Uphold Scam Email: The Fake Data Breach Message, How to Spot It, and What to Do If You Got One

The email arrives looking like the one message you are not supposed to ignore. "Uphold Security Notice: Please Contact Us." A third-party data breach, it says. Your email address, your name, your transaction logs — possibly exposed. And then the part that should stop you cold: don't click anything, don't log in anywhere, just call the Uphold Security Hotline and have your verification code ready.

I read the full message, checked it against Uphold's own published guidance, and compared it with what a real breach notice from a financial platform actually looks like. The verdict is not close. This email is a scam — a phone-based phishing campaign, known as vishing, that uses a fake breach as the excuse to get you on a live call with a stranger. Here is the message taken apart, the five tells that expose it in under a minute, and exactly what to do if you already picked up the phone.

The Email, Line by Line

The version of this scam that security researchers at BotCrawl documented reads like a form letter from a compliance department. It opens with a subject line designed to bypass your scepticism — "Uphold Security Notice: Please Contact Us" — and then states, in calm procedural language, that on December 17, 2025, Uphold's security team discovered a third-party service provider had suffered a data breach. It lists the data that "may have been exposed": email addresses linked to Uphold accounts, names and contact details, account backup and recovery preferences, and transaction and activity logs.

Then come the next steps, and this is where the whole thing gives itself away. Step one: contact the Security Response Team using the number below. Step two: verify your account status with a security specialist. Step three: follow the guidance provided. The number printed in the sample is +1 (888) 278-1174, labelled the "Uphold Security Hotline". Below it sits a "security verification code" — UP-372330 in the sample — with instructions to have it ready when speaking with the team.

Do not call that number. It belongs to the scam operation, not to Uphold, and scam numbers rotate: the same campaign can reappear tomorrow with a different one. What matters is the pattern, not the digits.

Three things about this message are worth noticing before we get to the checklist. First, it never links to anything real. There is no link to an Uphold status page, no link to a written breach notice, no link to your account dashboard. Every path in the email leads to the same phone number. Second, it is written to sound reassuring rather than alarming — a measured tone, specific-sounding data categories, a tidy three-step process. That is deliberate. Panic makes people suspicious; procedure makes people compliant. Third, the verification code is a prop. Real security teams do not hand you a code in an unsolicited email and then ask you to read it back to a stranger as proof of identity. The code exists to make the phone call feel like the middle of an official process instead of the beginning of a con.

Five Tells That Expose It in Under a Minute

You do not need security software or a forensics background to catch this one. You need sixty seconds and a willingness to check instead of react.

1. The sender domain has nothing to do with Uphold. The messages in the documented campaign were sent from addresses on tarte.com, tartecosmetics.com, and awakebeauty.com — domains belonging to a cosmetics brand. Uphold publishes the complete list of addresses it will ever email you from, and none of them look like that. The full list, verified against Uphold's own help centre on November 15, 2026, is: no-reply@help.uphold.com, noreply@upholdmail.com, newsletter@unboxed.uphold.com, noreply@marketing.uphold.com, noreply@uphold.com, support@uphold.com, plus anything ending @help.uphold.com, @unboxed.uphold.com, or @uphold.com. If the sender is not on that list, the email is not from Uphold. Full stop. Check the actual sender address, not the display name — display names are trivially faked, and "Uphold Security" can sit on top of any address at all.

2. It is phone-only. A real breach notification from a regulated financial platform is a written document. It names the vendor or system involved, explains what was exposed, and gives you a way to verify the information independently — a status page, a support article, a logged-in account alert. This email offers none of that. The only action it permits is a phone call, because a live conversation is where the scammer has the advantage: they can adjust the script in real time, answer your hesitation, and escalate the urgency until you comply.

3. It names a date but no vendor. "A third-party service provider experienced a data breach" — which provider? The email never says. Real breach disclosures name names, because they have to: regulators, auditors, and affected users all need to know what system was involved. A vague "third-party provider" plus a specific date is the shape of a story invented to sound detailed while saying nothing checkable.

4. The verification code is backwards. In legitimate security flows, a code is something a service sends you so you can prove to the service that you control the inbox or the phone. Here the code arrives unsolicited and you are told to present it to a stranger. That is not verification; it is theatre. It conditions you to treat the call as an official case already in progress, so that when the "agent" asks for your real credentials or your two-factor code, the request feels like the next step in a process rather than the theft it is.

