What do you need to understand first?
An attacker can use a lookalike address to exploit a short preview or a hurried comparison. The visible beginning and end may appear familiar while the middle differs. Seeing an entry in history does not establish who controls its address or why it appeared. The record is evidence of activity, not an endorsement.
What might this look like?
You want to repeat a payment and select an address from a recent entry. It looks like the previous recipient in the shortened view. Before sending, you obtain fresh details from the recipient through a known channel and discover the full addresses differ.
Where is the safety checkpoint?
How can you work through it?
Use an independent receiving source
Open the recipient details you intended to use or ask through a known channel. Avoid copying a destination from an unsolicited entry.
Expand the whole address
Compare the complete destination, including its middle. Similar edges do not establish a match.
Check the final signing request
Review asset, network, amount and fee along with the address. Reject any mismatch on a trusted signing display.
Preserve misleading activity if reporting
Keep relevant transaction references without wallet secrets. Do not interact with an unsolicited token or linked website to clear the entry.
When should you pause?
Pause until you can check each point below without sharing spending secrets.
- The destination came from the intended recipient.
- You compared the entire address.
- No unsolicited history entry became a trusted contact.