How can scammers create an address that looks like yours?

[FinneysTrueVision]

As long as you have a decent amount of computing power you can generate a custom address that resembles the address of a target victim using a program like VanityEth. Normally these programs are used to create a cool looking wallet or smart contract address, but there’s no way to stop someone for using it for nefarious purposes.

[tabas]

That's a lifesaving in there, and this is another reminder not just for everyone but also to me! Before, when I sent to addresses, that's how I looked at my copy pasted addresses. Only the first few characters and the last of it, but it didn't take long until I took my time in reading each character from the first, middle, and last of it, the entire thing. This is why this is important when doing some transfers. If they're quite big, make sure to send first smaller amounts to test and see if it's arrived in the right receiver.

[Nheer]

Most often, such attacks are not random, but part of social engineering, so the less information is publicly available to you, the less likely such attacks will occur. In general, verifying the entire address takes only a few seconds.

A lot of people feel very lazy to just verify an address they are sending funds to and it will only take a few seconds knowing fully well that any mistake will result to loss of assets. The only way to prevent such scams from occurring is to properly verify the addresses and not only look at the first and last characters and assume it is all correct.
Scammers are always waiting on the slightest mistake to capitalize on so even if verifying an address will take a minute or an hour then it’s worth it and it’s better to waste time than send your asset to a wrong address.

[joniboini]

A lot of people feel very lazy to just verify an address they are sending funds to and it will only take a few seconds knowing fully well that any mistake will result to loss of assets. The only way to prevent such scams from occurring is to properly verify the addresses and not only look at the first and last characters and assume it is all correct.

That's true, unfortunately. That being said, I do recall seeing a suggestion that asked developers of crypto wallets to hide suspicious transactions easily to prevent poisoning attacks. I don't think most developers put that as a priority because users have many ways to tackle it on their own (especially on desktops). I can see it as a good feature to sell new wallets though, the question is whether that will be enough to attract users to use it. CMIIW.

[Y3shot]

That's a lifesaving in there, and this is another reminder not just for everyone but also to me! Before, when I sent to addresses, that's how I looked at my copy pasted addresses. Only the first few characters and the last of it, but it didn't take long until I took my time in reading each character from the first, middle, and last of it, the entire thing. This is why this is important when doing some transfers. If they're quite big, make sure to send first smaller amounts to test and see if it's arrived in the right receiver.

One needs to be very careful on wallets and addresses because these scammers are very smart and are capable of doing things that looks so real. When sending a coin it is important for one to be careful and cross check if it is the right address because the reason why sometimes we fall into the hands of the scammers is because we are busy cross check that is why when itis about manipulating addresses they make it too similar and makes it so real for you to believe. Being very care and good observation can prevent one from falling into scam like this.

[KingsDen]

That's a lifesaving in there, and this is another reminder not just for everyone but also to me! Before, when I sent to addresses, that's how I looked at my copy pasted addresses. Only the first few characters and the last of it, but it didn't take long until I took my time in reading each character from the first, middle, and last of it, the entire thing. This is why this is important when doing some transfers. If they're quite big, make sure to send first smaller amounts to test and see if it's arrived in the right receiver.

You can send first and it arrived safe, copying the second, the dead will be done.
What I do always is;

• Check 3 letters randomly throughout the address, like beginning, two places in the middle and ending.
• As you said, if it's large, I'll consider to partition the transactions.
• Ensure every time I want to transact, I generate an address and not going back to history to copy my old address.
• There's no perfect way, but little carefulness could save us alot.

[God Of Thunder]

Alright thanks for this, I will check this out as well.. I also saw some repos while researching but this is perfect.

This is perfect pone because you have dozens of options in this Vanitygen Plus Plus. It supports generating BTC, ETH, and LTC addresses. Moreover, one can generate Legacy, taproot and native witness addresses if they want. Overall, this is kind of all-in-one to generate vanity addresses. Point to be noted, I did not used this yet, but one of my local used it and he shared his opinion regarding this and that is where I learned about this one.

