Last checked 31 October 2026. Attack methods change. The checks below work because they do not depend on spotting a particular trick. If anything here conflicts with the linked source, the source wins.
A bitcoin payment cannot be reversed once it confirms. Most losses in company payments do not come from breaking cryptography; they come from paying the wrong address. That can happen because malware changed it, because someone planted a look-alike address in the wallet's history, or because a convincing email changed the supplier's details. The defence is a routine that checks the address in places an attacker does not control.
- Get the addressFrom a source you already trust
- Confirm itBy a separate channel
- Check on deviceEvery character, on the signer screen
- TestSmall amount first
- SendSecond approver signs
1. Check the address on the signing device
A hardware signing device shows the destination and amount on its own screen before it signs. That screen is the one place malware on the computer cannot change. Read the whole address there, not just the first and last few characters. In a 2 of 3 multisig, each signer sees the same transaction, so two people check it independently.
For incoming funds, the same idea applies in reverse: show your own receiving address on the signing devices to confirm it belongs to your wallet before you give it to anyone.
Source: Bitcoin developer documentation: Wallets guide: signing-only wallets and hardware wallets, Bitcoin BIPs: BIP 174: Partially Signed Bitcoin Transaction format (PSBT).
2. Address poisoning
The FBI has warned of scams that plant look-alike addresses in a wallet's transaction history. The fake address matches the start and end of an address the victim uses, so it looks right when a wallet shortens it. The scammer hopes the victim copies it from the history next time. The FBI warning describes tokens on other networks, but the same trick works on any address shown in a history list.
- Never copy a destination from your transaction history.
- Keep a saved, labelled address book, built from addresses confirmed with the recipient.
- Compare every character, not only the ends.
3. Clipboard malware
Clipboard malware watches for a copied bitcoin address and swaps in one controlled by the attacker. Microsoft described one such Windows malware family in June 2026. It checked the clipboard about every half second and replaced bitcoin addresses with look-alikes chosen to match some of the original's characters, and it also looked for recovery phrases and private keys. It spread through infected USB drives.
The on-device check in step 1 defeats this, because the signing device shows the address that will actually be paid.
4. Invoice and supplier fraud
Business email compromise is not specific to bitcoin. The FBI reported 305,033 incidents and more than $55 billion in exposed losses worldwide between October 2013 and December 2023. In the UK, the NCSC and Report Fraud describe the same pattern: a criminal poses as a supplier or senior colleague and asks for payment details to change.
Source: FBI IC3: PSA240911: Business email compromise, the $55 billion scam (11 September 2024), NCSC: Business payment fraud: respond and recover, Report Fraud (City of London Police): Mandate fraud, also known as payment diversion fraud.
- Treat any request to change a payment address as suspicious until confirmed.
- Confirm a new or changed address by calling a number you already hold, not one in the email.
- Be wary of urgency, secrecy, or a request from a senior person to skip the usual steps.
5. Send a test amount first
For a new address or a large payment, send a small amount, ask the recipient to confirm it arrived, then send the rest to the same address. It costs one extra network fee and proves the whole path. Our page on fees and UTXOs shows how to estimate that fee.
6. Approvals
In a 2 of 3 multisig, no single person can send funds. Write the approval rule down: who may request a payment, who checks the address, which two keyholders sign, and the amount above which the board must approve. Keep a record of each approval with the transaction ID.
Source: Bitcoin BIPs: BIP 11: M of N standard transactions (multisig).
Before every payment
- Address from the address book or confirmed by phone on a known number.
- Not copied from transaction history.
- Every character checked on the signing device screen by each signer.
- Test amount sent and confirmed for a new address.
- Approval recorded with the transaction ID.
If something goes wrong
Report it straight away. In the UK, report it to Report Fraud, the police reporting service that replaced Action Fraud in December 2025 (in Scotland, report to Police Scotland on 101), and tell your bank if fiat payments are involved. In the US, report to the FBI's Internet Crime Complaint Center. Be wary of anyone who then offers to recover the funds for a fee; see recovery scams.
Source: Report Fraud (City of London Police): Mandate fraud, also known as payment diversion fraud, Report Fraud (City of London Police): Report Fraud: the place to report cyber crime and fraud (in Scotland, report via 101), GOV.UK: Report Fraud: new service from City of London Police, replacing Action Fraud from 4 December 2025, FBI IC3: Cryptocurrency fraud: how to report it.
Read next
- Scams aimed at company treasuries, what they look like.
- How a transaction works, from signing to confirmation.
- Security lessons, real incidents and what they teach.
Sources
Primary sources only. Each link was checked on 31 October 2026. Rules change, so confirm the current version with your adviser.
- Bitcoin developer documentationWallets guide: signing-only wallets and hardware wallets
- Bitcoin BIPsBIP 174: Partially Signed Bitcoin Transaction format (PSBT)
- FBI DenverFBI warns of cryptocurrency token impersonation scam (look-alike addresses in transaction history)
- Microsoft Security BlogCrypto Clipper uses Tor and worm-like propagation, 17 June 2026 (clipboard address replacement)
- FBI IC3PSA240911: Business email compromise, the $55 billion scam (11 September 2024)
- NCSCBusiness payment fraud: respond and recover
- Report Fraud (City of London Police)Mandate fraud, also known as payment diversion fraud
- Bitcoin BIPsBIP 11: M of N standard transactions (multisig)
- Report Fraud (City of London Police)Report Fraud: the place to report cyber crime and fraud (in Scotland, report via 101)
- GOV.UKReport Fraud: new service from City of London Police, replacing Action Fraud from 4 December 2025
- FBI IC3Cryptocurrency fraud: how to report it
One email. The whole library.
Policy checklist, board paper, recovery drill record, document pack and the rest, in one send. Then one short Thursday lesson for small companies in the UK and the US.
Free. One email with the whole template library, then one short lesson each Thursday. Unsubscribe at any time. See our privacy notice.
This is general information and education only. It is not financial, investment, tax, accounting, legal or regulatory advice, and it is not a recommendation to buy, sell or hold bitcoin or any other asset. It does not take account of your circumstances or those of your company. You must obtain your own official professional advice to confirm this information is correct before acting on it.
Rules change. This information is correct to our understanding at the last-reviewed date, but it may be incomplete or out of date, and official sources take precedence. Bitcoin is volatile. A company that buys it could lose some or all of the money it puts in.
Using this site does not create an adviser or client relationship. IoT Financial is not authorised or regulated by the Financial Conduct Authority (FCA) and is not registered with the US Securities and Exchange Commission (SEC) as an investment adviser. Read the full disclaimer.