Fake AML check: how to spot it and check an address honestly

What the scam looks like

A deal counterparty, an “exchange manager” or “support” writes: “before the transfer, pass an AML check or the funds will be frozen.” They send a link to a site with a serious name, logos and a risk gauge. To “start the check”, the site asks you to connect your wallet and confirm an action.

The confirmation window looks like a formality, but it is really permission to spend your USDT, or a transfer. After you sign, the money leaves the wallet within minutes while the site shows “check passed”.

The second variant is a screenshot: you get a picture saying “address clean, risk 0%” so that you calmly send money to the scammer’s address.

Why it cannot be a check

An address check reads only public blockchain data: transfer history, links, sanctions and block lists. Copying the address is enough. No honest service asks you to:

• connect your wallet;
• sign an approval, a “verification” or a “sync”;
• enter a seed phrase or private key;
• send a “test amount” or a “check deposit”.

If a site wants any of this, close the tab, even if it shows our logo or a familiar name.

Signs of a fake checker

• The link came from someone who expects money from you or is “helping to get it back”.
• The domain looks like a known service but differs by a letter, a hyphen or the zone: guard-pay.com, guardpay.xyz and the like. Our only site is guardpay.online.
• A bot with a similar name: @GuardPayBot, @GuardPay_Bot and others are not ours. Our only bot is @Guard_Pay_Bot.
• Pressure: “the check is valid for 10 minutes”, “otherwise a freeze”.
• The “Connect wallet” or “Check wallet” button comes before you have entered any address.

How to check for real without leaving the chat

1. In any Telegram chat type @Guard_Pay_Bot, a space and paste the address.
2. Pick the card that appears — it is sent to the chat on behalf of the bot. It cannot be forged: the message is signed by the bot, not by a user.
3. The card shows the short address, the result, the Tether block status, the check date and a full-report button. The full report opens inside Telegram.

You can also use the site: paste the address into GuardPay /check. The bot can be added to a group: it replies with a card to an address and warns when someone posts a link to a known fake check.

Do not trust screenshots of checks

A picture with a “green” result takes a minute to draw, and a real report may be about another address or a week old. Ask the other person to send a card right into the chat via @Guard_Pay_Bot, or check the address yourself — it takes seconds.

If you already connected your wallet or signed an approval

1. Open the approval check right away and revoke anything unfamiliar. More: how to revoke unlimited approvals.
2. If you entered your seed phrase, create a new wallet and move everything left there. Do not use the old one again.
3. If the money is already gone, save the link, the chat and the addresses and read about phishing dApps — including what to do next.