Crypto payment phishing often tries to replace a legitimate checkout, wallet destination or sign-in page with an imitation. Consistent branding helps recognition, but the domain, order context and wallet transaction details are the stronger checks.
Give customers a predictable payment journey
Send invoices through your normal business channel and explain that hosted checkout uses the Coinvay domain. Keep the business name and order reference recognizable so a customer can question a mismatched request. Avoid asking buyers to follow last-minute wallet addresses sent from an unrelated account. For example, an agency billing a retainer should not replace its established invoice link with a support-message address without an authenticated explanation.
Read what the wallet is approving
A one-time payment should present the expected network, recipient and value or token transfer. An unrelated token approval or an unexpected contract interaction needs investigation. Wallet connection and message signing are not automatically harmless just because they do not immediately display a transfer. Teach staff and customers never to enter a seed phrase into a payment page. QR codes should be checked against the visible network and receiving instructions rather than treated as inherently trustworthy images.
Create a calm response process
If a customer reports a suspicious page, pause the order workflow and compare the legitimate saved invoice with the URL and transaction details. Preserve the suspicious message for your own incident process without redistributing credentials or private customer information. Changing a logo alone will not repair a substituted destination. Secure the merchant account and linked email, review receiving-wallet changes and verify the real checkout independently before resuming. Do not promise recovery of a transfer already sent to an attacker; investigate the facts and use the appropriate support channels.
Practical checklist
- Use established channels and clearly identify the expected hosted-checkout domain.
- Verify network, recipient, token and amount in the wallet approval screen.
- Reject requests for seed phrases and investigate unexpected approvals or address changes.
Common questions
Does a correct Coinvay logo prove that a page is legitimate?+
No. Images can be copied. Check the actual domain, order context and transaction details.
Can a QR code protect against an incorrect destination?+
No. It only encodes payment information. Review the decoded destination and network in your wallet before approving the transfer.
Sources and further reading
Primary references and Coinvay product documentation. Check the linked pages for current details.
AI-assisted drafting, published by Coinvay. Examples are illustrative. Read our editorial approach.