Impersonation scams grew by over 1,400% in 2025. Scammers pretend to be from your bank, a government agency, or even Coinstash itself, and create urgency to trick you into moving your funds. In Australia, phishing and impersonation scams caused $19.5 million in losses in 2025. This article explains how these scams work, how Coinstash really contacts you, and what to do if you're unsure.
⚠️ Coinstash will never ask you to…
share your password, 2FA codes or recovery phrase
move, send or transfer your crypto or AUD to another wallet, account or platform, including a so-called "safe wallet"
contact us on WhatsApp, Telegram, Discord or social media DMs
Anyone who asks you to do any of these is a scammer, even if they know your name, email or account details.
Types of impersonation scams
Fake exchange support
You receive a call, email or social media message from someone claiming to be "Coinstash Support". They say your account has been compromised and you need to move your funds to a "safe wallet" immediately. They may know your name and email. The "safe wallet" is the scammer's wallet.
Government impersonation
You get a call or message from someone claiming to be the ATO, myGov or the AFP. They say you owe taxes on your crypto and must pay immediately in cryptocurrency or face arrest. Government agencies will never demand crypto payments.
Bank impersonation
Someone calls claiming to be from your bank, saying suspicious transactions have been detected. They ask you to "secure" your funds by transferring them to crypto, supposedly because it's "untraceable by the criminals". Your real bank will never ask you to buy crypto.
Friend or family impersonation
You receive a message from what appears to be a friend's or family member's account asking for urgent crypto help: "I'm stuck overseas", "I need to pay a bill urgently". Their account may have been hacked, or the scammer created a duplicate profile. Scammers can also use AI to clone a person's voice. See AI, Deepfake & Phishing Scams Targeting Crypto Users.
How Coinstash actually contacts you
Through the in-app chat (the chat widget inside the Coinstash app or website)
Via email from @coinstash.com.au addresses only
We will NEVER contact you on WhatsApp, Telegram, Discord or social media DMs
We will NEVER ask you to transfer funds to an external wallet for "safety"
We will NEVER ask for your password or 2FA codes
We will NEVER threaten account closure unless you act immediately
If you're not sure whether a message is really from us, don't reply to it. Open the Coinstash app or type coinstash.com.au into your browser, then start a chat with our team and ask.
Real-world examples
Australians received SMS messages impersonating the ATO claiming crypto tax debts, with losses of $4 million reported to Scamwatch in 2024.
A pensioner lost her life savings after scammers posing as "Microsoft Support" told her to move her money into Bitcoin via a crypto ATM for "protection".
Scammers created fake social media profiles of crypto exchanges and messaged customers offering "account upgrades", collecting login details in the process.
How to protect yourself
Hang up and call back. If someone calls claiming to be from Coinstash, your bank or the government, hang up and contact them directly through their official website or app.
Never click links in unexpected SMS messages or emails. Type the URL directly.
Check email sender addresses carefully (e.g. [email protected] vs a look-alike such as [email protected]).
If someone says "don't tell anyone" or "this is confidential", that's a scam tactic.
Enable 2FA on all accounts and never share codes with anyone. See Securing Your Account with Two-Factor Authentication (2FA).
What to do if you've been contacted
Stop: don't reply, click links, install apps or move any funds.
Check: contact the organisation yourself using contact details from its official website or app.
Tell us: if it involved Coinstash or your Coinstash account, chat with our team. If you reach us quickly, we may be able to place a hold on your account to prevent further transactions.
Report it to Scamwatch.
Already sent money or shared your details? Follow the steps in I think I've been scammed — what should I do?
FAQ
The caller knew my name, email and that I use Coinstash. Doesn't that mean they're real?
No. Scammers often have personal details from data breaches or social media. Knowing your details doesn't make someone legitimate. What matters is what they ask you to do: if they want your codes or want you to move your crypto, it's a scam.
I gave a "support agent" my 2FA code. What now?
Contact us immediately through the in-app chat, change your password and reset your 2FA. See Account Protection in Case of Device Theft for steps to secure your account.
Related articles
Need a hand? Our Brisbane-based support team is here to help — tap the chat icon in the app or on the website to get in touch.