Crypto payments have no chargeback and no support line that can reverse a mistake, so security is front-loaded: you get it right before you press send, or you don't get it right at all. The good news is that the risks are well understood and the defences are simple habits.
Custody: who holds the keys
Every security decision starts with custody. If a provider holds your keys, your risk is their security and solvency; if you hold your keys, your risk is your own backups and discipline. Neither is automatically safer — they move the risk to a different place.
Match custody to the amount and purpose. Small operating balances are fine in a reputable custodial wallet for convenience; larger holdings belong in self-custody, ideally with a hardware wallet, and the recovery phrase stored offline where no camera or cloud has ever seen it.
Invoice and payment-page scams
A common attack swaps the payment address on a page or in a message a victim is about to pay. You think you're paying a legitimate invoice, but the address belongs to the attacker. Because the payment is final, the money is gone the moment it confirms.
Defend by verifying the destination through a second channel for anything significant: confirm the address with the recipient directly, use signed or gateway-hosted invoices rather than an address pasted into a chat, and be suspicious of any last-minute 'updated payment details' message.
Address hygiene
Never retype an address, and don't trust your clipboard blindly — clipboard-hijacking malware silently replaces a copied crypto address with the attacker's. Always paste, then check the first and last several characters against the source, and prefer scanning a QR code from the genuine invoice.
Watch for address poisoning, where an attacker sends you a tiny transaction from an address that resembles one you use, hoping you'll later copy it from your history. Copy addresses only from the real source, never from your transaction list.
- Paste, never retype; verify the first and last characters.
- Prefer QR codes and gateway-hosted invoices over pasted addresses.
- Keep a small native-coin balance so a payment isn't rushed for gas.
- Send a tiny test transfer first for a large or first-time payment.
Confirm the network, not just the address
A correct address on the wrong network can strand funds. Before sending, confirm the coin and the chain match what the recipient expects — sending an ERC-20 token to a correct-looking address on the wrong chain is a frequent and painful loss.
Gateways reduce this risk by showing the exact coin, network, and amount, and by generating a fresh address per invoice. Using a proper checkout instead of a bare address is itself a security control.
Refunds and disputes, handled safely
Since there are no chargebacks, refunds are manual transfers you initiate — which means a refund request is also a social-engineering surface. Verify the original payment by its transaction hash before refunding, and send only to an address confirmed with the genuine customer.
For merchants, write these steps into a policy so staff don't improvise under pressure. Most losses in crypto payments aren't exotic hacks — they're ordinary mistakes and manipulations that a checklist would have caught.
Frequently asked questions
Can a crypto payment be reversed if I make a mistake?
No. On-chain payments are final and have no chargeback. That's why verification before sending — right address, right network, right amount — is the entire security model.
What is clipboard hijacking and how do I avoid it?
Malware that silently replaces a copied crypto address with the attacker's. Avoid it by pasting and then checking the first and last characters against the source, preferring QR codes, and keeping your device clean.
Should I use a custodial or self-custody wallet?
Match it to the amount. A reputable custodial wallet is convenient for small operating balances; larger holdings belong in self-custody with a hardware wallet and an offline recovery phrase.
How do I safely refund a crypto payment?
Verify the original payment by its transaction hash, confirm the refund address directly with the genuine customer, and send from a funded wallet. Never refund to an address supplied only in a follow-up message you can't verify.