Crypto Payment Scams Targeting Merchants (and How to Stop Them)
Crypto has no chargebacks, so scammers attack merchants in other ways: fake proof of payment, poisoned addresses, look-alike tokens and 'please refund to this new address'. Here is how each scam works and the simple rules that stop them.
Crypto payment scams that target merchants rarely break the blockchain — they trick people. The most common ones are fake payment screenshots, address poisoning, look-alike tokens, refund tricks and phishing for your panel or wallet. The best defence is one rule: treat an order as paid only when your own gateway or wallet shows the confirmed payment, never because a customer says so.
Below is how each scam works, how to spot it and what to change in your process so it cannot succeed.
The scams at a glance
| Scam | How it works | What stops it |
|---|---|---|
| Fake proof of payment | Edited screenshot or fake transaction hash sent in chat | Fulfil only on a confirmed status in your dashboard or webhook |
| Address poisoning | Tiny transfers from a look-alike address so you copy the wrong one later | Never copy addresses from transaction history; verify the full address |
| Look-alike tokens | A worthless token named "USDT" sent instead of the real one | Match by token contract, not by name — a gateway does this for you |
| Overpayment refund trick | "I sent too much, refund the difference to this other address" | Check the received amount yourself; refund only to verified addresses |
| Fake support and phishing | Messages or sites asking for your login, 2FA code or seed phrase | No real support asks for secrets; use bookmarks and 2FA |
1. Fake screenshots and fake transaction hashes
A buyer sends a screenshot of a wallet showing "Sent 250 USDT", or a transaction hash that belongs to someone else's payment, and asks you to ship now. Editing a screenshot takes seconds.
- Use one invoice per order — each order gets its own amount and payment page, so a payment can be matched automatically.
- Fulfil on confirmed only — with a gateway, ship when the invoice shows confirmed or the signed webhook arrives. See crypto payment webhooks.
- If someone insists — open the hash in a block explorer and check recipient, token, amount and time. Often it simply is not your address.
2. Address poisoning
Scammers send tiny transfers to your wallet from an address that starts and ends with the same characters as one you use. Later, when you copy "your" address from the transaction history to send funds or share it, you copy theirs.
- Copy addresses from the source — your wallet's receive screen or saved contacts, never from history.
- Check the whole address — not just the first and last four characters.
- Send a test first — for large withdrawals or refunds, a small test transfer is cheap insurance.
3. Look-alike tokens
On most networks anyone can create a token and call it "USDT". If you only look at the name and the amount, a worthless token can look like a real payment.
A payment gateway matches incoming transfers to the official token contract on a specific network, so a fake token never marks an invoice as paid. If you accept payments to a plain wallet, check the contract address in a block explorer. More on networks: USDT TRC-20 vs ERC-20.
4. Refund and overpayment tricks
"I accidentally sent 500 instead of 50 — please send back 450 to my friend's address." Sometimes nothing extra was sent at all; sometimes the extra came from a stolen source.
5. Fake support, phishing and account takeover
- Nobody needs your seed phrase — not your gateway, not a wallet company, not "security". Anyone asking is a scammer.
- Bookmark your panel — log in from a bookmark, not from links in messages or ads.
- Turn on two-factor authentication — and never share the codes.
- Protect payout settings — treat any change of withdrawal address as a security event and double-check it.
A short anti-fraud checklist for your team
- One invoice per order with a fixed amount and expiry.
- Ship on confirmed status or signed webhook only.
- Never copy addresses from transaction history.
- Refund only after checking the received amount yourself.
- Keep secrets secret — seed phrases offline, 2FA on, logins from bookmarks.
- Write it down — a one-page process every team member follows.
Accept crypto safely with mistKET
mistKET creates a hosted invoice for every order, detects and confirms USDT on TRON automatically and sends signed webhooks, so your shop reacts to real on-chain payments, not to screenshots. New to gateways? Read what a crypto payment gateway is, check pricing, log in to the merchant panel, or apply on Telegram at @mistnetwork.
