The lookalike address scam

Last reviewed: 26 August 2026

Someone builds a wallet address that looks almost exactly like one you already trust, then waits for you to copy the wrong one. It's known in the industry as address poisoning, and it is one of the few crypto scams that works just as well on careful people as on careless ones.

What it is

A crypto address is a long string of random characters. Nobody reads the whole thing. Every wallet ever made — ours included — shortens them on screen, showing the first few characters and the last few.

That shortcut is the entire attack. A scammer generates an address whose beginning and end match one you already deal with. In full, they are completely different addresses. Shortened on a screen, they are indistinguishable.

As a wallet shows it

Identical. There is nothing on screen to tell them apart.

The same two addresses, in full

Different from the fifth character onward — only the highlighted ends match, and the ends are all a shortened display shows. Obvious — but only if you see all of it.

How it plays out

1. You pay someone real. A supplier, a friend, your own exchange account. Every payment on a public blockchain is visible to anyone watching.
2. A bot spots it within seconds. It creates a brand-new address built to match the one you just paid — same opening characters, same closing characters.
3. It sends you a worthless payment from that address. A fraction of a penny. The point is not the money. The point is to get that address into your payment history, sitting right next to the real one.
4. Then it waits — sometimes for months. Next time you pay that supplier, you scroll back through your history, find what looks like the right entry, and copy the address.

The payment goes to the scammer. Crypto payments cannot be reversed, cancelled, or charged back. There is nobody to call.

Why this one is different

Most crypto fraud attacks your security — stealing a password, tricking you into approving something. This one doesn't. Nothing is broken into, and nothing you do is careless.

It attacks a habit: copying an address out of a list, the way everybody does. Most people have never saved a payment contact. Their history is their address book.

That's why we treat it as something to design out of the product, rather than something to warn you about and move on.

What Safewire does about it

Payments arriving in your wallet are screened automatically, before they reach your phone. When something looks like an impersonation of an address you'd recognise:

• It's set apart from your real payments. A scam payment never sits in the same list as a genuine one, where it could be mistaken for it.
• It's clearly marked. If you open it deliberately, you're told plainly what it is and why it was flagged.
• You can't copy that address by accident. The ordinary shortcuts that make paying someone quick are switched off for a flagged entry.
• It doesn't get your attention. A scam payment gets none of the prominence a real one does.

The protection is maintained by us, not by your phone — it works the same on every device, and it gets better for everyone at once without you needing to update anything.

What we deliberately don't do

We don't block your payments. If you decide to send to an address, that is your call to make. Refusing to move someone's money because a pattern looked wrong would mean blocking legitimate payments with no way to appeal. We warn clearly; you decide.

We don't hold or freeze anything. Safewire is non-custodial. Your funds are yours, and only you can move them. That is as true of this protection as of everything else we build.

We don't ask you to judge for yourself. Nobody can tell two addresses apart from a shortened display — so “does this look right to you?” is not a fair question to put to anyone. Any question we ask has to be one you can actually answer.

What you can do

Save the people you pay regularly as contacts. This is the single habit that defeats the scam entirely. A saved contact can't be impersonated by something that turns up in your history later.

If a payment seems to be missing, it may have been set aside. Check the suspicious transfers section of your wallet history — and if we've flagged something genuine, tell us. Those reports are how the protection improves.

If you think you've already sent money to a lookalike address, contact us straight away. A sent crypto payment can't be reversed, but the address, amount and time all matter for reporting it, and the sooner we have them the better.

This page explains a scam that affects every crypto wallet, not just Safewire. If it's useful to you, it's useful to share.