A user asks: A 0 USDT transfer has somehow appeared in my transaction record. I did not authorize this transaction. Will it affect the security of my tokens?
imToken: No, it won’t affect the security of your tokens. The 0 USDT transfer is actually a new type of scam. Scammers use the TransferFrom() function of TRX wallets to transfer 0 USDT from your account to his TRX wallet.
What is the TransferFrom() function?
The function allows a third party to transfer tokens from the owner account to the recipient account.
It’s similar to the family payment service offered by Google Play through which a third party, for example your family members, can transfer your money from your account (the owner account) to the merchant’s account (the recipient account) when they make a purchase.
Another feature of the TransferFrom() function is that when the amount of USDT transferred is 0, a third party can transfer 0 USDT from the owner account to the recipient account without the owner's permission.
Just like anyone can transfer $0 from my account (the owner account) to the merchant's account (the recipient account) without my permission.
I know you are confused about this 0 USDT transfer cause it sounds like a meaningless transaction.
Transferring 0 USDT from our TRX wallet address to another address does not make any sense in itself and does not have any impact on the security of our account. However, the scammer will use a fraud address as the recipient address when making transfers, which makes his trick work.
For example, a user often transfers money to the recipient address “TY4tK9…Rmz31D”. The scammer will use a fraud address "TKivqn...Rmz31D", which has the same ending characters "Rmz31D", as the recipient address.
By calling the TransferFrom() function, the scammer transfers 0 USDT from the user's wallet to a fraud address with the same last characters, and then the transfer appears in the user's transaction history.
When the user wants to start a transaction and copies the address from the history, he can easily make a mistake and transfer money to the fraud address if he only checks the last characters, resulting in loss of tokens.
For example, the user wants to transfer some USDT to "TY4tK9...Rmz31D". After opening his transaction record, he finds a transfer to "TKivqn...Rmz31D". If he only checks the last characters of the address, he may mistakenly think that the fraud address "TKivqn ...Rmz31D" is the address he’d like to transfer money to, then he will be caught in the scammer's trap.
PSA
- Don’t worry if you have 0 USDT transfers in your TRX transaction history. These transfers do not affect the security of your tokens.
- Information stored on blockchain is non-temperable. So once your transfer is successful, it cannot be canceled or changed. Please be sure to check the address carefully before transferring! And It is recommended to use the address book feature of imToken when making transfers (Click here for the tutorial).