Accepting cryptocurrency cuts transaction fees, removes chargebacks and opens your business to customers worldwide. It also moves the security burden onto you: crypto transactions are final, so there is no issuer to reverse a fraudulent payment.
A compromised gateway means lost funds, unauthorised transactions, downtime and reputational damage. This guide is the checklist we apply to Jamesinvoicing itself — use it to audit whatever gateway you run.
Why crypto payment security is different
Card networks assume mistakes and build reversal into the rails. Blockchains do not. If funds leave to the wrong address, or an attacker swaps your receiving address, the money is gone.
That means every layer has to hold on its own:
- Payment processing logic
- Wallet and key infrastructure
- Customer and transaction data
- API integrations
- Servers and hosting environment
- Administrative accounts
1. Use a self-custodial wallet
The single biggest decision is where the crypto lands. Self-custody means funds settle straight from the customer to a wallet only you control.
- Complete ownership of your assets — no processor balance sheet in between
- No rolling reserves, freezes or withdrawal queues
- No counterparty risk if a processor is hacked or shuts down
- Better privacy for you and your customers
Jamesinvoicing is self-custodial by design: you add an xPub or a receiving address, and payments settle on-chain directly to you. See how it works in the installation guide.
2. Protect your private keys and xPub
Private keys are the funds. An xPub is not spendable, but it reveals your entire address history — and if an attacker can replace it, they redirect future payments.
- Never commit keys or seed phrases to a repository
- Never send them over email or chat
- Store recovery phrases offline, ideally on paper or metal, in two locations
- Encrypt any wallet backups you keep digitally
- Limit who on your team can change receiving wallet settings
Confirm a changed receiving address on a second channel before you save it. Address-swap attacks are one of the most common ways merchants lose crypto revenue.
3. Enable multi-factor authentication everywhere
Passwords alone are not enough for anything that touches money. Turn MFA on for your gateway dashboard, hosting panel, cloud console, domain registrar, email and exchange accounts.
Prefer an authenticator app or hardware key over SMS. Jamesinvoicing supports TOTP and email one-time codes, plus trusted-device handling so day-to-day logins stay quick.
4. Verify every transaction before marking an invoice paid
Never mark an order fulfilled on an unconfirmed sighting. Verification should check:
- Confirmation depth on the correct chain
- The exact receiving address for that invoice
- The full amount, including a tolerance you control
- Fee-bump and replace-by-fee behaviour
- Double-spend and duplicate-transaction protection
A unique address per invoice is what makes this reliable — it removes the ambiguity of two customers paying the same address. Our API documentation covers the invoice lifecycle and confirmation states in detail.
5. Harden your website and server
A gateway is only as strong as the infrastructure under it.
TLS everywhere
Serve every page over HTTPS, including checkout and webhook endpoints, and enable HSTS.
Web application firewall
Filter malicious traffic before it reaches your application.
DDoS protection
Keep checkout reachable during traffic floods.
Patch discipline
Keep the OS, runtime, gateway software, plugins and extensions current. Most breaches use known, already-patched bugs.
6. Secure your API integrations
Most integrations — WooCommerce, Shopify, BigCommerce or custom — run on API keys.
- Authenticate every request and reject unsigned webhooks
- Verify webhook signatures before you act on a payload
- Rotate API keys on a schedule and after any staff change
- Scope keys to the minimum permissions needed
- Rate-limit and log all API activity
Manage and rotate your keys from the dashboard at any time.
7. Monitor for suspicious activity
Early detection is what turns an incident into a non-event. Watch for repeated failed logins, logins from new countries or devices, unexpected configuration changes, unauthorised API calls and payment patterns that do not match your usual volume.
Jamesinvoicing logs sign-ins with device, browser and location, and alerts you when a new device is used.
8. Audit regularly and train your team
Review wallet configuration, receiving addresses, user permissions, server posture and payment verification at least quarterly.
Human error is still the largest single risk. Train staff to recognise phishing, use a password manager, follow least-privilege access and report anything unusual immediately.
Common mistakes to avoid
- Storing private keys on an internet-facing server
- Reusing one static address for every invoice
- Sharing a single admin login across the team
- Skipping webhook signature verification
- Trusting zero-confirmation payments for high-value orders
- Never testing wallet backup and recovery
Frequently asked questions
Is a self-custodial crypto payment gateway safer than a custodial one?
For merchant funds, yes. With self-custody the processor never holds your money, so a processor breach, insolvency or account freeze cannot touch it. The trade-off is that key management becomes your responsibility.
How many confirmations should I require before shipping?
For Bitcoin, one confirmation is generally fine for small orders and three to six for high-value ones. Faster chains and stablecoins have different norms — set the threshold per product value rather than using one global number.
What happens if a customer underpays or overpays?
A good gateway records the exact amount received and leaves the invoice partially paid rather than silently fulfilling it. Define a tolerance and a refund path before you go live.
Do I need KYC to accept crypto payments?
For a self-custodial gateway there is no platform custody, so the processor does not need to hold your funds or your identity documents. Your own local tax and regulatory obligations still apply.
How do I stop attackers redirecting my payouts?
Require a second factor and an explicit confirmation step for any change to the receiving wallet, and alert on the change by email. Jamesinvoicing does both by default.
Conclusion
Security for crypto payments is not a one-time setup — it is a process. Self-custody your funds, protect your keys, enforce MFA, verify every transaction on-chain, harden your servers and APIs, and monitor continuously.
Ready to accept crypto with self-custody built in? See pricing or start with the installation guide.