[Agbe]

The simplest way to explain it is they generate enough addresses until one is generated that has identical first and last public key characters.  But this is an automated process, it probably runs 24 out of 7 to generate as many coincidental addresses as possible so more victims can be screwed.

So from my understanding theres a way to generate that kind of almost identical address? Im kinda curious about this one too since I dont know how they do it. Plus creating address in such wallet gives you random one.

Imagine how they can get the almost same address with that, probably there some software or scheme doing this. If there is one then they should have close it its being used by scammers as a mean to victimize a lot of newbies.

I was not aware of it as well. So scammers.can generate identical addresses to scam people. This is good information to safeguard ourselves from coping in clipboard. And the best way is copy the address from your exchange app whenever you want to deposit coins to your address. And not coping from saved address because from what I am seeing, it can be compromised when you saved it in the phone or other devices.
Op thanks for the thread.

[sokani]

I was not aware of it as well. So scammers.can generate identical addresses to scam people. This is good information to safeguard ourselves from coping in clipboard. And the best way is copy the address from your exchange app whenever you want to deposit coins to your address. And not coping from saved address because from what I am seeing, it can be compromised when you saved it in the phone or other devices.
Op thanks for the thread.

It doesn't matter where you are coping from. Whether from an exchange or a personal wallet address. If your device is infected with a clipboard malware, chances are you may lose your funds if you're the type that don't normally crosscheck the address. To avoid falling for this kind of scam, always verify the address you're sending funds to, that the digits matches correctly with what you've on the exchange or personal wallet before hitting the "send" option.

[tabas]

That's a lifesaving in there, and this is another reminder not just for everyone but also to me! Before, when I sent to addresses, that's how I looked at my copy pasted addresses. Only the first few characters and the last of it, but it didn't take long until I took my time in reading each character from the first, middle, and last of it, the entire thing. This is why this is important when doing some transfers. If they're quite big, make sure to send first smaller amounts to test and see if it's arrived in the right receiver.

One needs to be very careful on wallets and addresses because these scammers are very smart and are capable of doing things that looks so real. When sending a coin it is important for one to be careful and cross check if it is the right address because the reason why sometimes we fall into the hands of the scammers is because we are busy cross check that is why when itis about manipulating addresses they make it too similar and makes it so real for you to believe. Being very care and good observation can prevent one from falling into scam like this.

That's the purpose of the person that does address poisoning, they're just waiting for the real owner to do a mistake of being lazy in checking their transactions.

That's a lifesaving in there, and this is another reminder not just for everyone but also to me! Before, when I sent to addresses, that's how I looked at my copy pasted addresses. Only the first few characters and the last of it, but it didn't take long until I took my time in reading each character from the first, middle, and last of it, the entire thing. This is why this is important when doing some transfers. If they're quite big, make sure to send first smaller amounts to test and see if it's arrived in the right receiver.

You can send first and it arrived safe, copying the second, the dead will be done.
What I do always is;

• Check 3 letters randomly throughout the address, like beginning, two places in the middle and ending.
• As you said, if it's large, I'll consider to partition the transactions.
• Ensure every time I want to transact, I generate an address and not going back to history to copy my old address.
• There's no perfect way, but little carefulness could save us alot.

Yup, we need to have more extra care for us not to fall for it. I guess many here won't fall for that but it's sad that the victim has lost his fortune with that. It's a known technique by cons for those that been here for quite a while but not everyone is aware of that.

[Bryan jessy]

They could carryout such scandalous act through the use of malware, at times I wonder how those scammers are so good in activities like this, they are more like evil genius, because that is actually a good skill. I wish they could come to realize how cool it is and use that knowledge to solve problems in the general public, and also help in repairing technicals issues rather than using such knowledge in an outrageous manner

[BIT-BENDER]

That is address poisoning.

The attacker will send dust coin to the victim with the address that resembles the victims address. The victims will copy the address, thinking it is his own address and send coins to the attackers address.

This can happen if the victim is the only one sending coins to an address. The victim will think the deposit address is his. It can be the deposit address from an exchange. The attackers will generate address that is similar to it and use it to send dust to the victim sot they the victim can fall into the trap.

