The Dreaded 2FA Google authenticator for Coinbase

If anyone is using Google authenticator for anything related to Cyrptocurrency, or any account whatsoever connected to it, Please...oh please take the time to back up the current key you're using it on after reading this.

As for anything account related, I make sure that I back up everything up to the point I write it down on paper. Up to the point that I enabled Google Authenticator for Coinbase. Assuming that it is connected to my email, I should have a way to recover the key in case my device is lost. Well thats what assumption does, you just assume it is and not being entirely sure.

I enabled Google Authenticator on June 4, 2017 @ 12:33 am

A month passed and having spent 3 weeks vacation. Using my iPhone 7 in 2 resorts and basically diving with it in the ocean I may have messed up my Apple pay chip (I'm assuming here) from working. My phone still works as per usual except for the Apple pay function. To cut the long story short, I needed to replace my phone.

After a few days, I was in the process of transferring some Bitcoin to another wallet, when the most dreadful thing happened that it felt that I was flushed over with a bucket of cold water. Coinbase asks me to re-login to my account! I then initiated the login but now it assks for the Google Authenticator 2FA pin.

I'm not yet panicking at the time as I know I've backed up everything in iCloud and even my desktop computer.

However, upon doing these different recovery options, Google authenticator is a tough nut to crack, because unless you have the back up key, it wont allow you to authenticate again for Coinbase.

I then try to recover via Coinbase itself by selecting the option for "I've lost my Google Authenticator 2FA". This is where it gets bonkers....the system will ask you to submit an image of your verified ID using your device's webcam! And the end result is that it wont work at all due to the fact that most valid IDs or passport that is being accepted by Coinbase has a hologram printed onto the ID which will then cause the application to reject the photo being captured.

So this is what I've tried so far; I used an iMac, opened Google Chrome and tried the account recovery. The system will then ask you to take capture of the front of your ID, the back of the ID and a selfie of yourself. After careful positioning of the ID, you will notice it will always capture a blurred image due to the fact that you're indoors and just using LED or Fluorescent light, and you're ID has a hologram in parts of it that will definitely blur out the text or your photo.

The end result is that it will say your image cannot be captured and has been rejected...and to try again.

After countless tries, and even used different devices it's frustrating to say it just wont work.

I then contact Coinbase Support. Which apparently was more depressing than their system not accepting the rejected webcam images. It took the support to contact me 3 days for another canned message to try to take a photo of the webcam image under a well lit area, such as direct sunlight. Which, I have already done.

It took close to 2 weeks for the back and forth emails asking me to try again, until finally I informed them that if he doesn't take me seriously I will need to file a complaint to the BBB. Then he asked me to try to submit another recovery via the webcam again and inform him after I've done so. It also rejected the image, but i informed support anyway. After 2 days, I receive an SMS that my 2 Factor settings for Coinbase has changed and that I should be able to login to my account now.

Recovered account: July 17 @ 11:12 pm

I was able to login afterwards. I don't really want to blame anything on support as they have their SOPs especially recovering from 2FA. However, I think their website recovery tool has been broken some time now and no one really cares to fix it. I just would like to share this really tiring experience in getting back my Coinbase account and hope it makes you check if you have all your recovery keys for Google authenticator.

I've now embraced this new rule, that I'f im not sure what it is, I wont enable it.