A familiar contact instead of a long address

UPCX's current wallet documentation puts phone-number lookup, UPCX IDs and chat payments at the center of its consumer experience. Its privacy notice, updated October 14, 2026, describes those features in version 0.6.9. The change in payment flow is relevant to address poisoning: selecting a registered contact can avoid the step in which a user copies the wrong address from transaction history.

How the copy-paste trap works

In an address-poisoning attempt, an attacker places a transaction involving a lookalike address into a wallet's visible history. A hurried sender may recognize the beginning and end of the address and overlook different characters in the middle. Trezor's security guidance explains that the attacker does not need the victim's private key for this trick. The loss happens when the victim authorizes a transfer to the wrong destination.

Related reporting: UPCX and BitTrade Plan October 21 UPC Payment Pilot

What UPCX's directory changes

According to UPCX's notice, phone and username lookup resolve to a linked public wallet, subject to discovery preferences. Optional contact matching can help find registered members. Linking a replacement wallet changes where future lookups point; it does not move the old wallet's funds or recover its keys. A familiar name is therefore a way to find a destination, not proof that every future destination associated with that name is the one a sender intended.

Convenience is not a measured security result

The potential benefit is specific: fewer occasions to select an address from a transaction log. The reviewed sources do not provide a controlled study showing fewer losses among UPCX users. A misleading contact, mistaken identity or unexpected wallet change still needs attention. This is a product approach to a known problem, not evidence that address poisoning or payment mistakes have been eliminated.

What users should still check

Trezor advises obtaining the recipient's address from its original source, checking the complete destination and avoiding address reuse from transaction history. For an unfamiliar or changed recipient, confirming the details through an established channel remains sensible. UPCX also says recovery phrases stay under the user's control and cannot be restored by the company. Phone verification does not replace a private recovery backup. Readers can review our wallet-custody and scam-prevention guides below before deciding which safeguards fit their own transfers.

Sources

Prepared with AI assistance and source verification. Product descriptions and reported milestones are attributed to their sources.