Mailbox compromise
An attacker joins a real thread, edits payment instructions, creates forwarding rules, or intercepts receipts.
Core guide
Security for altcoin email payments.
Defend the communication path, verify changed instructions, decode the actual wallet action, and preserve enough evidence to investigate an exception.
Threat surface
The blockchain can work exactly as designed while the payment still goes wrong.
Attackers target the email, domain, invoice template, clipboard, wallet prompt, and approval process because changing one destination can be enough.
Look-alike domain
A convincing page displays familiar invoice text while injecting a different wallet request.
Destination substitution
Clipboard malware, address poisoning, or a changed template replaces the address while preserving context.
Token confusion
A copied symbol or logo hides the wrong contract, bridged version, or unsupported network.
Opaque signing
A page labeled “pay” requests an approval, signature, or contract call the user cannot interpret.
Urgency and exception
An executive, vendor, or customer pressures staff to skip normal verification and approval controls.
Defense in depth
Make one compromised channel insufficient.
Known sender path
Use protected mail accounts, controlled templates, approved domains, and monitored configuration changes.
Independent change check
Confirm new destinations through a phone number, workspace, or approver established before the email.
Wallet review
Compare destination, token, network, amount, function, and fee on the signing surface.
Evidence and response
Keep headers, invoice versions, approvals, transaction IDs, receipts, and a plan to pause payment activity.
Never request
Secrets do not belong in an invoice workflow.
- Seed phrase or private key
- Wallet backup file or recovery code
- One-time authentication code
- Remote access to the payer’s device
- Blind signature or unexplained unlimited approval
Red flag
“We changed wallets—pay immediately.”
A changed destination is a new risk event, even when the email comes from a familiar thread. Pause, use the established secondary channel, require the normal approver, and consider a test transfer after verification.
Do not verify through the suspicious message. Use contact details that were already known or independently published.
Complete security checklist
The long-form guide covers sender authentication, links, wallet review, test transfers, limits, monitoring, and incident response.
Read the security guide →Verify before paying
Use a repeatable routine for the recipient, exact network, token contract, complete destination, amount, and fee asset.
Open the verification guide →