It is good to be aware of this and clipboard malware.

I do not know how the scammer created the address but I know it happening to those altcoins and not bitcoin.

Going by this means that the attackers actually knows the victim.
Looking at how this works many people loves to pay attention to the first few digits and the last few digits. Personally I have always thought that this is very risky and with this information now it justifies my scepticm, right now it is important to actually check the how letters of the address you are sending to so as to avoid this sort of situations.

[Doan9269]

If am not the type that use to post my bitcoin address to the public, am likely not to be a victim of these kind of attempt to scam, because they would have seen your address somewhere and aimed to set you as target through the address poisoning attempt, they can even send you a dust transaction just to enable them have the lookalike address on your transaction history and once you mistakenly took that for your own address, that's all, I always ensure to verify on any address before making transaction or better still to go the deposit section and copy the address directly and reconfirm the same address after pasting it, because there's also clipboard malware means of attack and I must not play dumb on that too.

[|MINER|]

Going by this means that the attackers actually knows the victim.
Looking at how this works, many people love to pay attention to the first few digits and the last few digits. Personally, I have always thought that this is very risky, and with this information now, it justifies my skepticism. Right now, it is important to actually check the letters of the address you are sending to so as to avoid this sort of situation.

I don't think in these kinds of thing attackers always knows the victim. But it is also true that most of the cases the hackers  try to find out email via their wallet address on public.

I have also seen some scammers news that they were giving the malware injected files via mail even it could be randomly or from the stolen data from the crypto platform.

And I usually it is the time now we should check up the whole wallets character or use the direct qr always. Becuase there were more than 45 characters in a wallet address so it is also time consuming in rush time to check.

[khaled0111]

Going by this means that the attackers actually knows the victim.

Not necessarily. The attacker doesn’t need to know the victim personally as all the information required to perform his attack are publicly available on the blockchain.
All they need to do is find an address that always/regularly sends coins to the same address (it could be the victim’s exchange address). Then he will generate a new address that looks like the legit receipient address and use it to send a dust amount to the victim. The victim could be a completely random person.

[Cricktor]

To create a public address that on a quick look looks like a victim's one, such scammers have to find by brute-force a sort of vanity address where a few of characters are similar at the start and at the end of the public address. Lazy people might only check a few characters at the start and at the and of an address.

This requires quite some brute-force power because as with vanity addresses one needs to find correct prefixes AND some characters of the checksum which is at the end of an address. I don't know if it's feasible to do this on-the-fly. It seems highly unlikely to me to do it on the victim's machine alone by some malware. A GPU render farm on the malware's backend side could possibly do it. It surely depends on how many similar characters at the beginning and end the scammer wants to achieve to deceive the victim.

Therefore: always check a few characters in one or better two positions in between additionally to the start and end of an address!

You don't need to look at a lot of characters in each checking position because the goal is not to have to check avery character of an address. Key is to not only look at few characters at the start and end, but at a handful of characters each at the start, middle and end! Do not count common address type prefixes for the number of chars to check at the start, like 1..., 3..., bc1q... and bc1p..., only count chars after those address type prefixes!

[ZAINmalik75]

Scammers are mostly using clipboard malware to slightly change addresses with their own, but user first makes a mistake by clicking some link and installing malware.
They probably have different methods for scamming, and it's easier to do it when using hot wallets or online wallets.
As a way of protection I would always double check addresses to confirm them, use Linux OS instead of wind0ws, and use hardware wallets.

Double-checking an address that you are sending assets to is extremely important considering how scammers are getting smarter with their actions and heists. They have so many ways of scamming you that you might not even realize it sometimes. Still, it's true that if someone is always in their senses and careful before making a transaction, it's not possible for any scammer using any method to scam them. It's mostly the ones who make subtle mistakes during transactions who get trapped in such things.

Having a device with no connection to other things than you financial applications and wallets which you know are safe is a better way to manage your assets because if you are not constantly surfing the internet with that device or download apps and games, you will be safer since the odds of you getting scammed through a malware or something will be tiny this way.