Chapter 2 of 6 / is this the real one
The address looks familiar
You recognise the first few characters, so you stop reading. That is not carelessness, it is how anybody reads a long random string, and every forgery you will ever meet is fitted to it.
What it usually turns out to be
| Cause | How often | What settles it |
|---|---|---|
| It is the right address | Most of the time | Compare it and stop worrying |
| It is one you saved a while ago | Common | Check it against a current set as well |
| A close copy with a matching opening | Uncommon but the expensive one | Compare the whole string, not the ends |
| A different address for the same market | Occasional | Check it appears in a published set |
What a forgery actually costs to make
| What somebody matches | Roughly what it costs them |
|---|---|
| The first four or five characters | Seconds to minutes on an ordinary machine |
| The first seven or eight | Hours to days, and people do it |
| The first twelve | Not worth anybody time |
| The whole fifty six | Impossible, and everything rests on that |
That table decides the shape of every fake address in existence. Familiar opening, unfamiliar middle, sometimes a plausible tail because the last few characters are cheap to steer too. Which is why the middle is the part that carries the information.
The comparison that ends it
- Paste the address you are about to use into an empty text box.
- Paste your own saved copy directly underneath it.
- Look at whether the two lines are the same length and line up. Two identical strings stacked are obvious at a glance and two nearly identical ones are not.
Five seconds, no judgement involved, and it still works on the hundredth repetition when your attention has long since stopped helping. Reading carefully is the fallback rather than the method.
If you will not paste and compare
If you are going to eyeball it anyway, look at characters twenty through forty rather than the ends. It takes exactly the same second and it is the second that matters.
Where these turn up
- In search results, on a page built honestly over months that later had its links swapped. Nothing was spammed, so there is nothing to detect.
- In a forum reply from an account with years of ordinary history, because accounts change hands and the history stays with the account.
- In a message from somebody you know, who got it from a page and did not check either.
- In your own notes, if you saved it once and never compared it again.
Almost none of those feel suspicious, which is the entire point. The check has to be on the string rather than on the source, because where something came from has never been evidence.