Scam schemes
TRON address poisoning: how a look-alike gets into your history
In short
- A scammer generates an address whose start and end match your counterparty’s, then plants it in your history with a tiny or zero-value transfer.
- The transfer itself steals nothing. The loss happens later, when you copy the recipient from your history.
- The defence is an address book, checking every character, and screening a new address before a large transfer.
What it looks like
You regularly send USDT to the same recipient: a supplier, an exchange, a colleague. One day a new line appears in your wallet history — a transfer of 0 USDT or a few cents. The address in it starts and ends exactly like your recipient’s: the same first four and last four characters. The middle is different, but your wallet usually shortens it to an ellipsis.
A day or a week later you pay the same person again, open your history, copy “their” address from the latest line — and send the money to the scammer.
Why a look-alike address is so easy to fake
A TRON address has 34 characters. An ordinary computer can find an address whose first and last 4–5 characters match in a few hours. Scammers need neither your key nor your signature: the blockchain is public, so they can see whom you pay and create a look-alike for exactly that recipient.
The look-alike reaches your history in three ways:
- Dust. A tiny amount of TRX or USDT sent from the look-alike to you.
- A 0 USDT transfer. The USDT contract lets anyone trigger a zero-amount transfer in someone else’s name without permission. In an explorer it looks as if you yourself sent 0 USDT to the look-alike.
- A fake token. A token named “USDT” on someone else’s contract. The line in your history looks like a real payment.
Who gets targeted
Most often people who send large amounts to the same addresses: buyers and sellers in OTC deals, accountants, exchange-office cashiers, anyone who tops up an exchange account regularly. The larger and more regular your transfers, the more it pays the scammer to spend on a look-alike and dust.
Three habits that protect you
- An address book, not your history. Save a verified recipient address in your wallet’s address book with a clear label. Send only from the book. Your transaction history is not a contact list.
- Check every character. If you have to paste an address, compare all of it, not just the start and end. The easiest way is a QR code the recipient shows from their own device, or a message from them in another channel.
- A test transfer and a check. Before a large amount, send a small one and ask the recipient to confirm it arrived. Screen a new address in GuardPay /check: an address that is a few days old and sends dust to dozens of strangers’ wallets is a reason to stop.
What to do if a look-alike is already in your history
Send nothing to that address, not even to “return the dust”. Hide the line or the token if your wallet allows it, and stop copying addresses from your history for a while. Warn the people you pay often: they may have been sent a look-alike too.
If a transfer to the look-alike has already gone out, act fast: trace where the money went before it dissolves in exchangers. How to do that is covered in “Scammed on TRON: what to do in the first hours”.
For companies
Sign payments from a shared wallet only to addresses on a pre-approved list. An address enters the list from a contract or a signed message from the counterparty, never from the transaction history. One person prepares the transfer, a second one checks the whole address. Shortened addresses like “TXy…4k7” in spreadsheets and chats are exactly the form poisoning relies on.
Check an address for free
Trust score, risk labels, links to known scam addresses, fake tokens and granted approvals — in a minute, with no signature and no wallet connection.
Check an addressFAQ
Can a 0 USDT transfer steal my money?
No. It needs no signature from you and debits nothing. Its only danger is that it leaves a look-alike address in your history that you might copy.
How do I tell that an address is a look-alike?
Compare all of it with the address in your address book or contract. A look-alike matches only at the start and end. In GuardPay /check a look-alike usually shows a short life and many outgoing dust transfers to different people.
This guide explains how schemes work and how to protect yourself. It is not legal or financial advice.