Crypto Payment Security: What the Service Covers, What You Cover
Where the line of responsibility falls between a payment service and a merchant when accepting crypto, and how to set that up correctly.
When accepting crypto, each side has its own area of responsibility. Mixing them up creates gaps that are harder to close later.
What the service handles
A payment service is responsible for generating addresses securely, safeguarding funds on your balance, signing payment notifications so they cannot be faked, and protecting your account. A good service does not lose customer funds, does not expose keys to third parties, and notifies you of every movement.
What stays on your side
Account security. Password, two-factor authentication, control over who has access to your API keys. If a key leaks from your systems, the service is not responsible for what follows.
Withdrawal addresses. You specify where to send your money. The service has no way to know whether an address is yours or not. Send to the wrong address and the money goes there.
Customer support. If a customer sends on the wrong network or the wrong amount, the payment cannot be reversed. Dealing with the customer is your job. The service gives you the transaction data; it does not decide whether to issue a refund.
Refund policy. The service provides the refund mechanism, but the decision is yours. That is direct control, not a limitation.
Where risks overlap
Phishing: fake payment pages designed to look like your site. The defense is to always send customers the payment link directly rather than letting them find you through a search.
Old API keys: if staff or developers have changed, rotate the keys.
Check the URL in your browser before showing it to customers. It takes a second.
