How to Accept Crypto Payments on Your Website, Safely

How does crypto checkout work on a website?

It works like an invoice with a wallet address on it. Your customer picks crypto at checkout, sees an exact amount, a wallet address and a QR code, and sends the payment from their own wallet or exchange app.

Here is the whole journey in plain words:

1. The invoice is created. Your site asks the payment system for a fresh invoice: the price in your currency, converted into the coin the customer chose.
2. The customer pays. They scan the QR code or copy the address and amount. The invoice usually has a timer, because coin prices move.
3. The network confirms it. The payment is checked and added to the blockchain. Until that happens, the payment is not final.
4. Your site gets told. The payment system sends your website a message (a webhook) saying the payment is complete. Only then does the order unlock.

The golden rule: never deliver on "payment seen". Deliver on "payment finished". The NOWPayments integration guide says it plainly about the confirming stage: "Do nothing. The payment is not final yet."

Should you use a crypto payment gateway or your own wallet?

For most businesses, a crypto payment gateway is the safer choice. Posting your own wallet address on a page looks simple, but you then have to match every payment to every order by hand.

• Your own wallet. No middleman and no gateway fee. But there is no automatic invoice, no order matching, no timer and no webhook. One customer sends the wrong amount and you are doing detective work.
• A crypto payment gateway. It creates a unique invoice per order, watches the blockchain for you, tells your website when the money arrives, and can convert coins into the currency you want to keep.

What we do ourselves. On jpsheet.com, one of our own AZi Solutions brands, customers can pay by card through Stripe, by PayPal, or in crypto through NOWPayments. Crypto sits next to the normal options. It does not replace them.

Check the webhook properly. A good integration verifies the gateway's signature on every message and ignores duplicates. The NOWPayments guide recommends checking an HMAC signature rather than trusting any request that arrives, and checking for an existing payment ID because duplicates can happen.

Which coin and network should you accept?

Start with a stablecoin such as USDT or USDC. A stablecoin is designed to hold the value of a normal currency, usually the US dollar, so the price your customer paid is close to the price you keep.

Bitcoin and other coins move in price. If you accept them and hold them, your income goes up and down with the market. That is investing, not selling. Many gateways can convert coins automatically so you never hold them.

The network matters as much as the coin. USDT exists on many blockchains. Tether lists Ethereum (ERC20), Tron (TRC20), BNB Smart Chain, Solana, Avalanche and others. The same coin on two networks is not interchangeable at the address level.

• Pick one or two networks. More choice means more customer mistakes.
• Show the network name in big letters. "Send USDT on Tron (TRC20) only" next to the QR code saves a lot of support emails.
• Check the network fee. On some networks a transfer costs very little; on others it can cost far more when the network is busy. Look at the live fee before you choose which networks to offer.

What about refunds and chargebacks?

There are no chargebacks in crypto. Once a payment is final, the customer cannot ask a bank to pull it back. The US Federal Trade Commission puts it simply: "Cryptocurrency payments typically are not reversible."

That cuts both ways:

• The good side. No surprise chargeback months later after you have delivered a digital product.
• The responsibility. Your customer has fewer protections than with a card, so your refund promise has to be clear and honest. If you owe a refund, you send it back yourself.

Write a crypto refund rule before your first sale. Say which currency you refund in, who pays the network fee, and that refunds go back to a wallet address the customer confirms in writing, not to whatever address the payment came from. Exchanges often send from shared addresses.

What records and taxes should you keep?

Treat every crypto sale like a normal sale, with a little more paperwork. Tax authorities generally see crypto received for goods or services as income, valued in your normal currency at the time you received it.

The IRS, for example, says income from digital assets is taxable and that you must track "the fair market value as measured in U.S. dollars of all digital assets received as income." Other countries have their own rules, so ask your accountant what applies to you.

For every crypto payment, keep:

• The order number and what was sold
• The coin, network and amount received
• The value in your currency at that moment
• The transaction ID (hash) from the blockchain
• Any conversion into normal money, with its date and rate

Let the gateway do the heavy lifting. Most gateways keep a payment history you can export. Download it every month and store it with your other sales records.