5. There is no corroboration anywhere. When I checked, there were no official announcements, blog posts, regulatory filings, or user advisories from Uphold describing a third-party data breach matching this email's claims. A breach affecting a platform with millions of users does not exist only inside your inbox. If it were real, it would be on Uphold's status page, in the press, and in your account dashboard. It is in none of those places.

Any one of these tells is enough. Together they are conclusive.

The One Real Breach the Scammers Are Borrowing

The scam works because it is not entirely invented. Uphold does have a real third-party incident in its history, and the scammers are borrowing its credibility.

In July 2022, Customer.io — an email delivery vendor Uphold used — had an incident in which a senior engineer with administrator access provided customer email addresses for multiple Customer.io clients, including Uphold, to a bad actor. Uphold published a written notice about it in January 2023, stating that customer funds were not stolen and accounts remained secure, but that first names, last names, and email addresses could have been disclosed. That disclosure matters for two reasons. First, it is what a real breach notice looks like: written, specific, verifiable, and published where anyone can read it. Second, it explains how the scammers got your address in the first place. They do not need a new breach. Old breach data circulates for years — copied into "combo lists", resold on forums, merged with data from other leaks — and an email address exposed in 2022 is still a deliverable target in 2026.

The cosmetics domains fit the same logic. Tarte itself had customer data exposed in 2017 through misconfigured databases. The scammers are not necessarily using breached Tarte systems; they are using recognizable, long-established domains that pass spam filters and look legitimate to a human glancing at a sender line. Old data, familiar names, a plausible pretext — that is the whole supply chain.

What Uphold Will Actually Do — and Never Do

Uphold's own phishing guidance, which I read on its help centre, draws the line plainly. Uphold will never call you to ask you to move your funds, and will never ask you to forward or read out a two-factor authentication code. Its phishing page adds the rest: Uphold will never ask you to move your money to a "safe account" because your money is in "danger", never ask you to move it to an alternative Uphold account, never ask for your password or PIN, and never ask for your full 16-digit card number or the three digits on the back.

So if anyone claiming to be Uphold asks you to do any of those things — on a call, by text, or by email — you are not talking to Uphold. Hang up. The real company's support team will never call you asking for log-in information, and it will never email you asking for it either.

If you receive a suspicious message, Uphold's own advice is short and worth following exactly: do not click any links, do not download attachments, do not reply. Report the message through Uphold's web form with a screenshot. Then, separately, sign in to your account by typing uphold.com into your browser yourself — never through a link in the message — and check for unauthorised activity.

What Happens If You Call

BotCrawl's researchers did call the number in the sample, and what they found is instructive. The call was answered by a prerecorded greeting identifying itself as Uphold customer service, followed by hold music, then a transfer to a live agent. The setup closely resembled a legitimate support line — automated prompts, queue behaviour, the whole performance. That is the point. A convincing call centre is cheap to run and far more effective than a phishing page, because a live agent can hear your doubt and talk through it.

Once you are on the line, the conversation is framed as an active security issue tied to a recent breach, and you are treated as someone who needs to complete verification steps to prevent account impact — not as someone who should authenticate through an official website. From there, the agent can steer you toward sharing account details, reading out a two-factor code, approving a transaction, or moving funds. The specific ask varies; the structure does not.

This is also why the scam is hard to kill. When a phone number gets reported and blocked, the operation swaps in a new one and the emails keep going. The defence is not blocking one number. It is recognising the pattern so the next number does not work either.

I Already Called or Shared a Code — the Damage-Control Checklist

If you are reading this after the call, do not panic, but do not wait either. Work through this in order, right now.

1. Change your Uphold password immediately — from the official site or app, typed in by hand, not from any link. Use a password you do not use anywhere else.
2. Revoke and re-set two-factor authentication. If you read out a 2FA code or approved a prompt during the call, treat that factor as compromised. Disable it and set it up again from scratch. If you use an authenticator app, consider moving to a hardware-backed option — a TOTP card keeps your codes off your phone entirely.
3. Check your account activity and connected devices. Look for new payees, changed withdrawal addresses, changed email or phone settings, and any session you do not recognise. If anything moved, contact Uphold support through the official site and your bank.
4. If you moved funds or shared card details, call your bank now. Card numbers can be cancelled; a wire that has already settled usually cannot be reversed, but your bank needs to know immediately.
5. Report the message. Forward the email to Uphold through its reporting web form with a screenshot, and report the number to your carrier as spam. If money was lost, file a report at ReportFraud.ftc.gov and with local law enforcement — it matters for the paper trail even when recovery is unlikely.
6. Watch your inbox for the next one. The same address that got this email will get more. Scammers share lists, and a person who answered once is marked as a person who answers. Tighten your spam filters and consider what address you hand out next time you sign up for anything crypto-adjacent.

