This guide is for anyone who accepts crypto from strangers: P2P traders, freelancers paid in USDT, sellers. In every one of these cases one rule applies: the money has arrived only when you can see it in a block explorer — not a moment earlier.
A block explorer is a website that shows everything recorded on a blockchain: every transaction, every address and every token. For the TRON network (USDT TRC20) it's Tronscan; for Ethereum (USDT ERC20) it's Etherscan. No sign-up needed: paste a transaction hash or an address into the search bar and you see the facts.
01Why only the explorer can be trusted
Everything the buyer sends you is their words and their pictures. A picture can be drawn, a message typed, an email "from the exchange" forged. A blockchain transaction can't be faked: either it exists and shows your address, or it doesn't.
| What you're shown | Can it be faked? | What to do |
|---|---|---|
| A "transfer completed" screenshot | Yes, in a minute in any editor | Don't treat it as proof at all |
| "I've sent it, check" in chat | It's just text | Ask for the transaction hash (TXID) |
| An email or SMS "payment is processing" | Yes, fake ones exist | Ignore it, look in the explorer |
| A transaction hash | It may belong to someone else's transfer, a failed one, or carry a fake token | Check it step by step as in section 02 |
| An incoming transfer on your address in the explorer | No | This is the proof — after you check the token and the status |
02Fake payment screenshot on P2P: verify by hash that the money really arrived
The classic scheme: the buyer clicks "Paid" and sends a screenshot of a successful transfer. The screenshot is edited — or real, but the transfer in it didn't go to you. The seller is in a hurry, releases the coins or the goods and is left with nothing. The defence is to open the transaction in the explorer and check seven fields.
- The site address. It must be tronscan.org (or etherscan.io) that you opened yourself — not a link from the buyer.
- Result: SUCCESS. If it says FAILED, REVERT or another error, the tokens didn't move, even though the transaction is on the blockchain.
- Status: CONFIRMED. The block holding the transaction is now irreversible. While it says UNCONFIRMED — wait (more in section 04).
- Time. It must be after your deal started. An old transaction with a matching amount means you're being shown someone else's transfer.
- Token contract — exactly TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t for USDT on TRON. Anyone can name a token "Tether USD"; nobody can fake the contract (section 03). Don't mix it up: this is the token's address, not the recipient's.
- The recipient is your full address. Check not just the start and the end but the middle too: look-alikes match on the edges.
- The amount matches the deal, in USDT and not in some other token.
Etherscan works the same way, but the fields are named a little differently: Status (should be Success), Timestamp, From. An important trap: for a USDT transfer, the Interacted With (To) field shows the token contract, while the real recipient and amount are further down, in the ERC-20 Tokens Transferred block. Check that block.
03Fake USDT: check the token contract
Anyone can create a token called "Tether USD" with the USDT ticker and the same logo — no permission is needed. Such a token is worthless, but in a wallet it looks like regular USDT. There's only one way to tell it apart — the contract address. Real USDT has exactly one contract per network, and the issuer Tether publishes it on tether.to/supported-protocols.
| Network | Real USDT contract |
|---|---|
| TRON (TRC20) | TR7NHqjeKQxGTCi8q8ZY4pL8otSzgjLj6t |
| Ethereum (ERC20) | 0xdAC17F958D2ee523a2206206994597C13D831ec7 |
- A different contract. The name, ticker and icon match — the contract doesn't. Compare the whole contract address, character by character, with the table above or with tether.to.
- No price. A fake usually has no market price — the explorer shows the amount with no dollar value. It's a hint, not a check: only the contract decides.
- The contract isn't on Tether's list. The issuer publishes its contract addresses for every network — a stranger's address won't be there.
04Success, pending or failed: when the money is really yours
Every transaction in an explorer has a status. Only one of the three means the money arrived.
The transaction executed and is in an irreversible block. You can release the goods — if the token and recipient are right too.
The transaction isn't in a block yet, or the block isn't irreversible yet. On Ethereum the sender can replace a pending transaction with another one (status Dropped & Replaced).
The transaction was recorded but didn't execute. The tokens stayed with the sender; only the fee was spent. For you it's zero.
How long to wait for confirmations
- TRON. A new block is produced every 3 seconds, in turn by 27 Super Representatives. A block becomes irreversible once 19 of the 27 have built blocks on top of it — usually in about a minute. After that, Tronscan switches the status to CONFIRMED.
- Ethereum. A block comes every 12 seconds, but it becomes final (Finalized) only after about 15 minutes. Etherscan shows the number of confirmations next to the block number, and the block page shows its status: Unfinalized, Unfinalized (Safe) or Finalized.
05Check the sender's address before the deal
Even real USDT can cause trouble if it came from a "dirty" address: the exchange you later deposit it to may freeze the funds and ask for an explanation. So before a deal it's worth opening the buyer's address in the explorer and looking at its history.
- Where the first money came from. Etherscan's Funded By field shows the address that first funded the wallet with ETH. A labelled exchange is normal; an unknown fresh address is a reason to dig deeper.
- Age. An address created a couple of days before a large deal is a typical picture for throwaway wallets. That's not a crime in itself, but the risk is higher. In Tronscan you can see the age from the oldest entry in the history.
- The shape of the history. Money arrives from various unknown addresses and immediately moves on — transit wallets often look like this.
- No label doesn't mean "clean". An explorer labels only known addresses (exchanges, sometimes phishing and hacks). A missing label guarantees nothing. If there is a "phishing" or "hack" label — better walk away from the deal.
An explorer shows facts, but it doesn't tell you whether an address is linked to sanctions lists, USDT issuer freezes or known thefts. That part is covered by the AMLConsensus address check: paste the address and see the result for sanctions lists, freezes, and hacker and scammer labels in one report. The first check is free.
06Address poisoning: a look-alike in your own history
When you open your own address in an explorer, the history may contain "empty" transfers — 0 USDT or pennies — from addresses that look very much like your partners': the first and last characters match, the middle is different. This is address poisoning: the bet is that next time you'll copy the address from history and send the money to the scammer.
- Never copy addresses from transaction history — only from your wallet's address book or directly from the recipient.
- Check the middle of the address, not just the edges.
- Check a suspicious address with our address poisoning check — it looks for look-alikes and dust campaigns.
The scheme, with a transaction-history mockup, is explained in detail in "How not to lose your crypto: the 7 most common ways people get robbed", section 04.
07A 5-minute checklist before you release goods or money
Check the buyer's address before the deal
Sanctions, USDT freezes, hacker and scammer labels. The first check is free.
Open amlconsensus.comSources: Tether's list of USDT contracts (tether.to/supported-protocols); TRON documentation on consensus and block solidification (developers.tron.network); the proof-of-stake and finality pages on ethereum.org; the Etherscan Information Center on transaction statuses, Dropped & Replaced and block statuses (info.etherscan.com). The screenshots are schematic interface mockups, not real screens; the addresses and hashes in them are made up, except for the USDT contracts. Tronscan, Etherscan, Tether and USDT are trademarks of their owners, and AMLConsensus is not affiliated with them. This material is educational and is not financial or legal advice.