Cheap contracts, valuable access: the market behind Coinbase’s bribed agents

The week

On May 15, 2025, Coinbase, one of the largest cryptocurrency exchanges in the United States, disclosed in an SEC filing that criminals had paid contractors and employees in support roles outside the United States. Those support staff, the people who answer customer calls and emails, had copied customer data from the internal tools they used every day to do their jobs. Most data breaches start with someone breaking in. This one started with someone paying to be let in.

The filing was a Form 8-K under Item 1.05, the line item the SEC created in 2023 for material cybersecurity incidents. A public company must file it within four business days of deciding that an incident is material. The disclosure was unusually direct about what had been taken and how.

The rule took effect in December 2023. It was meant to give investors prompt, comparable notice of serious incidents, and it forces a company to describe what happened before all the facts are in. Coinbase’s filing reflected that. It gave a cost range rather than a figure and said the full financial impact was still being assessed. It reported no material effect on operations so far and said the company was cooperating with law enforcement.

The stolen data included names, addresses, phone numbers and email addresses. It included Social Security numbers masked to the last four digits, masked bank account numbers and some account identifiers. It also included government ID images such as driver’s licenses and passports, and account data such as balance snapshots and transaction history. Some corporate material went too: documents, training materials and communications available to support agents.

It did not include passwords, private keys, which are the secret codes that control crypto holdings, or the ability to move funds. The criminals could not empty accounts directly. What they had was something subtler: enough personal detail to impersonate Coinbase convincingly to its own customers.

The company said its own monitoring had detected personnel accessing data without a business need in prior months, and that the people involved had been fired. It later concluded that those separate access events belonged to a single campaign. But by then the data had already been copied.

The next move came on May 11, when the company received an extortion email claiming to hold customer account information and internal documents. The demand was for $20 million. The criminals were, in effect, offering not to use or publish what they had taken, for a price.

Coinbase refused to pay. Instead, it turned the tables and offered a $20 million reward for information leading to arrests. It also said it would voluntarily reimburse eligible retail customers tricked into sending funds to the attackers. That was a recognition that the real harm would come from scam calls to customers rather than from the theft itself. It added fraud monitoring and warnings for affected customers, and said it was opening a new US-based support hub.

It estimated related costs at roughly $180 million to $400 million, covering remediation and the reimbursements. The filing cautioned that the figure could change as the company reviewed losses, indemnification claims and potential recoveries. That phrase matters for what follows. Whatever contract governed the support work would help decide who finally bore the cost.

The timing was awkward. On May 12, S&P Dow Jones Indices had announced that Coinbase would join the S&P 500 on May 19, replacing Discover Financial Services, which Capital One was acquiring. A company days away from joining the main US equity benchmark was disclosing that its weakest point was the people paid to answer its customers.

For other financial institutions, the case raised an uncomfortable question. The insiders here were not hackers or senior administrators. They were front-line support staff, often employed through outsourcing firms, using exactly the access their jobs gave them. Banks, credit unions, broker-dealers and fintechs run the same model at scale. Outsourced contact centers are a standard part of retail financial services, and the agents in them usually see far more than one transaction. How many of them have the same arrangement?

Insider threat programs are usually built for the rare bad actor: a disgruntled administrator, a rogue trader. They look for the one person who goes wrong. The Coinbase case followed a different pattern. An outside buyer recruited people in a support operation and paid them for access they already had as part of the job.

That turns insider risk into something closer to a market, with a buyer, a seller and rules that govern the trade. Seeing it that way is useful, because markets respond to prices and terms, and those can be changed. A firm cannot make every agent incorruptible. It can make its seats less valuable to buy, less attractive to sell and harder to trade without consequence.

Banks, credit unions, broker-dealers and fintechs that run or outsource large contact centers can manage each side of it. The market has three sides: the buyer’s demand, the agent’s supply, and the outsourcing terms that set the rules of the market. We first define who counts as an insider in a contact center, then take the three sides in turn. We then apply them to a contract renewal, to the question of who pays, and to what a changed operation looks like. Questions of console design and data masking, meaning how much information the support screens show, are a separate topic, and we leave them aside here.

Who counts as an insider in a contact center

An insider, in security language, is anyone who has legitimate access to an organization’s systems or data: employees, contractors, temporary staff, the staff of service providers. Insider risk is the chance that someone with that access misuses it, whether through malice, carelessness or, as here, a bribe.

