Safety Academy · Story 12 · Clipboard & QR substitution

Copied correctly. Pasted elsewhere.

Cleo has the right supplier address. The final screen has other plans.

Estimated 4 min read

CLIPBOARD & QR SUBSTITUTION6 scenes

Cleo copies a verified payment address.

Cleo gets a 75 USDC invoice through her supplier’s verified contact. She agrees the network and copies the payment address, shown here as 0x41D8…72B4, into her wallet.

Cleo

“This time I got it from the supplier.”

Starting from a trusted source is necessary. Still check what reaches the final payment screen.

Malware replaces what she pastes.

On this compromised computer, malware substitutes a different address in the clipboard. The payment form receives 0x8A03…F910. A replaced payment QR code can create a similar wrong-destination problem.

The Scammer

“Copy. Paste. Profit. For me.”

Illustration: Malware replaces what she pastes.

In this fictional case, the destination changes on the way into the payment form.

The confirmation screen shows a different recipient.

The amount is still 75 USDC, but Cleo notices that the destination on the final confirmation screen differs from the supplier’s details. She has not signed.

Cleo

“That is not what I copied.”

Illustration: The confirmation screen shows a different recipient.

A correct amount does not compensate for a wrong recipient.

Capitano Ritas checks the final destination.

Capitano Ritas helps compare the complete destination against the trusted invoice and checks the network and amount. When using a hardware signer, its trusted display is part of that final check.

Capitano Ritas

“Your clipboard has made a creative contribution. Cancel that.”

The shortened addresses here are illustrations. In a real payment, compare the complete destination.

Cleo cancels and investigates the device.

Cleo cancels and stops using the suspect computer for payments. She investigates from a trusted setup rather than trying the same paste again with real funds.

Cleo

“I am not giving Paste another chance with real money.”

Do not repeatedly paste and send on a device that appears to be changing addresses.

The substituted destination receives nothing.

The replacement address receives nothing. The story shows address excerpts; Cleo checks every character in the actual payment. Copying or scanning starts a payment form. It does not verify its recipient.

Cleo

“Seventy-five reasons to read the last screen.”

Illustration: The substituted destination receives nothing.

The habit: verify the final destination after every paste or scan.

The useful bit

Check the destination after pasting or scanning, not only before.

Check the full address on the final screen, after pasting or scanning, not just before.
Check the network and the amount too. With a hardware wallet, trust its own screen, not the computer's.
If anything differs, cancel. Clean the device before you try again.

Ledger: checking the secure screen ↗

I already did this

Stop payments on the suspect device. Use the maker’s security guidance; Microsoft’s guide covers Windows malware checks. If you already sent money, preserve the transaction for a fraud report. Correcting the clipboard cannot reverse a completed payment.

Sources & further reading

Ledger: checking the secure screen ↗