When transferring USDT on the TRON network, some users rent Energy from services operated by individuals to reduce transaction costs. Scammers exploit this demand by advertising “low-cost rentals” or “free Energy.” During the process, they substitute the recipient address and trick users into transferring assets to a scammer-controlled wallet.
Users who send assets to the wrong address while renting Energy may rush to contact customer support for a refund. This can expose them to impersonators who request their mnemonic phrase or private key or trick them into taking risky actions, resulting in further losses. This issue of the Security Monthly Report explains the common scam tactics used in these two scenarios and how users can protect themselves.
1. The Free Energy Trap: Recipient Address Substitution
When searching for Energy services on Telegram, users may encounter promotions such as “All-in-One Bot for 1 TRX” or “Free Energy.” After users open the relevant bot, it may lure users with offers to claim free Energy five times a day and ask them to enter both the wallet address that will receive the Energy and the USDT recipient address they intend to use later.
In this type of scam, the bot or an associated webpage tricks users into copying an address controlled by the scammer or attempts to replace the contents of their clipboard. Scammers may also generate lookalike addresses with matching or similar characters at the beginning and end, making the substitution harder to notice. If users paste one of these addresses into the recipient field and check only the beginning and end, they may mistakenly send USDT to the scammer's wallet.
PSA:
- Verify the source of the service. Use the Energy rental option in imToken rather than following recommendations from unfamiliar bots, group ads, or direct messages.
- Be cautious of unreasonable requests for information. Renting Energy generally requires only the wallet address that will receive the Energy. If the service also asks for the USDT recipient address you intend to use later, stay alert and do not proceed without careful verification.
- Verify the complete recipient address. Before making a transfer, carefully compare the entire pasted address with the original recipient address. Never assume that the contents of your clipboard are correct. Once verified, frequently used addresses can be saved to your address book. Even then, always reconfirm the recipient and network before transferring assets. To learn more about this risk, read: “Scam Alert | Addresses with the same last characters.”
2. Sent Funds to the Wrong Address? Beware of Fake Support
Some users first send TRX to an Energy provider’s address and then transfer USDT to the intended recipient. If they fail to reconfirm the recipient address before making the second transfer, they may accidentally send the USDT to the Energy provider’s address as well.
Some Energy rental services run by individuals have no clearly identifiable operator or verifiable official support channel. After sending assets to the wrong address, users may find it difficult to determine whom they should contact and whether the service provider is capable of issuing a refund.
Learn more: “Energy Rental Phishing Scam | Security Monthly Report, Issue 31”
When urgently trying to recover their assets, users may search Telegram for a customer support name, wallet address, or related group, only to encounter fake customer support accounts. These impersonators may claim that they need to “process a refund” or “verify wallet ownership” and ask for the user’s mnemonic phrase or private key. They may also trick users into signing transactions, granting token approvals, or performing other actions on unfamiliar websites, allowing them to steal additional assets from the wallet.
PSA:
- Reconfirm the purpose and recipient address of every transfer. Paying an Energy rental fee and transferring USDT are two separate transactions. Never reuse the recipient address from the previous transaction without verifying it again.
- Choose an Energy rental service with a verifiable operator and an official customer support channel. If you send assets to the wrong address, confirm the correct support channel through a trusted source, such as the service provider’s official website. Provide only publicly available information—including the transaction hash (TxID), token name, and transfer amount—and ask the provider to investigate.
- Any request for your mnemonic phrase or private key is a scam. Never follow instructions from unfamiliar customer support accounts to sign transactions, grant token approvals, or perform other actions with an unclear purpose on unfamiliar websites.
- If your mnemonic phrase or private key has already been exposed, stop using the original wallet immediately. Create a new wallet with a new mnemonic phrase on a secure device, and transfer your assets as soon as possible.
Closing Thoughts
As scam tactics continue to evolve, it can be difficult for users to recognize and avoid every threat. imToken will continue to monitor new types of scams and share timely risk information and security alerts with the community, helping users reduce losses and manage their digital assets more securely.
Read and share the imToken Wallet Security Monthly Report to help more users recognize scams and protect their digital assets.