Insider risk is hard to manage because the access is genuine. A burglar trips the alarm. An insider uses a key the organization handed them. Monitoring tools can spot unusual behavior, such as an agent looking up far more customers than usual, but they are looking for a needle in a haystack of normal work.

Outsourced customer support is the common practice of hiring a specialist firm, often called a business process outsourcer, to run contact centers on a company’s behalf. The provider hires and manages the agents, frequently in lower-cost countries, and the agents log into the client’s internal tools to help customers. To the customer, the agent is the bank or exchange. Legally and practically, the agent works for someone else.

That arrangement brings real benefits: lower cost, round-the-clock coverage, the ability to scale up quickly. It also places sensitive data in the hands of thousands of people the institution never hired, rarely meets and pays indirectly through a contract.

Recruited insiders are a distinct category

Insider programs usually sort cases into two kinds. The malicious insider acts on a grievance or for personal gain. The negligent insider makes a mistake: a misdirected email, a password written on a sticky note. Both start inside the organization.

The recruited insider is different. The initiative comes from outside, from someone who has identified the role, priced it and gone looking for a seller. That changes how the risk scales. A grievance arises in one person at a time. A recruiter can approach dozens of agents in a week, and only needs a few to accept.

It also changes what controls can do. Programs tuned to spot disaffection, such as watching for poor reviews, resignations or conflicts with managers, will miss an agent who is content at work and simply wants extra money. The signal a recruited insider gives off is behavioral, in what they look up, rather than emotional.

There are neighboring categories worth keeping apart. A coerced insider is threatened rather than paid, sometimes after a first small sale gives the buyer something to threaten them with. A planted insider is hired under false pretenses to begin with. Each calls for slightly different defenses, but all three share the feature that matters here: the organization’s own hiring and sourcing choices decide how exposed it is.

The rules already say these people are your problem

Financial regulation has long treated a service provider’s staff as the institution’s responsibility, though the specific rule depends on the charter.

• Banks fall under the interagency guidelines implementing the Gramm-Leach-Bliley Act’s safeguards provisions. They require banks to oversee service providers and to bind them by contract to protect customer information. Under the Bank Service Company Act, bank regulators can also examine many of those providers directly.
• Credit unions follow the NCUA’s Part 748 security program rules. The NCUA, unlike the bank agencies, has no general authority to examine credit union vendors, so contract terms carry more of the load.
• Broker-dealers and registered investment advisers fall under Regulation S-P. The SEC amended it in May 2024 to require written service provider oversight and a 72-hour breach notice from providers to the firm.
• Nonbank fintechs, including many payment and lending firms, generally fall under the FTC’s Safeguards Rule. Since May 2024, it has required notice to the FTC of breaches affecting 500 or more consumers.
• Firms licensed in New York, including virtual currency businesses, also answer to the Department of Financial Services cybersecurity regulation, Part 500, which has specific requirements on access privileges and third-party providers.

No rule says “manage the bribe market.” All of them assume the institution knows who can see customer data, under what controls, and with what evidence. Organizations should check with counsel on exactly which apply to them.

Why the data is worth stealing

The criminal business model that exploits this is called social engineering: manipulating people rather than machines. A fraudster who knows a customer’s name, phone number, balance and recent transactions can call them and claim to be from the company’s security team. The fraudster can then talk them into “moving funds to safety,” straight into the fraudster’s wallet. The stolen data is what makes the call believable.

The script usually runs in a recognizable order. The caller cites a real recent transaction to establish credibility. They warn of a compromise and create urgency. They then direct the customer to act, often through a new wallet or account the fraudster controls. Every element of that script depends on details a support console shows by design.

Government ID images have a second use. They can help open accounts in the victim’s name at other institutions, or pass identity checks during account recovery elsewhere. A leak from one firm’s support floor can turn into fraud at a firm that was never breached.

The buyer’s demand: what a support seat is worth

A support agent at a financial firm can usually see enough to make a customer an easy target. Name, phone number, balance and recent activity let a fraud ring call a customer while posing as the firm’s security team, with details that make the call believable. For crypto holders, whose transfers are hard to reverse, that script is especially lucrative. Once a crypto transfer is confirmed, there is usually no bank to call and no chargeback to file.

The Coinbase cost estimate shows the scale: the firm put its exposure at many times the extortion demand. That gap is instructive. The value of the data to criminals, and its cost to the firm, lies not in the ransom but in what the data enables.