What are the rules for accepting crypto payments?

The rules depend on where you are and how you do it. Selling your own products and being paid in crypto through a licensed gateway is very different from holding, exchanging or moving crypto for other people.

• Money-laundering rules. The international standard-setter, FATF, says businesses that provide virtual asset services "are subject to the same relevant FATF measures that apply to financial institutions" (FATF guidance on virtual assets). That includes the "travel rule", which makes those providers pass on information about who is sending and receiving transfers.
• Sanctions. US authorities say sanctions apply to crypto exactly as they do to normal money, and publish blocked wallet addresses. Their sanctions guidance for the virtual currency industry recommends screening wallet addresses and blocking users from sanctioned locations by IP address.
• In the UAE. In Dubai, VARA is the regulator responsible for virtual assets and virtual asset activities across the emirate, including its free zones but not the DIFC. Other emirates and other countries have their own regulators.

The practical takeaway: use a gateway that handles identity checks and screening on its side, read its terms for the countries it serves, and never offer to "exchange" or "hold" crypto for customers unless you are licensed to.

This is general information, not legal, tax or financial advice. Rules change and differ by country, so check with a qualified adviser before you start.

What can go wrong when you take USDT payments?

Most problems are customer mistakes, not hacks. Plan for them and they become small support tickets instead of lost money.

• Wrong network. A customer sends USDT on one network to an address meant for another. Getting it back can be slow or impossible. Clear labels prevent most of this.
• Short payments. Exchange fees mean the customer sends a little less than the invoice. The NOWPayments guide marks this as "Partially Paid" and says "Do not deliver." Decide in advance whether you accept small shortfalls.
• Late payments. The invoice timer runs out and the price moved. Your gateway settings decide what happens next; learn them before launch.
• Fake "payment sent" screenshots. Never deliver because someone shows you a screenshot. Only the finished status from your gateway counts.
• Risky wallets. Some addresses are linked to sanctions or crime. Gateways that screen addresses protect you from accepting money you would later have to explain.

When should you not accept crypto?

Crypto is an extra door, not a replacement for cards. Skip it, or wait, if any of these sound like you:

• Your customers never ask for it. If nobody has asked in a year, a card checkout that converts better is worth more.
• You sell to people who need consumer protection. Without chargebacks, a dispute becomes harder for both sides.
• You cannot keep clean records. If your bookkeeping is already behind, crypto makes it worse.
• Your bank is unsure. Some banks ask questions about crypto-related deposits. Talk to yours before the first conversion lands.

Where it makes sense: international buyers in countries where cards fail or cost a lot, digital products, and business suppliers who prefer stablecoins. We pay one of our own data suppliers in USDT for exactly that reason: it is the method they accept.

Your checklist to accept crypto payments safely

1. Choose a gateway that screens payments, supports your country and offers webhooks.
2. Start with one stablecoin on one or two networks. Label the network clearly at checkout.
3. Turn on auto-conversion if you do not want to hold crypto.
4. Deliver only on "finished". Verify the webhook signature and ignore duplicates.
5. Write your crypto refund rule and put it on your refund policy page.
6. Export payment history monthly and keep transaction IDs with your sales records.
7. Keep card and PayPal checkout next to crypto, so no customer is forced into it.
8. Test with a small real payment before you announce it.

Want it built into your site properly, with cards, wallets and crypto in one checkout? That is what our payment solutions service does, and it works with a custom web app or an existing website. If you also want payment follow-ups to run on their own, see business automation.

Frequently asked questions

Sources

• FATF — Updated guidance for a risk-based approach to virtual assets and VASPs
• VARA — About the Virtual Assets Regulatory Authority
• OFAC — Sanctions Compliance Guidance for the Virtual Currency Industry
• IRS — Digital assets
• Tether — Supported protocols
• NOWPayments — Best integration practices
• FTC — What to know about cryptocurrency and scams