Why is the address preview on a small screen not enough to verify a swap destination

07 September 2026

The address preview on a small screen is not enough because a phone display truncates or formats the address in ways that hide critical differences between the intended destination and a look-alike address. The human eye cannot reliably compare two long hexadecimal strings when only a few characters are visible at once.

Mobile wallet screens show wallet addresses in a smaller font, often with ellipses or line breaks that split the string across multiple rows. A common truncation pattern shows the first six and last four characters, hiding the middle portion where attackers insert subtle changes. A single altered character in a 42-character address changes the destination completely, yet the preview may appear identical to a quick glance.

Consider how addresses are rendered on a phone. The screen width forces a reduction in font size or forces the address to wrap to a second line. Both squeeze the visual distinctiveness. On a desktop monitor, the same address appears in a single line with larger characters, making it easier to spot the difference between, say, 0xabcd...1234 and 0xabce...1234. On a phone, those two addresses look functionally the same when previewed.

Another problem is the scroll-and-swipe behavior. You cannot hold the full address steady while checking it against a known reference. You have to scroll back and forth between the preview and the destination you intend. That switching breaks visual memory. Each time you look away, you lose the exact pattern you were holding in mind.

Clipboard malware, covered elsewhere in this set, exploits exactly this weakness. An attacker swaps the real address for a fraudulent one after you copy it. When you glance at the phone's address preview, you see the first few characters and assume the rest matches. The preview gives you false confidence.

Even without malware, the phone's auto-correct or text-replacement features can alter addresses. Some keyboards replace repeated strings with emoji or correct what they think is a typo. The preview shows the final string, but you never saw the intermediate edit.

QR codes are a separate verification method, but they introduce their own risks. A compromised QR code leads to a different address entirely. The phone preview shows the decoded address, but again at a scale that makes verification unreliable. The sibling page on QR code checks covers that in detail.

What is missing from the preview is context. The preview does not show the network, the contract standard, or whether the address belongs to the expected protocol. A USDT address on Ethereum looks identical on screen to a USDT address on BNB Smart Chain, but the swap only succeeds if both match. The preview alone cannot confirm the network.

The only safe way to verify a destination on a phone is to check the full address character by character against a trusted source, using a method that does not rely on visual memory alone. Read the address aloud to a second person. Use hardware wallet confirmation screens. Compare against a previously verified address stored in a separate device. Do not trust a phone's truncated preview.

This page is part of a set about mobile wallet swap safety mistakes to avoid. The next natural step is to read about clipboard malware, which shows how the preview becomes a liability when combined with common copy-paste workflows.

Back to trezor