How to check a wallet before you pay it.

A bank transfer to the wrong place can often be recalled. A card payment can be disputed. A crypto transfer has neither of those. Once it confirms, the money belongs to whoever holds that address, and there is no institution in the middle with the power to change its mind.

That's why screening an address is the one piece of diligence that has to happen before the send rather than after. Everything else about a counterparty you can investigate at your leisure. This you cannot.

How to check a crypto wallet address before you send

Four checks, and they are not equal. The first two cost seconds and catch the attacks that actually take money from small businesses. The third and fourth cost a little and catch the category that gets your exchange account frozen.

1. Check where the address came from, then check the middle of it. Copy it from the request itself, not from your own transaction history, because an address planted in your history is the point of address poisoning. Then compare the middle of the string rather than the first and last four characters. Attackers generate lookalikes that match the ends precisely, which is exactly the part people read.

2. Look it up on a block explorer. You're not auditing anything, you're asking two questions. Does this address have a history, and does that history look like the counterparty you think you're paying? A supplier's address funded eleven minutes ago is a question worth asking out loud. So is one with no outgoing transactions at all.

3. Screen it. A screening service does the part you cannot do by eye: it traces the address's history against labelled entities and comes back with a risk score and the categories behind it. What that is and is not is the next section.

4. Send a test amount. Ten or twenty, confirmed as arrived, then the rest. It costs cents and catches everything the first three miss: a wrong network, a stale address, a counterparty whose wallet doesn't do what they assumed.

For a payment that matters, add the one check that is not on the chain at all: confirm the address on a second channel, a call or a chat you already use. Almost every large business loss here started as an email.

What a screening actually looks at

An address is public. Its entire history is public. What a screening service adds is the part you cannot see by staring at a block explorer: which of those counterparties are known, and what they are known for.

So the check traces the address's history against labelled entities. Sanctioned addresses. Darknet markets. Mixers and tumblers. Addresses tied to reported hacks and to reported scams. Exchanges, ransomware payments, gambling. Out comes a risk score with the categories behind it.

It's worth being precise about what that is and is not. It's a statement about an address's transaction history. It is not a statement about a person. Nobody can tell you from the chain alone who holds the keys, and any service claiming to is guessing.

The half everybody skips: money coming in

Most people who think about screening at all think about it as something you do before paying somebody. The receiving side is the one that actually bites.

Here is the shape of it. A client pays you 4,000 USDT. The payment arrives, the invoice is settled, everyone is happy. Two months later you move that balance to an exchange to cash out, and the withdrawal is held. The exchange has traced the incoming trail, found something it doesn't like two or three hops back, and now wants to know where the money came from.

The risk of tainted funds sits with whoever is holding them when they touch a regulated institution. That is you. And the difference between finding out on the day the payment landed and finding out ten weeks later is the difference between a conversation with your client and a frozen balance with no conversation available.

Screening the sender of an incoming transfer is the cheapest possible version of that conversation.

One check is a photograph

An address that was clean on Tuesday is not clean forever. Its history keeps being written after you looked, by people you have no relationship with. A wallet you paid three times last quarter may since have received funds from a hack.

This is the argument for watching an address rather than checking it once, and it applies to a small number of addresses: the supplier you pay monthly, the client who pays you monthly, the exchange deposit address you use. Not everything needs watching. The handful of addresses that move real money for you probably do.

The same logic says the opposite thing about the addresses you pay constantly and already trust. Re-checking your own business partner every Friday spends money to learn nothing. Vet them once, mark them trusted, and spend the checks on strangers.

What to do with a bad verdict

A high risk verdict is not a verdict on a person, so treating it as an accusation is both unfair and unhelpful. What it means is that money in this address's history came from somewhere with a label attached.

Sometimes that's nothing. An address that once received a withdrawal from an exchange with a poor reputation is not a criminal. Someone who used a privacy tool in 2021 is not necessarily doing anything you should refuse to be part of.

So the useful response is a question rather than a refusal:

• Ask for a different address. A legitimate counterparty usually has one, and this costs them a minute. Somebody who insists on the flagged address is telling you something.
• Ask where the funds came from, if you are receiving. The answer is often boring and verifiable.
• If it's a large payment and the answer is not satisfying, decline it. Being the person who didn't take that particular 4,000 is much cheaper than being the person explaining it later.

And write down what you decided. Which brings us to the part everyone forgets.

The record is the point

Eventually somebody asks what diligence you ran. A bank onboarding your company. An exchange reviewing an account. An accountant preparing something that has to be signed.

The honest answer, for most people, is that somebody looked at an explorer once, in a browser tab that closed months ago. That is not a record. It cannot be produced, dated, or shown to anybody.

What can be produced is a list: date, address, verdict, who ran the check. Built as you go, it takes no effort. Reconstructed afterwards from memory, it is not the same document and everyone in the room knows it.

Who this is actually for

If you hold crypto and only ever move it between your own accounts, this is not your problem. Screening is about counterparties, and you're not one.

It starts mattering the moment other people's addresses are involved: you invoice clients who pay on chain, you pay contractors or suppliers in stablecoins, you run a business where somebody who is not you can initiate a payment. That is also roughly the point where a regulated institution starts asking you questions, which is not a coincidence.

What it costs to be wrong, versus what it costs to check

A screening costs less than a coffee. A payment to a sanctioned address is a problem with no upper bound, and a frozen exchange balance is weeks of your attention at the worst possible time.

The asymmetry is the whole argument. You're not buying certainty, because certainty is not on sale. You're buying the removal of one specific, cheap, avoidable category of disaster, and a piece of paper that says you did.

How this works in Orla

Address screening sits where the decision is: a shield button next to the address on the send form, and on a contact's card if you would rather vet somebody once. The verdict comes with the score behind it, and a screening that cannot be completed says so in those words rather than coming back clean, because a silent pass looks identical to everything being fine.

Monitoring covers the two things you cannot do by hand: watched addresses are re-screened on a rhythm you set, and the senders of newly arrived transfers are screened without anybody asking. You hear about it when a verdict turns bad, not on every pass.

Every check is kept, and exports to CSV over a date range, which is the artefact somebody eventually asks for. Trusted contacts are exempt, so vetting a partner once doesn't cost you a check every payday.

The rest of the invoicing side, including the four lines a crypto invoice needs and the address swap trick that no screening will catch for you, is in this post.