Why Your Inbox Is the Target — and How to Shrink It

Here is the part most guides skip: the scam did not start with the email. It started months or years earlier, when your email address landed on a list. Every account you create with your primary address — every exchange, every newsletter, every "sign up to continue" — is another copy of that address in another database, and databases leak. The Customer.io incident is proof that even the vendors of the platforms you trust can be the source.

You cannot un-leak an address, but you can stop feeding new ones to the lists. For anything that is not your bank, your employer, or your government, a disposable address is the right tool. Sign up with a burner email — an address you can abandon the moment it starts attracting junk — and the next breach of the next vendor exposes an address that leads nowhere. Your real inbox stays quiet, and the scam emails land in a throwaway inbox you never check.

It is worth being honest about the limits, too. A temporary address will not protect an Uphold account you already hold, and Uphold itself will require your real details for identity verification — as it should. The point is not to hide from Uphold. The point is to stop handing your permanent address to every service that asks for one, so the lists the scammers buy contain fewer addresses that matter.

One more practical habit: when a service sends you a code you did not ask for, treat it as information, not an instruction. An unexpected code usually means someone is trying to get into your account — or trying to get you to hand them the code. Our guide to what a verification code is and how it works covers the mechanics, and the write-up of the Plaid verification code text people didn't request shows the same pattern playing out with a different brand name. The scam changes logos. The structure stays the same.

The 60-Second Test for Any "Security" Email

Before you act on any message claiming your account is in danger, run this:

• Who sent it, really? Expand the sender and compare it against the company's published sender list. A display name is not an address.
• Does it let you verify independently? A real security notice points you to a status page, a support article, or your logged-in dashboard. A scam points you to a phone number or a link.
• Does it name something checkable? A vendor, a system, a case number you can look up. "A third-party provider" is not checkable.
• Does it ask for a code, a password, or a transfer? If yes, it is a scam. No legitimate company asks for these by email or phone.
• Is it corroborated? Search the company's status page and one news source. A real incident affecting a major platform is never visible only in your inbox.

If a message fails any one of these, delete it and check your account by typing the address yourself. If it fails two, report it. That is the whole skill, and it works on every brand, not just Uphold.

Frequently Asked Questions

Is Uphold a scam?

No. Uphold is a legitimate, regulated financial platform. The scam is the email impersonating it. Confusing the two is exactly what the campaign counts on — the brand's legitimacy is the bait, not the crime.

Is there a real Uphold data breach?

There is no confirmed public breach matching the claims in the scam email — no official announcement, blog post, or filing. Uphold did have a real third-party incident in 2022, when its email vendor Customer.io exposed customer names and email addresses; Uphold disclosed it in writing in January 2023 and stated funds were not affected. The scam email's "December 17, 2025" breach is invented.

What is the real Uphold security hotline number?

There isn't one to call from an email. Uphold does not handle security issues by asking users to call a hotline from an unsolicited message. If you need support, go to uphold.com or the Uphold app and use the official support channels there.

I got the email but I don't have an Uphold account. Why me?

Because your address is on a list. Scammers send these in bulk to addresses gathered from old breaches, marketing lists, and scraped data. Not having an account is actually the fastest way to know it is fake — but if you ever open an account later, remember the sender list above.

Should I reply to the email to tell them it's a scam?

No. Replying confirms your address is active and monitored, which makes it more valuable to the next campaign. Delete it, or report it through Uphold's web form and move on.

Can a disposable email address stop these scams?

It cannot stop the ones already aimed at your real address, but it shrinks the target. Using a temporary address for signups means the next vendor breach exposes a throwaway address instead of your permanent one. Start at tempomailusa.com — it takes about ten seconds to get an inbox, and you can abandon it the moment it attracts junk.

What should I do if I already sent money to the scammers?

Contact your bank immediately, report the message to Uphold, and file a report at ReportFraud.ftc.gov. Recovery depends on how the money moved — card payments can sometimes be disputed, wires usually cannot — but reporting quickly is the only move that ever helps.