Somehow I received an email from Coinbase that said a password reset had been requested. I noticed that on the email it said that the request was made on a Samsung device. I don't have a Samsung device. The email did come from no-reply@coinbase.com Shortly thereafter I received a phone call from someone claiming to be from Coinbase saying someone from Germany was trying to access my account. They said my account would be locked. I did initiate a password reset. They transferred my BTC, about 13.85, out of my account. I really don't know how they were able to do this and most importantly, how Coinbase could let a device that has never been associated with my account make a transfer.