
Kraken's new in-app verification banner and one-time code let users confirm a support callback is legitimate before moving funds, countering a surge in impersonation scams.
Kraken has extended its in-app call verification system to standard phone callbacks, giving customers a way to confirm they are speaking with a legitimate support agent before moving funds or changing account settings.
The feature, announced August 6, shows a verification banner inside the Kraken app when a real support agent calls. A customer's callback is registered as verified when their support case is active with the agent. They can open the app, check the confirmed banner, and Kraken will also generate a one-time verification code. Users ask the caller to read the code back. If it matches the one displayed in the app, the caller has real access to the support case.
Chief Security Officer Nicholas Percoco framed the move as a direct response to a fraud tactic that has become one of the crypto industry's most effective.
“Scammers are calling our clients pretending to be Kraken Support, or reps from other crypto firms. The script rarely changes. They tell you there’s a security issue with your account and you need to move your funds somewhere safe now,” Percoco said in a LinkedIn post.
The feature is live on the latest versions of the Kraken app, Kraken Pro, and Kraken's other mobile apps. For calls the exchange cannot verify, Kraken added stronger warnings. If a user tries to withdraw funds or change sensitive account settings while on an unverified call, the app displays an extra alert and reminds them of common scam tactics.
The exchange says the additional layer makes it harder for scammers to impersonate company representatives during social engineering attacks.
The security push comes as the industry deals with attacks on multiple fronts. Days before the announcement, security researchers flagged a flaw in older versions of Coldcard hardware wallets that allowed attackers to exploit weak key generation and drain roughly $100 million in bitcoin from more than 1,000 wallets. Users with vulnerable devices were told to generate new seed phrases and move their assets.
Kraken's new feature targets the other side of the problem. Instead of exploiting software bugs, scammers increasingly pose as exchange support staff. They tell users their accounts are compromised and direct them to transfer assets to attacker-controlled wallets or hand over credentials.
That social engineering approach has pushed exchanges to invest in user verification alongside traditional cybersecurity. Kraken's in-app code check is one version of that response. The verification banner is the visible part. The system itself hinges on whether the caller can prove access to the active support case.
Percoco's message is that the scam script has not changed in years. The industry's answer has been to make the verification step harder to fake. Kraken is now betting that a code matched against an active support case in the app is enough to break the impersonation loop.
Drafted by a large language model from the source reporting linked above, then screened by automated publishing checks. It is not read by a journalist before publication. Some articles cite our Alpha Score. Verify prices and figures against the original source. Educational coverage, not personalized advice.