Bank customers face the same script

It would be comforting to treat this as a crypto problem. It is not, for a structural reason. Many bank scams work by persuading customers to send money themselves, by wire, instant payment or person-to-person app.

The Electronic Fund Transfer Act and Regulation E protect consumers against unauthorized electronic transfers. Whether a transfer the customer was tricked into making counts as unauthorized has been contested, and customers who press the button themselves often bear the loss. Wires to a fraudster are also hard to recall once the funds have moved on.

So a bank’s support data supports the same impersonation script, with somewhat better odds of recovery than crypto but not good ones. Broker-dealer data adds another route: a fraudster who knows enough to pass an account recovery check can sell holdings and move the proceeds. Wealth managers hold fewer clients, but each one is worth more, which makes a single compromised assistant valuable.

How the buying works

Recruitment for insider access is not new, and some of it has been public. In 2022, the LAPSUS$ group openly advertised on Telegram for insiders at telecom carriers, large software companies and call center operators. In April 2024, T-Mobile and Verizon employees reported unsolicited text messages offering cash to carry out SIM swaps.

The common pattern is easy to describe. Recruiters find agents through professional networking sites, where people list their employer, or through messaging groups. The first ask is small, such as a single lookup or a screenshot. Payment comes per record or per task, often in crypto. Once an agent has sold once, the buyer holds evidence against them, and the relationship can shift from bribery to coercion.

Demand also has a structure. Criminal buyers prefer seats that can view many customers, high-balance customers, and identity documents. They prefer large sites, where one recruiter can approach many agents through social media or messaging apps. They prefer locations where a modest payment is large relative to local wages.

Each of those preferences is visible in advance to a firm planning a support operation. A sourcing team choosing between two providers, or deciding which queues to send offshore, is in effect deciding how attractive its operation will look to a buyer. Security teams should brief procurement on them before the next sourcing decision, not after a disclosure.

What a demand assessment contains

A demand assessment can be a short document. For each support queue it records what an agent can see and how many customers an agent can reach in a shift. It notes whether the queue handles identity documents or high-value accounts, and where it is staffed.

From that, a security team can rank queues by their value to a buyer. A queue that resets online banking passwords and sees only a name and the last login date ranks low. A queue that handles account recovery for high-balance customers, with ID images on screen, ranks high. The ranking does not require a threat intelligence budget. It requires someone to read the support tools with a criminal’s eyes.

The agent’s supply: wages, tenure and consequences

On the other side sits the agent’s calculation. Large support operations, especially outsourced ones in lower-cost locations, often run on modest pay and high turnover. An agent who expects to leave within a year, earns little and faces at most dismissal has less to lose than a long-tenured employee with a career at stake.

That says nothing about the character of individuals. Most agents in most centers will never accept a bribe. It describes incentives the firm helped create when it bought support on price. A recruiter does not need everyone to say yes. He needs a few, out of hundreds.

Why higher pay alone does not close the gap

A natural response is to raise wages. That helps, but less than it seems. A buyer who expects to turn a list of customers into large scam proceeds can always offer more than any plausible pay rise. Firms cannot win a bidding war against fraud margins.

The economics of deterrence point elsewhere. A rational seller weighs the bribe against the chance of being caught multiplied by what happens next. Raising either factor changes the decision more cheaply than matching the bribe. Pay works best indirectly, by making the job worth keeping over years, which raises the cost of losing it.

Several levers change the calculation.

Prosecution is the strongest. An agent who knows that the provider and the client will pursue criminal charges, and that local police have done so before, weighs a bribe differently. Dismissal alone is a small price if the job was temporary anyway.

Prosecution across borders is harder than it sounds. The financial institution is usually not the victim in the eyes of local police; the provider employs the agent and must file the complaint. Evidence has to be preserved in a form local courts accept. Requests between national authorities are slow. Unless the provider has committed in advance to referring cases and supporting them, the default outcome is a dismissal and nothing more.

Tenure is another. Programs that pay retention bonuses or offer a path into better-paid roles raise the cost of losing the job. An agent with a promotion in sight has a future to protect.

Reporting is a third. A confidential channel for reporting bribe approaches, with a reward large enough to matter locally, turns some recruitment attempts into intelligence. Each report tells the firm who is recruiting, how and where. The best-known case shows the payoff. In 2020, an employee at Tesla’s Nevada factory reported an offer of $1 million to install malware, and worked with the FBI, which arrested the recruiter. The recruiter later pleaded guilty.

