So, I received an invite to trial Coinbase One for one month recently.

I did a search on the sub, and apparently literally nobody actually read the User Agreement. Posts of people liking the false sense of security of a non-existant "account protection" policy up to 1 million dollars, no trading fees, etc. We'll get into all that, don't worry.

I'll be breaking down the three main points they're selling with this subscription in their advertisement of this "service", in the order they are being presented, while quoting relevant terms directly from: https://www.coinbase.com/legal/user_agreement/united_states/

1) Zero trading fees - Unlock your portfolio’s potential and trade as much and as often as you want with $0 in trading fees.

Nobody likes fees. What's the fine print say?

Section 5: Coinbase One

1. Coinbase One Subcription. Eligible Users may sign up for Coinbase One which is an automatically renewing subscription requiring recurring payments. A Coinbase One subscription grants you the benefits of: (a) a waiver of Coinbase fees for buying, selling, and converting digital currencies on the Coinbase platform (which does not include Coinbase Pro’s order matching platform), provided that a spread in the price is still included in all buys, sells, and conversion of digital currencies on the Coinbase trading platform ...

You read that right? Market buys on Coinbase only. No Coinbase Pro. Market buys only on regular Coinbase. That spread might as well be considered a fee. Things get uglier, just wait.

2) $1M account protection - Members may be eligible to receive reimbursement for up to $1M in losses caused by unauthorized access.

This is the deceit that I felt needed brought to the forefront the most, as soon as possible. $1M in account protection could sound nice, especially these days with all the phishing, viruses, keyloggers, you name it flying around. Let's have a closer look at those terms.

Section 5: Coinbase One

... and (c) Coinbase Account Protection as detailed in paragraph 3 below. Coinbase may modify or suspend this program at any time upon notice.

Well that's not a great start, but let's keep digging.

Section 3: Coinbase Account Protection

Coinbase Account Protection. With an active Coinbase One subscription, you may be eligible to receive a one-time reimbursement for up to $1,000,000 (U.S. Dollars) of actual losses (or the U.S. Dollar equivalent thereof, in the case such losses were in the form of Digital Currency) that you sustain due to a compromise of your Coinbase Account login credentials resulting from a vulnerability or other deficiency in Coinbase’s systems and/or security protocols (the “Coinbase Account Protection”). The Coinbase Account Protection is subject to the terms and conditions set forth in this [Paragraph 3] (the “Coinbase Account Protection Warranty Terms”), which apply in addition to the terms of the Agreement and any other terms and policies set forth on the Coinbase Site.

3.1.4. 2-factor authentication with either an authenticator application (e.g., Duo or Google Authenticator), security key (e.g., Yubikey) or push notification through the Coinbase mobile application must have been enabled on your Coinbase Account at the time you sustained the Reimbursable Losses. 2-factor authentication via SMS is not sufficient to be eligible for coverage under the Coinbase Account Protection.

That seems reasonable, SMS protection is very weak compared to TOTP MFA, a security key, or a security app's push notifications.

But now let's get into the ugly and why this account protection isn't really any protection at all.

3.2. What is Not Covered.

3.2.1. The Coinbase Account Protection does not cover reimbursement for any loss of funds held outside of your Coinbase Account, including without limitation in Coinbase Custody, Coinbase Wallet, or non-custodial wallets connected to Coinbase Commerce.

...

3.2.4. The Coinbase Account Protection does not cover reimbursement for any losses that were the result of a security vulnerability or other technical deficiency in your computer, mobile device or security key.

3.2.5. The Coinbase Account Protection does not cover reimbursement for any losses that were the result of an event or action that you were aware could result in compromise of your account security, if you failed to promptly notify Coinbase of such occurrence in accordance with Section 6.2 (Security Breach) of the Agreement. Examples of such occurrences include, without limitation, if you lose your security key or API key, if you grant a third party remote access to your account, or if you provide your Coinbase Account login credentials and/or 2-factor authentication codes to a third party.

