Almost every scam covered elsewhere in this primer — a fake support agent, a stranger building trust for weeks, a cloned exchange page — is aimed at exactly one outcome: getting you to voluntarily send funds somewhere. That's worth stating plainly, because it cuts through every version of the scam at once. Nothing leaves a self-custodied wallet without a transaction you sign yourself. A scammer with your phone number, your trust, or even a plausible story still has nothing until a transaction actually goes out.

That makes the moment right before you press send the single highest-leverage point in the entire process. Every other defence in this primer is really just a way of not arriving at that moment under false pretences — but the destination address deserves its own scrutiny regardless of how you got there, because it's checked far less carefully than people assume.

The address itself should also only ever come from one place: your own wallet or exchange account, opened by you. A message, a screenshot, or a claim from someone else that “this is your deposit address” or “send here to receive it” is a claim, not a fact — the only way to know your real address is to open your own account and look. This holds even when the claim comes from someone posing as support, a counterparty, or a service you already trust; the legitimate version of any of those would never need to tell you your own address in the first place.

Once you have the real address, read it in full against the one you're about to send to, not just the first and last few characters. A single altered character produces a completely different, valid address that a wallet will accept without complaint — there's no built-in warning that you're sending to the wrong person, only that the format is technically correct.

One specific attack exploits exactly the habit of skipping that check: address poisoning, where an attacker sends a tiny, worthless transaction from a wallet address deliberately crafted to resemble one already in your transaction history, hoping a future copy-paste from that history grabs the poisoned look-alike instead of the real one.

For anything beyond a trivial amount, sending a small test transaction first and confirming it arrived before sending the rest costs a few extra minutes and a small fee — the closest thing crypto has to a safety net, given that a completed transaction cannot be reversed, recalled, or refunded by anyone once it settles.