What a check shows
What a check actually shows
Three layers, and each is a different question.
Address validity
Does the string parse as a real address on the network you think it belongs to. Free, instant, and it catches the most expensive routine mistake, which is sending to the wrong network.
Transaction history
Balance, first and last activity, every transfer in and out. Any block explorer shows this without an account.
Risk score
Where the funds came from, traced back through recent hops, with each source category weighted. This is KYT, and doing it properly requires licensed data from Chainalysis, TRM Labs or Elliptic.
What free tools can and cannot do
Explorers show the history, and reading it manually tells you something: an address created yesterday receiving a large transfer looks different from one with three years of ordinary activity.
What free tools cannot do is cluster analysis. Identifying that fifty addresses belong to one exchange, or that a particular cluster is a known ransomware operator, requires a labelled dataset built over years. Some explorers display basic risk indicators derived from licensed feeds, and those are worth a glance without being a substitute.
Sanctions lists are the exception. The OFAC list is public, and checking an address against it is something anyone can do, as the entry on sanctions screening describes.
The scams around this
The scam economy around this
Worth stating plainly, because the search term attracts a lot of it.
Sites offering to check your wallet for cleanliness, then asking for a connection to it, a seed phrase or a signature, are stealing. A genuine check needs only the address, which is public information. Anything asking for more is asking for control.
The pattern extends to services claiming they can clear a flagged address for a fee. Nobody can. A risk score reflects transaction history, and history does not change because somebody was paid.
What to do in practice
What to do before receiving a large transfer
Two things, and both take a minute.
Ask the sender where the funds came from. A straightforward answer from an exchange withdrawal is different from a vague one, and asking costs nothing.
Check the sending address in an explorer if you have it in advance. A pattern of small transfers from many unrelated addresses looks different from a single withdrawal from a known venue.
What to do if you received tainted funds
Do not move them immediately. A transfer onward extends the history to your next address and can complicate your own withdrawal to fiat later.
Establish where they came from, keep the correspondence, and if the amount is significant, get advice before converting. A payment gateway screens incoming payments and may hold one, which feels obstructive and is preferable to discovering the problem at the bank months later.
For a merchant, this screening is part of what the provider does rather than something to run yourself, and the setup guide covers where the responsibility sits.