At a glance
| Decision | Practical answer |
|---|---|
| Start here | Protect the public request, private management access and wallet signing as separate surfaces. |
| Choose deliberately | Give cashiers the information needed to match a receipt, rather than unnecessary signing authority. |
| Main tradeoff | A familiar token name, screenshot or sound alone does not prove the correct sale is paid. |
A valid USDC transfer can still pay the wrong recipient. A convincing screenshot can still describe a transaction unrelated to the sale. Security for a merchant payment is therefore a chain of checks, not one label such as stablecoin or non-custodial.
This checklist covers operational risk within the merchant payment series. It does not certify a provider, wallet or business as safe.
Separate the risks before selecting controls
| Risk | A practical control | What it does not establish |
|---|---|---|
| Fake token or wrong chain | Verify exact asset and network in the request and receipt | Future market value or conversion availability |
| Replaced printed QR | Inspect the physical sign and scan its destination during setup and routine checks | That a later unrelated transfer matches an order |
| Stolen management access | Restrict private links and configuration permissions | Protection of a separately compromised wallet |
| Malicious signing request | Review recipient, amount, network and requested permissions in a trusted flow | A universal guarantee from a familiar logo |
| Lost or stolen wallet control | Appropriate wallet protection and documented recovery | Removal of issuer or smart-contract restrictions |
| False payment claim | Verify a completed merchant record and matching transaction details | Automatic order fulfillment |
Protect what customers scan
Keep customer-facing Payment links separate from private management and POS access. A printed sign should lead to the intended public request. Check its destination after printing and inspect for stickers or other physical replacements during operation.
The sign generator checks public-link format and makes a printable QR; it does not verify the recipient, checkout availability or the actual paper displayed later. A successful export is not a security audit.
Verify the asset as well as the amount
A token can copy a familiar name or symbol. Use the request's supported network and asset identifier; Circle's official contract directory is a primary reference for native USDC. Read native versus bridged USDC before accepting an unfamiliar representation.
For Solana, the mint identifies the asset and the receiving address identifies the destination. Do not substitute one for the other. For EVM networks, an address looking familiar does not establish which chain a payment used.
Give staff receipt access, not unnecessary signing power
A cashier usually needs the requested amount, payment feedback and a completed receipt to match against an order. That does not require sharing the business's wallet recovery material or permission to move accumulated revenue.
Keep wallet control, payment management and customer-facing display roles distinct. Follow staff receiving without the owner wallet. If staff need refunds, define an authorization procedure rather than assuming that receiving access should also permit spending.
Treat a signature as an authorization decision
A request to sign is not harmless merely because no native gas is requested. A signature can authorize a transfer or establish other permissions. Review what the particular wallet displays, use the intended product destination and reject unfamiliar requests instead of signing to make an error disappear.
Gas sponsorship concerns who pays execution costs, not whether the transfer deserves approval. The gasless guide explains the mechanisms without treating them as a safety seal.
Match a completed receipt before delivery
Check the merchant's completed record, amount, supported network and transaction details. A customer's wallet screen can help investigate but should not replace merchant verification. A spoken amount is useful feedback, but two equal-amount orders still need separate identification.
Use the receipt-verification guide and same-amount matching guide. If the result is uncertain, investigate before requesting another payment. Retrying blindly can create duplicate payment problems.
Keep issuer and custody risks in view
Circle's terms describe restrictions and conditions that remain relevant even when a merchant controls its wallet. Stablecoin backing does not eliminate market-price, legal-access, smart-contract or operational risk.
A service-custodied account adds its own recovery and withdrawal arrangements; a merchant-controlled wallet adds key-control responsibilities. Compare custody models and plan what happens after receipt. Do not infer a service-level guarantee, insurance or a refund entitlement from a checkout's design.