Clarity is the fourth. The same messaging channels criminals use to recruit can be used to warn: periodic briefings that describe real approaches remove the ambiguity a recruiter relies on. A message that says “someone may offer you money to share screenshots; this is what an approach looks like, and this is what happens to people who accept” is hard to misread.

Where the work happens

Many contact centers moved agents home in 2020, and some never moved them back. Home working widens the pool of agents and keeps service running through disruption. It also removes most of the physical controls that make copying hard.

On a supervised floor, a no-phone rule can be enforced, screens are visible to team leaders and colleagues notice odd behavior. At home, an agent can photograph a screen with no one in the room. Virtual desktops that block copy, paste and printing help, but a phone camera defeats them.

The trade-off is genuine, and neither answer is obvious. A reasonable split keeps high-value queues on supervised floors and lets lower-value queues work from home. The choice should be made deliberately, queue by queue, and recorded with its reasons.

The market rules: what the outsourcing contract says

Most institutions never set a wage at their outsourcing provider. They do set the contract, and that is where the market’s rules are written.

Contact center contracts are typically priced per contact or per agent hour, with service levels on handle time (how long each call takes) and answer speed. Those terms reward the provider for cheap, fast seats with broad access. They are silent on most of what drives insider risk. In effect, the contract tells the provider exactly what the institution values, and security is not on the list.

How the pricing shapes the floor

Per-contact pricing has predictable effects. Providers want each agent to resolve as many contact types as possible without escalation, because escalations add handle time. So they train generalists and ask for broad tool access. Specialist queues with narrower access cost more to run, because agents sit idle when their queue has little traffic.

Turnover follows the same logic. Under per-contact pricing, the cost of training new agents falls on the provider, which therefore wants short training. Short training means less time spent on security awareness and less time to get to know an agent before granting access. The provider is acting in good faith. It is responding to what the price signals ask for.

A better contract adds terms the provider must evidence:

• Screening standards equivalent to the institution’s own, adapted to local law.
• Attrition reporting by site and team, because sudden churn can signal a recruitment campaign.
• On-site work for seats with customer data, with no personal phones on the floor, since a phone camera is the simplest way to copy a screen.
• Removal of an agent within a set time on the institution’s request.
• A commitment to refer misconduct to law enforcement and support prosecution.
• Near-real-time access logs delivered to the institution’s own monitoring team.

The clauses that decide who pays

Beyond those operating terms, a handful of commercial clauses decide how an incident’s cost is shared. The Coinbase filing pointed at them when it cited indemnification claims and potential recoveries.

• Liability caps. Outsourcing contracts often cap the provider’s liability at a multiple of annual fees. A separate, higher cap for data breaches is common in well-negotiated deals.
• Indemnities. These set whether the provider covers losses caused by its personnel, including customer reimbursements the institution chooses to make.
• Insurance. Contracts can require the provider to carry cyber and crime insurance. Crime and fidelity policies often cover employee theft of money, and may not respond to theft of data. Institutions should read the wording with their broker.
• Subcontracting and location. These clauses require approval before work moves to a new site or a subcontractor, so the institution knows where its seats are.
• Audit rights. These allow on-site inspection, in addition to review of the provider’s certification reports.

Regulators have long been clear about where responsibility sits. The interagency guidance on third-party risk management issued in 2023 by the US banking agencies is explicit that outsourcing an activity does not outsource responsibility for it.

What an examiner would ask to see

For a bank, the evidence trail follows that guidance’s life cycle: planning, due diligence, contract negotiation, ongoing monitoring and termination. A file that would survive an examination shows the risk assessment that ranked the support activity, the due diligence on the provider’s screening and controls, and the contract terms. It also shows monitoring evidence: attrition reports received, log reviews performed, issues raised and closed, and records of agents removed.

The weak spot in most files is ongoing monitoring. Due diligence happens once, at signing. A file with a thick onboarding pack and two years of silence tells an examiner the institution stopped looking.

Those terms cost money, and providers will price them. That is the trade-off institutions should make openly. A support contract that is a few percent dearer but comes with supervision, evidence and enforcement may be far cheaper than one incident.

Options for smaller institutions

A community bank or credit union rarely negotiates a bespoke contract with a global provider. It may buy contact center services through its core processor, a credit union service organization or a small regional firm. Its bargaining power is limited.

