Accepting cryptocurrency through a payment gateway shifts some risks away from the merchant: the gateway handles address generation, blockchain monitoring and conversion. Other risks remain with the merchant, especially account access, integration security and operational processes. This checklist covers what overseas merchants should review before and after going live.
Account access
Enable two-factor authentication for every user of the merchant dashboard, using an authenticator app rather than SMS where possible. Give each staff member their own login; multi-user support exists so that credentials are never shared. Assign the minimum permissions each role needs, so that support staff can view transactions without being able to change withdrawal settings. Review the user list monthly and remove leavers immediately.
Withdrawal settings
Withdrawal addresses and bank accounts are the highest-value target for attackers. Restrict who can change them, require 2FA for every change, and enable notifications so that any change triggers an email or message to several people. Where the gateway supports address allow-lists or time delays for new withdrawal destinations, turn them on.
API keys
Store API keys only on servers, in environment variables or a secrets manager, never in front-end code, mobile app bundles or code repositories. Use separate keys for test and production. Rotate keys when staff with access leave, and immediately if a leak is suspected.
Webhooks
Verify the signature on every payment notification before acting on it. Do not mark an order paid based on a redirect from the payment page alone, because redirects can be forged. Process notifications idempotently, so duplicates do not ship goods twice. Log every notification with its verification result.
Order and amount checks
Confirm that the amount and currency received match the order. Define rules for underpayment, overpayment and late payment, and enforce them in code rather than by hand.
Customer protection
Tell customers clearly that staff will never ask for private keys or seed phrases. Publish official support channels so customers can recognise impersonators. Phishing that targets a merchant's customers damages the merchant's reputation even when the merchant is not at fault.
Monitoring
Turn on transaction notifications. Review daily reports for unusual patterns such as many small payments from one source or a sudden rise in refunds. Reconcile gateway records with your order system daily.
Incident plan
Write down who to contact at the gateway, how to freeze withdrawals, and how to rotate keys. Test the plan once a year.
A more detailed guide to securing crypto payments is available at crypto payment security guide.
References
- OWASP guidance on API security and webhook verification.
- Payment gateway documentation on two-factor authentication and multi-user roles.
- PandaWM merchant onboarding notes for overseas merchants (Hong Kong service provider).
Published by PandaWM, an overseas marketing team based in Hong Kong.