Change Output

Because Bitcoin spends whole Unspent Transaction Outputs (UTXOs), a wallet rarely has a coin that matches the exact payment amount. When you spend a UTXO worth more than you owe, the wallet sends the payment to the recipient and routes the remainder — the change — back to a fresh address it controls. That returning output is the change output, and identifying it is one of the central goals of blockchain surveillance.

Change-Detection Heuristics

Analysts use several rules of thumb to guess which output is change rather than the real payment. The fresh-address heuristic flags an output going to a never-before-seen address as likely change. The round-number heuristic assumes a clean payment amount (e.g., 0.0500000 BTC) is the recipient and the odd-valued output is change. Other approaches track which output keeps a wallet cluster growing slowly over time. Chained together over many transactions, these guesses let an observer follow a user's coins across hops.

Defending Your Change

Good wallet hygiene reduces leakage: avoid address reuse so change always lands on a new address, prefer amounts that don't betray which output is the payment, and use coin control to keep coins from different contexts apart. Collaborative transactions defeat change detection more aggressively — in a properly built CoinJoin the heuristics simply fail, and PayJoin deliberately confuses which input and output belong to whom.

For the broader picture, read about the Common-Input-Ownership Heuristic and why Address Reuse makes change far easier to track.