How to validate your supplier's TRC-20 wallet before paying in USDT: format, second channel and test transfer
A transfer confirmed on the blockchain does not come back. Before sending the full amount, check the TRC-20 address format, confirm it through a second channel, test with a small amount and distrust addresses copied from your history.
Historical reference: April 14, 2026. Published on this site on November 2, 2026. Dates in the text identify the period covered.
In this article
Key points
- A valid TRC-20 address has 34 characters and starts with T (Base58Check format). Having the right format does not prove the address belongs to the supplier.
- Confirm the address through a second channel, different from the one that sent the invoice, and ask the supplier to write it on the invoice itself.
- Always send a small test amount before the full amount, but remember the test only covers the address used: checking the address again before the main transfer is essential.
- Never copy the address from the wallet history. Scammers deposit tiny amounts from look-alike addresses so that you paste the fake one.
In a bank transfer, the bank usually shows the payee's name before confirmation. On the blockchain, the address is a sequence of letters and numbers with no name. If it is wrong, or belongs to a scammer, the money is gone and the confirmed transaction is irreversible. That is why validating the supplier's wallet is the most important step of a USDT payment on the TRON network. This guide shows what to check, and in what order. The complete payment walkthrough, from invoice to keeping the receipt, is in how to pay a supplier in China with USDT.
What a TRC-20 address is and what the format confirms
USDT on TRON uses the TRC-20 standard. According to the network's documentation, the address appears in wallets and explorers in Base58Check format: 34 characters, starting with the letter T. Internally it corresponds to a 42-character hexadecimal value with the prefix 41.
One practical detail: on TRON, the network only recognizes an address after it is activated, usually by receiving TRX or a TRC-10 token. According to the network's documentation, before that the address does not show up in API queries or in the explorer. If the supplier says the wallet is old and the explorer finds nothing, that is a warning sign.
Confirm the address through a second channel
The costliest attack in this type of payment does not break into the blockchain. It breaks into the email or WhatsApp. The scammer copies the conversation with the supplier and, at the right moment, sends an invoice with his own wallet. It is the same logic described in fake supplier and bank details changes. The defense is a second channel, independent of the first.
- Get the address from the invoice or the contract, not only from the chat.
- Call or video chat with a person you already know at the company, on the phone number in the contract (not the one that came in the invoice email).
- Ask them to read out or send the address again, through that channel. Compare it character by character.
- Ask the supplier to also confirm the network (TRC-20) and the name of the company that owns the wallet.
- If the supplier changes the wallet, treat it as a warning: repeat the procedure and ask for the change in writing, signed.
Messages like “we changed wallets, pay today” are the classic script of business email compromise. Refuse the deadline and use the second channel, even if it delays the payment.
Beware of the history: address poisoning
Never copy the supplier's address from the wallet history. In an address poisoning scam, the criminal sends a minimal transfer from an address with the same beginning and end as the real one, so the victim copies the fake one on the next payment. The mechanism and the 2024 cases are in address poisoning in USDT.
The scam defeats even those who send a test transfer. On December 20, 2025, Cointelegraph reported the loss of 49,999,950 USDT, almost US$50 million. According to the on-chain investigator Web3 Antivirus, the victim sent a test to the correct address and, minutes later, sent the full amount to an address copied from the history. The two matched in the first three and last four characters, observed Cos, founder of the security firm SlowMist. The report does not say which network was used, but the mechanism is the same on TRON.
Check the explorer and send a test transfer
Paste the address into Tronscan. It shows whether the address is active, its balances and its transfer history. To read each field and check the official USDT contract, see how to check a USDT transaction on Tronscan. Here, what matters is whether the wallet shows activity consistent with a company that receives payments, and whether there is USDT from varied sources or only immediate inflows and outflows.
Then send a small test transfer, the equivalent of a few dollars, to the same address. Ask the supplier to confirm the amount received, in writing and through the second channel. The test proves that the person who answered controls the wallet. It does not prove that the address for the main transfer is the same. That is why, before the full amount, compare again the pasted address with the confirmed one.
After validating, save the address in the wallet's or platform's contact list, with the company's name. For later payments, use the saved contact and never the history.
How this appears when paying with Swapo
When intermediating a supplier payment, Swapo asks for the beneficiary's identification (name, country and TRC-20 wallet), the purpose and a supporting document, such as an invoice, order or contract. Swapo sends the USDT to the wallet the client specifies; for that reason, the validation described above comes before the order. After the transfer, the client receives the transaction hash and can check it on Tronscan. Swapo never asks for a password, access code or private key.
Frequently asked questions
How can I tell whether a TRC-20 address is valid?
A valid TRC-20 address has 34 characters and starts with T, in Base58Check format. Most wallets reject addresses with a typo. But the format does not prove that the wallet belongs to the supplier: that requires confirmation through a second channel.
Does a test transfer eliminate the risk of sending to the wrong address?
Not entirely. The test confirms that the recipient controls that address. But if you paste a different address for the main transfer, for example one copied from the history, the full amount goes to the wrong address. Compare the address again before the main transfer.
What is address poisoning?
It is a scam in which the criminal sends a minimal-value transfer, from an address similar to yours or your supplier's, so that the fake address shows up in your history. The goal is to make you copy and use the wrong address.
Can I recover USDT sent to the wrong wallet?
Generally, no. A confirmed transaction is irreversible. If the address belongs to an exchange, its support may help; if it belongs to a scammer, recovery is unlikely. In fraud cases, file a police report and notify the platform you used.
Found it useful? Share it with anyone who pays suppliers abroad.
Sources
- Account: formato de endereço e ativação · TRON Developer Hub, Apr 14, 2026
- How a single copy-paste mistake cost a user $50M in USDt · Cointelegraph, Dec 20, 2025
- Tronscan: explorador de blocos da rede TRON · Tronscan, Apr 14, 2026
For information only, not investment advice. Third-party brands mentioned belong to their owners; the mention is journalistic and does not indicate a partnership or relationship with Swapo Finance.
International payments with the speed of Pix and Central Bank rules.
Convert reais into USDT and send it to your supplier on the TRON network. One fee shown upfront, asset segregation policy, human support. Virtual assets have no FGC coverage; authorization application filed with the BCB.
