Why a small screen address preview can trick you into approving the wrong token

07 September 2026

A small screen address preview can trick you into approving the wrong token because mobile wallets truncate long addresses and token names in ways that make different tokens look identical. When you approve a token for a swap, you are granting permission for the swap contract to move that specific token from your wallet. If you approve the wrong one, you may lose access to the real token or authorize a scam contract.

How truncation hides the difference

Mobile wallets show only the first few and last few characters of a token-safety-checks/token-contract-address-block-explorer-verification/">token contract address - often just 6 - 8 characters visible in a preview. Two different tokens can share the same first and last characters. For example, a legitimate USDC contract and a fake "USDC" copycat might both start with "0x1aB2" and end with "9cD3". On a phone screen, the preview shows "0x1aB2...9cD3" for both. You cannot tell them apart without expanding the full address.

Token symbols make the problem worse. Wallets often display the symbol a project claims for itself. A scam token can call itself "USDC" in its contract metadata. The wallet shows "USDC" for both the real and the fake token. You see the same symbol, the same truncated address, and no obvious red flag.

The approval prompt is the critical moment

During a mobile swap, you approve a token so the swap contract can spend it. The approval prompt shows the token name, symbol, and a truncated address. On a small screen, these elements are squeezed into a small box. You may scroll past them quickly. The wallet may not show the full contract address unless you tap a tiny "show more" link. Many users skip that step.

If you approve a fake token, the swap contract cannot spend your real tokens - but the fake token contract now has approval to drain any token it can reach. Some fake tokens are designed to impersonate real ones, then use that approval to steal the real token from your wallet. The approval itself becomes the attack vector.

Why mobile makes this easier to miss

Desktop wallets show more information at once. A 24-inch monitor can display the full contract address, the token symbol, and the approved amount without scrolling. On a phone, each approval screen shows only what fits. You must actively expand each field. The mental cost of verifying every detail is higher. Fatigue sets in faster.

Mobile notifications and interruptions compound the problem. A text message, a call, or a background app refresh can break your focus mid-approval. You return to the screen and approve what looks right without re-verifying.

What to do about it

Expand every truncated field before approving. Tap the token name, the contract address, and the spender address. Compare the full address against the one shown on the swap site. If the swap site shows a different address than the wallet approval prompt, stop. Do not approve.

Use a token list or block explorer on a second device to verify the contract address. Cross-check the symbol and the address independently. If the swap site tells you to approve "USDC" but the contract address belongs to a token launched yesterday, that is a warning.

For the broader set of problems that happen during mobile swaps, read the hub page "Why mobile wallet swaps fail more often." It covers the systemic reasons these small-screen mistakes occur, from network mismatches to clipboard risks. The approval trick is one common failure point among several.

Back to token safety