It still has options. Standard security addenda, written once and used across vendors, ask for the same evidence every time. Shared contracts negotiated by a group of institutions carry more weight than one small buyer. Independent audit reports, such as SOC 2 reports, help, but only if someone checks whether personnel screening and access logging fall within the tested controls. The report also lists “complementary” controls the client must run itself, and those are often ignored.

The limits of detection

Coinbase’s experience also shows the limit of detection alone. The company spotted the improper access in the months before the extortion attempt, and the data was already gone. Terms that shrink demand and supply work before data leaves.

Detection struggles here for a structural reason. Monitoring tools look for behavior that stands out: an agent viewing records at odd hours, opening far more accounts than colleagues, or searching for customers unrelated to any open ticket. A careful insider who copies a few records during each normal shift, perhaps by photographing the screen, looks very much like an agent doing the job. By the time a pattern becomes visible across weeks of activity, the data copied in the early days is already in the buyer’s hands.

Detection still matters, because it limits how long a leak runs and identifies who to remove. A few techniques narrow the window. Matching every customer lookup to an open ticket or call catches browsing with no business reason. Seeded decoy records, customers who do not exist, reveal a leak when someone contacts them, and the access logs show which seats viewed them. Visible on-screen watermarks with the agent’s identifier deter photography and make a leaked image traceable. Each of these reduces the damage. None prevents the first sale. Prevention lives in the earlier choices about who can see what, where they work and what they stand to lose.

Concentration is a final market rule. Many institutions place most of their support volume with one provider at one or two sites. That makes the operation easier to manage and easier for a recruiter to target. Splitting high-access work across sites, or keeping the most sensitive queues in-house while outsourcing routine contacts, changes where a buyer can shop. It also adds management overhead, which is why the decision belongs in the sourcing case rather than in an after-the-fact security review.

A regional bank renews its support contract

Take a regional bank whose contact center contract with an outsourcing provider is up for renewal. The provider runs two large sites abroad and handles most of the bank’s customer calls. The current contract is priced per contact, with targets for answer speed and handle time.

In the old way of doing things, procurement would run a price comparison, negotiate a modest discount and renew. The security team would learn the details later.

This time, the chief operating officer asks security to brief procurement first. The briefing is short: which queues can see balances and identity documents, how many agents sit in each, and what a criminal buyer would find attractive. Procurement then splits the work. Routine queries, such as resetting online banking access, stay with the provider. Queues that can view identity documents and high-balance accounts move to a smaller in-house team.

The renewed contract adds the six evidenced terms above. The provider must report attrition monthly by team, deliver access logs to the bank daily and commit to referring misconduct to police. The bank funds a confidential reporting channel with a reward large enough to matter locally, and quarterly briefings describe real approaches.

Sequencing and owners

The order of work matters, because the contract is the institution’s main bargaining moment. The demand assessment comes first, owned by security with input from the contact center operations lead. The sourcing decision follows, owned by the chief operating officer. Contract terms come third, drafted by procurement and legal from a security-written schedule. Transition comes last, with the in-house team stood up before the high-value queues move.

A renewal that starts this work three months before expiry will run out of time. Twelve months is more realistic for a bank of this size, because hiring and training an in-house team takes most of a year.

Measures the bank tracks afterward

The bank sets a small number of measures and reviews them quarterly with the provider:

• Share of customer lookups matched to an open contact or ticket, by queue.
• Agent attrition by site and team, with any sudden spike investigated.
• Time from a removal request to the agent’s access being revoked.
• Number of bribe approaches reported, and how quickly each was acted on.
• Referrals to law enforcement and their outcome.

A rise in reported approaches is not bad news in itself. It may mean the reporting channel is working. A long run of zero reports at a large site is the more worrying signal.

The new contract costs more per contact. The board approves it after the chief risk officer frames the decision plainly. The extra cost is a premium against an incident whose costs, as the Coinbase estimate shows, can run to many times any ransom demand.

The same renewal elsewhere

A credit union that buys member service through a credit union service organization has less room to move work in-house. It can still insist on the attrition and log terms and ask for evidence at each annual review. Because the NCUA cannot examine the provider directly, the credit union’s own file is the main record of oversight.

A broker-dealer faces a sharper rule. Amended Regulation S-P requires written policies for overseeing service providers that handle customer information, and a breach notice from the provider within 72 hours. FINRA also expects member firms to supervise outsourced functions as if they performed them. The contract renewal is the obvious moment to align terms with those obligations.

