Most Bitcoin security guides focus on sending: double-check the address, confirm the fee, broadcast the transaction. Receiving gets far less attention, and that gap creates risk. When Bitcoin arrives from a sender you don't recognise, or one you've only just met online, a handful of specific threats come into play. Knowing what they are and how to respond is the practical starting point.
Why receiving Bitcoin still carries risk
Bitcoin transactions are irreversible, which cuts both ways. If someone sends you funds as part of a scam or social engineering scheme, there's no bank to call. The money may look real in your wallet and still expose you to serious problems. Two categories of risk are worth understanding before you accept any payment from an unfamiliar source.
The first is tainted Bitcoin. Coins that have passed through darknet markets, ransomware payments, or sanctioned entities can be flagged by blockchain analytics firms. Regulated exchanges in Australia, including Digital Currency Exchange Providers registered with AUSTRAC, run incoming transactions against these databases. If tainted coins land in your exchange wallet, the platform may freeze your account pending a review. You don't have to have done anything wrong. The coins themselves carry the history.
The second is social engineering. A common pattern involves a stranger sending a small amount of Bitcoin and then claiming they sent it to the wrong address and asking for a refund. The original payment may have been funded by a stolen card or a hacked account. You send your own clean Bitcoin back to "correct the mistake" and the original deposit gets clawed back. You're left out of pocket. This is not hypothetical. It's a routine variant of the overpayment scams that run across every payment platform.
What to check before you accept the payment
You can't always refuse inbound Bitcoin, and in many cases you shouldn't need to. But you can take a few steps before treating the funds as yours to spend.
Wait for confirmations. A transaction with zero confirmations is unconfirmed. It's in the mempool and can, in some circumstances, be reversed or replaced. For small amounts from known contacts, one confirmation is usually fine. For payments from strangers, wait for at least three. For large sums, six confirmations is the conventional standard. Understanding what a Bitcoin confirmation actually means helps you decide how long to wait based on the amount involved.
Ask where the Bitcoin is coming from. If someone is paying you for a service, a product, or a loan repayment, ask them to confirm the source. Not because you'll verify it independently in every case, but because a fraudster will often stumble or give an inconsistent answer. A legitimate sender has nothing to hide.
Don't recycle the address. If you've shared a receiving address publicly, or used it for multiple payments, an incoming transaction from an unknown party could be a Bitcoin address poisoning attack. The attacker sends a tiny amount from an address that looks similar to yours or to a known contact, hoping you'll copy the wrong address the next time you send. Use a fresh address for every payment where possible, and check your transaction history carefully after any unsolicited inbound payment.
Don't spend the coins immediately. If tainted Bitcoin lands in your wallet, spending it onward spreads the taint to your other addresses and can complicate future exchange transactions. Keep the received coins in a separate UTXO until you're satisfied with the source.
Dusting attacks: when the amount is suspiciously small
If you receive a tiny, unsolicited amount of Bitcoin that you weren't expecting, treat it with suspicion. Dusting attacks involve sending microscopic amounts to many addresses in order to track wallet activity. When the recipient spends those "dust" coins alongside their own, the transaction graph can link previously separate addresses and reduce anonymity. The practical response is simple: don't spend the dust. Leave it in your wallet, label it if your wallet software allows, and let it sit. It costs you nothing and protects your privacy.
Using a watch-only wallet as a receiving buffer
One underused approach for people who regularly receive Bitcoin from new clients or counterparties is to maintain a dedicated receiving wallet that's separate from your main holdings. Funds arrive there first. You review them, wait for confirmations, and only move them to your main wallet once you're satisfied. A watch-only setup lets someone monitor incoming transactions without exposing the private keys of their main wallet to any device connected to the receiving process. This is especially useful if you're accepting Bitcoin as payment for goods or services on an ongoing basis.
What to do if something feels wrong
If a payment arrives that you weren't expecting, the amount is unusual, or the sender is pressing you to act quickly, slow down. Urgency is a manipulation tactic. Legitimate payments don't expire in the next ten minutes. You can:
- Decline to acknowledge receipt until you've had time to verify the context.
- Contact the sender through a channel you control, not one they provided to you.
- Check the sending address against public blockchain explorers to see its transaction history.
- Speak to your exchange's support team if the funds arrive at a custodial address and something looks off.
McLeod Pacific Investments offers Bitcoin trading services and education from the Gold Coast, and helps clients understand exactly these kinds of real-world scenarios before they become problems. If you're new to Bitcoin and want to understand how to share your payment details safely, that's a sensible next step alongside understanding how inbound payments work.
The short version
Receiving Bitcoin from an unknown sender is manageable if you treat the first few confirmations as a review window rather than a done deal. Wait for confirmations. Keep received coins separate until the source is clear. Don't send anything back under pressure. And if the transaction is unusually small and unsolicited, leave it alone. Those four habits cover the vast majority of inbound payment risks that Bitcoin holders actually face.