Address poisoning

People rarely read a whole address. They check the first and last few characters. Attackers exploit that: they generate an address that starts and ends like one you've used, then send you a tiny or zero-value transfer from it. Next time someone copies "the usual address" from the history, they may copy the attacker's.

A related trick is the fake token: a worthless token named "USDT" or "USDC", sent to many addresses so it shows up next to real balances.

Defences

• Saved addresses. Pay only to destinations saved and checked in advance, and never copy from history.
• Approvals. A second person checking the full destination catches what one person misses.
• Recognising tokens by contract, never by name.
• Screening destinations with a KYT provider.

On Valtu

Only each network's real token contract is counted, so fake tokens sent to your customers' addresses are ignored. Approval policies can limit wallets to saved addresses and require approvals, which show the full destination, and destinations can be screened with your own KYT provider.