099's my mother for the 'transaction' of bitcoin that wasn't even hers. If you wait till tax season for that and don't report it, it will look like your' fraudulently trying to transfer away your bitcoin. As I've thought about this more and more, it's incredibly difficult to 'prove' that any of this happened because the paper trail will just look like a regular transfer.... of your entire wealth all at once after years of inactivity. Also still not too weird in the world of crypto. That's the beauty and danger of bitcoin. Someone just spent 5 minutes conning my mother and is now potentially a millionaire. Not bad for a day's work.