3.4. Other Terms. In the event of a conflict between these Coinbase Account Protection Warranty Terms and anything else in the Agreement, these Coinbase Account Protection Warranty Terms will govern. Notwithstanding the foregoing, you are still primarily responsible for ensuring the security of your Coinbase Account, and if you suspect that you have been the victim of a Security Breach, you must notify Coinbase Support as soon as possible in accordance with Section 6.2 of the Agreement. The Coinbase Account Protection is not an insurance policy. To the extent you require protection beyond the Coinbase Account Protection, we strongly encourage you to purchase an insurance policy or other protection that provides coverage for unforeseen events that may result in the loss of funds held in your Coinbase Account.

Well now we know we're where we need to be, when they're literally suggesting you get an insurance policy, excluding all security vulnerabilities of your devices, and excluding if you provide your credentials and/or MFA to a third party. Use an app to generate TOTP MFA codes? That's a third party. Use a password manager to generate extremely secure passwords? That's a third party. Surely they can't really mean all this, right?

Section 5: Data Protection and Security

5.2. Security Breach. If you suspect that your Coinbase Account or any of your security details have been compromised or if you become aware of any fraud or attempted fraud or any other security incident (including a cyber-security attack) affecting you and/or Coinbase (collectively a "Security Breach"), you must notify Coinbase Support immediately at https://help.coinbase.com or (888) 908-7930 and provide accurate and up to date information throughout the duration of the Security Breach. You must take any steps that we reasonably require to reduce or manage any Security Breach. Prompt reporting of a Security Breach does not guarantee that Coinbase will reimburse you for any losses suffered or be liable to you for any losses suffered as a result of the Security Breach.

5.3. Computer Viruses. We shall not bear any liability, whatsoever, for any damage or interruptions caused by any computer viruses or other malicious code that may affect your computer or other equipment, or any phishing, spoofing or other attack. We advise the regular use of a reputable and readily available virus screening and prevention software. You should also be aware that SMS and email services are vulnerable to spoofing and phishing attacks and should use care in reviewing messages purporting to originate from Coinbase. Always log into your Coinbase Account(s) through the Coinbase Site to review any transactions or required actions if you have any uncertainty regarding the authenticity of any communication or notice.

Yup, they definitely meant all that. If you get malware of any sort you're not covered. If you get phished, you're not covered. Now that we've broken this all down, I'm trying to think of a single scenario you might be covered, and all I can come up with is if Coinbase itself experienced a breach.

I don't even feel like going onto their final advertisement point of 24/7/365 customer support at this point, but that'll be a quick one.

3) 24/7 priority support - Your dedicated Coinbase One team is standing by to help at a moment’s notice. Available 24/7/365, including weekends and holidays.

Section 5: Coinbase One

... (b) a dedicated customer support line available twenty four (24) hours a day, seven (7) days a week, three-hundred and sixty five (365) days a year ...

There aren't much details in the terms on this, but in reviewing other posts in this sub and others, as well as a few blogs - guess what? Your "dedicated customer support line" is a line to a call center rented by Coinbase. The people you'll talk to don't even work for Coinbase. So basically, you've paid for an answering service like CallRuby. They'll be happy to read you some scripted responses, take down notes, and pass them along to Coinbase so Coinbase can try to assist you at a later point though.

I know this has been long, but I condensed it as much as I could. Always read the terms. This $30/month subscription service is literally offering you nothing, near-everything is excluded in their terms.

Edit: To clarify for some commentors, I do not participate in the moons program. So if you're sending them, you're burning them. Also, if you're considering giving this post awards that cost money, please don't. A simple upvote, a thank you, and ideally sharing this post any time you see somebody mentioning Coinbase One would be more than enough for me. If you really want to do a bit extra - please make a donation to ProjectHOPE instead of buying awards from reddit on my behalf:

https://www.projecthope.org/crisis-in-ukraine-how-to-help/04/2022/