A fintech that relies on a partner bank faces two sets of demands. Its own regulators set one. The partner bank, which must manage the fintech as a third party, sets another, often in more detail. A fintech that outsources support may find its bank asking the same questions about the provider that an examiner would.

Who pays when a seat is sold

Money. The direct costs of an insider data theft include investigation, reimbursement, legal work and customer support. The Coinbase range of roughly $180 million to $400 million is a sobering reference point.

Customers. The harm lands on people who receive convincing scam calls and lose savings. Even when a firm reimburses them, trust is damaged. Customers whose ID images leaked carry a longer tail of risk, since a passport or license cannot be reissued as easily as a card.

Regulators. Banking supervisors expect institutions to manage third-party risk as if the activity were in-house. A contract with no security terms and no evidence is hard to defend.

The notification clocks also differ by charter. A bank must notify its primary federal regulator within 36 hours of determining that a significant computer-security incident has occurred. A federally insured credit union must notify the NCUA within 72 hours of forming a reasonable belief that a reportable incident occurred. A public company files its 8-K within four business days of determining materiality. State breach laws add customer notices with their own deadlines. A single bribed agent can set all of these running at once.

Staff. Support agents are not the enemy. Clear rules, real consequences, fair pay and a safe way to report approaches protect honest agents from pressure and from suspicion.

Objections, and where they hold

The market framing has serious critics, and some of their points hold.

The first objection is that in-house staff take bribes too. They do. The telecom SIM-swap cases involved carriers’ own retail and support staff. The argument here is about terms, not geography. In-house staff are cheaper to deter only if the institution actually gives them more to lose and supervises them more closely.

The second is that incidents are rare, so the premium for better terms is hard to justify on expected losses. For low-value queues, the challenge is fair. For queues that can see identity documents and high balances, the size of the tail, as Coinbase showed, changes the calculation.

The third is that privacy and labor law in some provider countries limit monitoring and screening. They do, and that is a reason to design controls around what is lawful locally, such as supervised floors and narrower access, rather than to drop them.

The fourth is that bringing sensitive queues in-house concentrates them in a smaller, less resilient team. The cost is real. A firm can mitigate it with a second in-house site or a second provider, but either adds expense. The decision belongs to the same sourcing case, made with the trade-off stated.

The three parts point to one operating rule. Assume some people with access will be offered money, and manage the terms of that offer through sourcing decisions. Those decisions belong in workforce and procurement planning, where support capacity is bought, rather than being left to the security program that inherits the result.

Spending differently, not necessarily more

An institution that has absorbed the lessons of this case does not necessarily spend dramatically more on support. It spends differently, and it can show its reasoning. In practice:

• Security has a seat in sourcing. Before any contact center contract is signed, renewed or moved, the security team describes what each queue can see and how attractive it would be to a criminal buyer. That briefing shapes the decision rather than arriving afterward.
• Access follows need. The queues that can view identity documents and high-balance accounts are smaller, more closely supervised and, where it makes sense, kept in-house. Routine work goes where it is cheapest.
• The contract carries evidence. Screening, attrition reporting, on-site rules, removal rights, law enforcement referral and log delivery are written in, and the provider has to prove them rather than promise them.
• Consequences are real and known. Agents know that misconduct leads to prosecution as well as dismissal, because they have seen it happen.
• Honest agents have an ally. A confidential reporting channel with a meaningful reward exists, is publicized and is used. Reports feed the monitoring team.
• Monitoring is fed in time. Access logs reach the institution quickly enough to act while a pattern is forming, not months after the fact.

The failures are the reverse of each of these. The first is buying support on price alone, so that the only signals the provider receives are about speed and cost. The second is treating insider risk as a monitoring problem only, hoping that a clever tool will catch misuse before harm is done; as Coinbase found, detection can come after the data has left. The third is assuming dismissal is a deterrent, when for a short-tenure agent it may cost little. The fourth is concentrating all high-access work in one place, which hands a recruiter a single, well-stocked shop. The fifth is leaving security out of sourcing decisions until after the contract is signed, at which point the terms that matter most can no longer be negotiated without reopening the deal.

These failures rarely reflect bad intent. Each is the natural result of buying a service the way most services are bought, on price and service levels. The case for change is simply that customer support at a financial firm is not an ordinary service. The seats come with keys to customers’ lives.

