Check an address before you pay it
Paste the address you are about to pay, and the addresses you already have for your payees. It tells you if it is made to look like one of them, the trick called address poisoning, if a character in it is hidden, from another alphabet or fails its checksum, and if it is on OFAC's sanctions list.
The check runs in this page. Nothing you paste is sent anywhere or kept.
One a line, with a name if you like. Copy them from your own records or past invoices, not from your wallet's recent activity, where a poisoned address hides.
What address poisoning is
Wallets and explorers show an address by its ends, like 0x7a2d…e10d. Someone makes an address with the same ends as one you pay, then sends you a transfer of nothing from it, so it sits in your history beside the real one. The next time you copy an address from your history, you may copy theirs. Nothing about the payment looks wrong until the payee asks where their money is.
The same goes for an invoice whose payment details were changed, or an email that says a supplier has a new wallet. Compare the whole address with one you already had, and confirm a new one with the payee by a call or a message to a contact you had before.
What Vestiarion does inside a workspace
Vestiarion is an AI agent for bills and payments. It never pays a changed payout address until a person confirms it. With its payee lock on, someone other than whoever entered it confirms it when anyone else can, a call or a message must use a contact you had before the change, and the payment can wait up to 72 hours after it. Counterparties warns when a payee's address shares its first 6 and last 4 characters with another payee's, or with the same payee's earlier one, and the agent checks every payout address against OFAC's list. Each step is signed into a ledger anyone can verify.