A link from someone you trust

This is the hardest page here to act on, because the advice sounds like it is about the person and it is not.

Two different things called trust

Trusting a person means believing they are not trying to harm you. That belief is usually correct and it is not what is needed here. What is needed is confidence that the address is right, which depends on whether they checked, not on whether they meant well.

Nearly always they did not check. They got it from a forum, a directory, a search result, or another friend, and passed it on because it worked for them. Somebody honest passing on an unverified address is passing on an unverified address, and their honesty does nothing to the address.

How a bad address travels this way

Chains form quickly and get shorter in the telling. Somebody pulls an address from a forum post, uses it without incident, and becomes a trusted source in their own circle. They pass it to two people who each pass it to two more. By the fourth hop everybody involved got it from someone they trust and nobody in the chain ever checked anything.

What makes this worse than an anonymous source is that it resists correction. Doubting a forum post costs nothing. Doubting a friend feels like an accusation, so people accept addresses from friends with less scrutiny than from strangers, which is precisely backwards given neither carries proof.

The compromise case

The account you are talking to may not be your friend, and this is common enough to plan for rather than dismiss. An account taken over is used exactly this way, because the relationship is the asset.

• Unprompted is the signal. An address arriving without you asking, particularly with a reason attached, is the shape to notice.
• Urgency does not belong here. A friend sharing an address does not need you to use it now.
• Watch for style shifts. The thing people notice afterwards is almost always how it was written rather than what it said.
• Confirm out of band if it matters. Ask about something only they would know, in a different channel.

How to handle it without being rude

You do not have to tell anyone you are checking. Verification happens on arrival, at the destination, and nobody is watching. Take the address, say thanks, check it like you would check any other, and if it is right then nothing awkward ever happened.

If it turns out to be wrong, that is worth telling them, because they are probably passing it to others and they will want to know. Being wrong here is not a character failing. It is the normal state of everybody who has not pinned a key.