Where the money moves

The budget shifts are modest but specific. Some spending moves from per-contact fees to a higher rate for supervised, on-site, high-value queues. Some moves to an in-house team for the most sensitive work. A small amount funds the reporting channel and its rewards. Some security analyst time moves from general alert triage to reviewing support access patterns.

Savings exist too. Narrower access in routine queues lets the provider staff them with less vetting effort. Clearer evidence shortens examinations and vendor reviews. A smaller set of high-value seats is cheaper to monitor well than a large set monitored poorly.

Where a sourcing review should start

A review does not need a new program. It needs the people who buy support, the people who run it and the people who secure it in one room, with five questions in front of them.

1. Which of our support queues can see balances, identity documents or many customers at once, and who staffs them?
2. How are our support contracts priced, and do they say anything about screening, attrition, phones on the floor, removal rights or prosecution?
3. Do we receive access logs from our providers in time to act on them, and how quickly could we remove someone and refer them to police?
4. Is there a confidential, rewarded way for agents to report bribe approaches, and when did we last brief agents, including those at our providers, on what a real approach looks like?
5. How concentrated is our high-access support work by provider and site, and did security brief procurement before our last sourcing decision?

The answers usually come from different teams, and the gaps between them are the finding. Procurement knows the price, operations knows the queues, and security knows the logs. A firm that cannot assemble all three in one document has not yet decided what its support seats are worth.

With hindsight

In its own account of the incident, Coinbase said the people affected were less than 1 percent of its monthly transacting users. It said the attackers’ aim was a customer list they could call while posing as the company. That confirms the business model described above: the stolen data was raw material for social engineering, not a way to break into accounts directly.

Its own account also confirmed what the filing implied: the insiders were support staff using access they held to do their jobs. There was no sophisticated hack of Coinbase’s systems to explain away. The weakness lay in how much ordinary support roles could see and in the incentives of the people sitting in those seats.

The market itself took the disclosure in stride. Coinbase joined the S&P 500 on May 19, 2025, as scheduled. Investors treated the incident as a large operating cost rather than a threat to the business. Their reaction fit where the harm fell: on customers who were scammed and on the firm’s remediation budget.

What held up through 2026 is the market framing. The case was cited throughout 2025 alongside help-desk social engineering attacks on retailers and insurers, as evidence that attackers were investing in people with access. In April and May 2025, attacks on Marks & Spencer and the Co-op in the UK were widely attributed to criminals who talked their way past help desks. In July 2025, the UK’s National Crime Agency arrested four people in connection with those attacks. Across sectors, the pattern looked similar: criminals had worked out that persuading or paying the humans who sit between a company and its customers is often easier than defeating technical defenses.

A related supply route grew more visible at the same time. In June 2025, the US Justice Department announced coordinated actions against schemes that placed North Korean IT workers in remote jobs at US companies under false identities. Those were planted insiders rather than bribed ones. The defense overlapped with the one argued here: screening, location rules and evidence about who is actually doing the work.

The rules also moved, in some places. The SEC’s amended Regulation S-P reached its compliance dates on December 3, 2025, for larger broker-dealers and advisers, and June 3, 2026, for smaller ones. Service provider oversight and a 72-hour provider breach notice became examinable obligations for those firms. Credit unions saw no equivalent change. The NCUA had for years asked Congress for authority to examine vendors directly, without getting it.

The weakest point in many institutions remained the outsourcing contract itself, still priced per contact. Contracts written that way continue to reward speed and cost while staying silent on screening, logging and enforcement. Institutions that renegotiated those terms gained evidence and enforcement rights that a per-contact price never buys.

Two limits of the framing deserve stating. Moving support onshore, as Coinbase said it would partly do, changes the local price of a bribe but does not remove the market; the SIM-swap offers went to US carrier staff. And the framing says less about coerced and planted insiders, who respond to screening and supervision more than to pay and reward.

Nor can we say how many institutions renegotiated their support contracts after the case. That kind of change rarely becomes public. The gap is itself telling: support sourcing terms remain among the least disclosed parts of a financial firm’s security posture, even to its own board.

The case is a reminder that security outcomes are often decided far from the security team. They are decided in procurement meetings, in workforce plans and in the clauses of contracts that few executives read closely. The most useful response is not a bigger monitoring tool. It is a sourcing decision made with the buyer, the seller and the rules of the trade in view. It also takes a willingness to pay a little more for support that comes with supervision and consequences.