Bitcoin account compromised. Bank refuse to refund.

Michael23

Yesterday I received a text from Coinbase to tell me of a deposit of £650.00, the person purchased bitcoins on my account from my bank account and then sent this to an address, I was able to cancel this through a security text I received from Coinbase. I rechecked just a few minutes later and saw this time that the transaction was sent again and went through. I wasn’t able to cancel this one. I have spoken to Coinbase and they have been unhelpful and said they can’t do anything. The bank have said that the IP used to send the payment matches the one I login to my online bank. I stated that any cyber criminal has the means with a vpn or something to mask my ip or perhaps someone was on my network. Is there anything I can do??

EDIT: bank have said that the IP was the same but device different.

masonic

So, someone gained access to your internet connection, was able to log in to online banking and send the payment to Coinbase, then log in to Coinbase and make the payment (presumably confirming the transaction with 2FA by entering an SMS code). You are going to have a really tough time convincing anyone that someone was not you. If not you, the next most likely suspect is someone who you know and trust.

Report the crime, pursue the transaction as unauthorised with your bank. Good luck.

dj1471

I suggest you secure your PC, since the transaction appears to have been made from there. Most likely there is a keylogger on your machine which will be how they gained access to your Coinbase account... Along with potentially every other account you have.

masonic

dj1471 wrote: »

I suggest you secure your PC, since the transaction appears to have been made from there. Most likely there is a keylogger on your machine which will be how they gained access to your Coinbase account... Along with potentially every other account you have.

The phone should also be considered compromised if an SMS was used to authorise the Coinbase payment (as it is by default).

Michael23

But after speaking to the bank they are just saying the IP is the same so can’t take it further, is that correct? My computer and phone may of been compromised and I will speak to anyone in the household. Won’t the bank just say if it someone in the household then I have been negligent?

masonic

Michael23 wrote: »

But after speaking to the bank they are just saying the IP is the same so can’t take it further, is that correct? My computer and phone may of been compromised and I will speak to anyone in the household. Won’t the bank just say if it someone in the household then I have been negligent?

That's likely the position they'll take. However, there may be evidence corroborating your version of events on your devices, if you can persuade the police to investigate and examine them.

A crime number itself might help persuade the bank to take things a little more seriously.

Zanderman

Michael23 wrote: »

But after speaking to the bank they are just saying the IP is the same so can’t take it further, is that correct? My computer and phone may of been compromised and I will speak to anyone in the household. Won’t the bank just say if it someone in the household then I have been negligent?

If your pc and/or phone have been compromised I'd suggest you put your efforts into sorting those out, changing all your security settings etc (but not from those devices!) before any further fraud takes place, rather than worrying about solving the existing fraud.

jonnygee2

I stated that any cyber criminal has the means with a vpn or something to mask my ip

Nope, not possible. You can't spoof someones IP number (or, at least it would be very, very difficult and not worth it for £600).

or perhaps someone was on my network

Yep, someone did this from your network. They obviously also had all of your security details. It's possible that someone took over your home computer remotely. Or, it was someone in your household. The latter, sadly, is a lot more common. Still, a good idea to resecure your home computers and change your wifi key.

The phone should also be considered compromised if an SMS was used to authorise the Coinbase payment

This part though, not necessarily. The SMS network is notably unsecured, you can intercept, divert and fake responses to SMS messages without ever going near the persons phone. Which is why people shouldn't really use SMS as a two factor auth method.

Emily_Joy

Michael23 wrote: »

But after speaking to the bank they are just saying the IP is the same so can’t take it further, is that correct? My computer and phone may of been compromised and I will speak to anyone in the household. Won’t the bank just say if it someone in the household then I have been negligent?

Huh?! Are you sure your computer does have an external IP address at all? what is your provider? If you are using BT, say, than your router is most likely acting like a BT hotspot for anyone passing by with a btinternet account, and there are quite a few of us walking around. If your neighbours are using the same provider as you do, then, most likely, you share external IP as well. (The bank can't possibly know your IP within your local network). Moreover, if your "usual" IP happen to be an office/work computer, than most likely all company computers have the same external IP address.

masonic

Emily_Joy wrote: »

Huh?! Are you sure your computer does have an external IP address at all?

That doesn't appear to be the claim being made.

jonnygee2 wrote: »

Nope, not possible. You can't spoof someones IP number (or, at least it would be very, very difficult and not worth it for £600).

If the OP's computer or phone (or indeed router in some cases) is compromised, then it could be made to run a VPN server, which could be connected to externally and used to redirect traffic through the OP's connection. Which is presumably where the VPN notion has come from.

18cc

The simplest explanation is often the best ...

if the bank are indeed right about your 'usual IP address' being used to make the payment then this means that your computer was the source of the payment

it is also possible that somebody has connected to your router but one has to ask the question why anybody would bother connecting to your router to make the payment

By the way unless you have a static IP address assigned then you will have a dynamic IP address and this will change every time you reconnect to the network although of course routers are often left connected for long periods of time and the IP address won't change