Recognize the trap
Address poisoning places a lookalike address into transaction history, often through a zero-value or tiny transfer. The attacker hopes a user will later copy that entry as a trusted destination. MetaMask's advisory emphasizes checking the full address, including the middle characters hidden by many shortened displays.
Use a better source for the recipient
Obtain the destination from the recipient through an independently verified channel, not from an unsolicited history entry. Compare it again on the final confirmation screen. Save recurring recipients in the wallet's supported address book only after verification. When moving funds to your own account, use that account's verified receive screen.
Do not confuse receipt with compromise
A stranger sending a transaction to your public address does not, by itself, demonstrate that they control your keys. Nor does a new-recipient warning prove that the recipient is malicious. Focus on the outgoing transfer you are about to authorize. If you suspect an incorrect destination, stop before confirming and resolve the mismatch. Preserve the relevant transaction identifiers for a report; a label in a history list is not enough to establish who controlled the address.
Source and review date
MetaMask Help Center — original source. Original publication date not verified in this review. Source checked: 2026-10-23.
This is an original Wallet Beep editorial summary. Consult the linked source for its full context and any later updates.