What you can check yourself
- The address's history on a public explorer: how many transactions it has received, and over what period.
- Whether the address has received many payments from many different senders in a short time — a pattern typical of a collection address used by a fraud operation.
- Whether the funds leave almost immediately after arriving, especially to the same handful of destinations.
- Whether the address appears alongside the platform or offer in search results, with other people describing the same experience.
Warning signs in the context around the address
The address itself is only half the picture. The strongest signals usually come from how it is presented to you:
- A demand for urgency — a bonus expiring, a withdrawal window closing, an account about to be suspended.
- A request to pay a fee, tax or deposit before anything is released to you. Genuine platforms do not require payments to permit withdrawals.
- Instructions to move the conversation to a private channel or a separate 'trading app'.
- An offer to help recover a previous loss, for an upfront payment or in exchange for wallet access.
What no check can tell you
A quiet address is not automatically safe, and a busy one is not automatically fraudulent. Fresh addresses used once have no history to judge. The public record also never reveals who owns an address, so 'checking' an address can never confirm that a person or company is genuine — only that its behaviour is or is not consistent with known fraud patterns.
If you already sent funds
If you have already paid an address you now doubt, preserve the transaction hash and stop any further payments. Report to Action Fraud and your bank, and if the funds have moved toward an exchange, report to the exchange with the hashes as soon as possible. A trace of where the funds went is the natural next step, and it can be done whether or not the original address looked suspicious at the time.
If you are looking at your own case rather than reading generally, our cryptocurrency investigation service explains how a case is scoped and worked, the asset tracing hub covers the network-specific work, and our overview of cryptocurrency scam recovery in the UK sets out what is realistic. Asset pages: USDT tracing, Bitcoin tracing and Ethereum tracing. You can also contact the investigations team directly.
Common questions
- Is there an official database of scam addresses?
- No single authoritative list exists. Some services maintain lists of addresses linked to reported fraud, and exchanges keep their own. Absence from a list proves nothing, and appearance on one is a strong but not conclusive signal.
- The address received funds from an exchange. Does that make it safe?
- No. Fraud operators withdraw from exchanges like anyone else. Payments arriving from a regulated service say nothing about the address's purpose.
- Can you check an address for me?
- We can. If you have already sent funds to it, a first assessment of whether the case is traceable takes a few working days and is free.
Have a case you want reviewed?
We scope at intake and tell you honestly whether the onchain data supports a traceable case.
Key terms in this guide
Plain-English definitions from the Wallsec glossary.