> For the complete documentation index, see [llms.txt](https://help.tokenpocket.pro/en/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://help.tokenpocket.pro/en/security-knowledge/common-fraud-cases/transfer-phishing.md).
# Common Transfer Phishing Scams and How to Stay Safe
On-chain transfers are usually irreversible once completed. Attackers often take advantage of everyday transfer habits, such as copying addresses from transaction history, checking only the first and last few characters, or pasting an address and confirming too quickly.
Below are several common transfer phishing tactics and ways to reduce the risk.
### Common Transfer Phishing Scams
#### 1. Zero-Value Transfer Poisoning
Attackers send zero-value token transfers, such as 0 USDT or 0 USDC, to large numbers of active addresses. These transactions then appear in the recipient’s on-chain transaction history.
The next time you make a transfer, you may mistakenly copy the attacker’s address from your history, assuming it is an address you previously interacted with. In reality, that record was planted by the attacker.
#### 2. Address Poisoning
Attackers generate addresses that look very similar to addresses you commonly interact with, often matching the first and last few characters. They may then use small or zero-value transfers to make the fake address appear familiar in your transaction history.
For example, the real address may be:
```
0xABC1...9F3E2D8A
```
The attacker’s address may be:
```
0xABC1...9F3E8D2A
```
Many people only check the first and last few characters before confirming a transfer. If the fake address looks familiar at a glance, funds may be sent to the wrong address.
#### 3. Clipboard Hijacking
If malicious software is present on your device, it may monitor your clipboard. When it detects a blockchain address, it can automatically replace it with an attacker-controlled address.
In other words, you may copy the correct address, but paste a different one. If you do not check it again before confirming, the transfer may go to the attacker.
### How to Protect Yourself
To help reduce transfer risks, TokenPocket provides multiple safety checks throughout the transfer process, covering key steps such as address entry, pasting, address display, and final confirmation.
#### 1. Address Book
Addresses saved in the address book are added and confirmed by you, making them safer than addresses copied from transaction history or the clipboard.
For frequently used recipient addresses, it is recommended to save them in the address book in advance. This helps reduce risks such as zero-value transfer poisoning and clipboard hijacking.
#### 2. Small-Amount Filtering
Zero-value transfer poisoning relies on 0-value or very small-value records appearing in transaction history and being mistaken for real interactions.
Filtering small or abnormal records can reduce the chance of these entries interfering with your address selection.
#### 3. Paste Alert
After pasting an address from the clipboard, do not rush to the next step. Check the full address displayed on the page and make sure it matches the address you intended to paste.
If clipboard hijacking has occurred, the pasted address will not match your expected address. This check gives you a chance to catch it before confirming.
#### 4. Address Highlighting
Address highlighting separates the address into visual segments, making it easier to spot differences between similar-looking addresses.
Even if an attacker generates a lookalike address with matching first and last characters, the middle section may still differ. Do not rely only on the first 4 and last 4 characters. Always review the full address before sending.
#### 5. First-Time Transfer Alert
When sending assets to an address you have never interacted with before, TokenPocket will trigger a first-time transfer alert.
Treat this as an important checkpoint. When you see the alert, verify that the recipient address comes from a trusted source before continuing.
### Before You Transfer
* Do not copy addresses directly from unfamiliar transaction records.
* Save frequently used addresses in the address book whenever possible.
* After pasting an address, always check the full address.
* Do not rely only on the first and last few characters.
* When a risk alert or first-time transfer alert appears, pause and verify.
* For large transfers, send a small test transaction first.
### Summary
Transfer phishing is one of the most common on-chain scam tactics. Whether it is zero-value transfer poisoning, address poisoning, or clipboard hijacking, the goal is the same: to exploit quick copying, partial address checks, and rushed confirmation.
To help protect users, TokenPocket provides multiple safeguards during the transfer process, including the address book, small-amount filtering, paste alerts, address highlighting, and first-time transfer alerts. These checks help identify suspicious activity at key steps such as address entry, pasting, review, and confirmation.
Still, no safety feature can replace your final review. Before sending, check the address source, the full address, and any page warnings carefully. For large transfers, start with a small test transaction and proceed only after confirming everything is correct.