Checking only the first and last few characters of an address before transferring is a bit risky. Address poisoning deliberately creates records that resemble addresses you've used before, hoping you'll copy one from your history next time.

MetaMask has issued a specific warning about this tactic. Verify the full address, and whenever possible, get it from a source the recipient has confirmed. Don't treat “looks familiar” as verification.