Bitcoin scams get a lot of press, and that coverage can make accepting Bitcoin feel riskier than it actually is for merchants. The reality is nuanced: many of the most common scams happen to individual holders, not businesses. But understanding the landscape helps you operate with confidence and have better conversations with skeptical customers.
Bitcoin payments are irreversible. This is the opposite of how most merchant fraud works. With credit cards, a fraudster pays, receives goods, then disputes the charge — you lose the product and the money. With Bitcoin, a confirmed payment cannot be reversed by anyone. This removes the most common vector for merchant fraud entirely.
Scams that affect individual holders
These primarily target consumers rather than merchants accepting payments, but they’re worth understanding — your customers may encounter them.
Fake websites, emails, or messages that impersonate legitimate crypto services to steal login credentials or seed phrases. A user gets an email that looks like it’s from their wallet provider, clicks a link, and enters their information on a fake site.
Bookmark the sites you use. Never click links in emails claiming to be from crypto services. Legitimate services will never ask for your seed phrase. OrangeTill will never ask for your seed phrase or private key.
Platforms that promise unusually high returns on crypto deposits. They may pay out initially to build trust, then disappear with deposited funds. Sometimes called “pig butchering” scams when they involve extended social engineering over weeks or months.
If a return sounds too good to be true, it is. No legitimate investment guarantees returns. Be especially cautious of unsolicited contact offering investment opportunities.
Counterfeit apps or websites that look like real crypto services. A user deposits funds, which the scammer controls from the start.
Only download wallet apps from official sources (App Store, Google Play) from publishers you can verify. Check reviews and download counts. Use well-established services with a documented history.
Fake accounts impersonating prominent Bitcoin figures or companies, often promising to “double” any bitcoin sent to a certain address. These circulate during periods of high public attention on crypto.
No one can double your bitcoin. No legitimate giveaway requires you to send funds first. Verified accounts and official websites are the only sources to trust.
Scams that could affect merchants
A bad actor shows a merchant a screenshot of a transaction or points to a pending (unconfirmed) transaction, receives goods, then uses a technique to get the transaction reversed before confirmation. This is rare and technically difficult, but theoretically possible for very large, high-value transactions.
Wait for at least one confirmation before releasing goods for any significant purchase. OrangeTill indicates payment confirmation status clearly. For everyday retail purchases, the risk of this attack is extremely low. For very large transactions, waiting for additional confirmations is prudent.
A physical QR code at a point of sale is replaced or covered with a sticker directing payments to a different address. This is a physical-world attack, not a digital one.
OrangeTill generates QR codes dynamically per transaction — they’re not static printed codes. Each invoice creates a fresh QR code for the correct address and amount. This is one of the reasons dynamic QR codes are preferable to printed ones.
Malware on a device monitors the clipboard. When a Bitcoin address is copied, the malware silently replaces it with the attacker’s address. The user pastes what they think is the correct address and sends funds to the wrong place.
Keep devices used for business updated and protected with reputable security software. Always visually verify the first and last few characters of any address before sending. OrangeTill customers paying via QR code scan bypass this risk entirely — they’re not copying and pasting an address.
The three rules that cover almost everything
Simple principles for staying safe
- Never share your seed phrase or private key with anyone, for any reason. No legitimate service, support team, or partner will ever ask for it. Not OrangeTill, not your wallet provider, not anyone.
- Wait for confirmation before releasing goods on large purchases. OrangeTill shows you confirmation status in real time. One confirmed block is sufficient for the vast majority of retail transactions.
- Verify addresses character by character if you ever need to copy one manually. Check the first four and last four characters at minimum. Better still, use QR codes — they eliminate address entry errors entirely.
The broader picture: Bitcoin’s transparency is a significant security feature. Every transaction is publicly auditable. There is no “the system says it went through” ambiguity. What the blockchain says happened, happened. For merchants, this is a feature, not a liability.
Built with your security in mind.
OrangeTill uses dynamic QR codes per transaction, never stores private keys, and gives you real-time confirmation status for every payment.
Try OrangeTill Free →