Risks

Before you take a real payment, know what you are taking on. This lesson covers the stablecoin itself, what HMRC expects you to record, why refunds are your job, how to spot fake demand, and what happens when big companies move in.

An x402 payment arrives in seconds and cannot be taken back. That is useful, and it also means everything around the payment is your job: keeping the money safe, recording it for tax, handling refunds, and knowing who is paying you.

This lesson is general information, not legal or tax advice. For your own situation, ask an accountant or an adviser who knows cryptoassets.

The coin you are paid in

When you set a price in dollars, the official x402 packages and Cloudflare’s Gateway take payment in USDC, a stablecoin. Circle, whose regulated affiliates issue it, says USDC can be redeemed one for one for US dollars and is fully backed by cash and cash-equivalent assets, most of them in a government money market fund. It publishes a monthly report on the reserves, checked by a Big Four accounting firm.

The coin you are paid in

Stablecoins can still wobble. In March 2023 Circle could not withdraw $3.3 billion of USDC reserves, about 8% of the total, from Silicon Valley Bank when the bank failed. Over that weekend USDC traded as low as 86 cents. It recovered fully on Monday 13 March, when Circle began processing redemptions again.

The coin you are paid in

Two more things to plan for:

• It is dollars. If your costs are in pounds, your income moves with the exchange rate.
• The wallet is yours alone. Payments go straight to your address. Lose the recovery phrase and the money is gone, with no bank to call. If someone else gets it, they can take everything. Keep the wallet that receives payments separate from any savings, and keep its recovery phrase offline.

Tax, for UK sellers

Start with HMRC’s guidance pages on cryptoassets, linked in the sources. The points that matter most for a seller:

• Keep records of every token you receive, including the type, the date, how many you received and their value in pounds sterling.
• Convert to sterling at the time of each transaction, using an appropriate rate, and keep a record of how you worked out the value.

Tax, for UK sellers

• If the payments are part of a trade, they go into your taxable trading profits.
• When you later sell or swap the USDC, Capital Gains Tax may apply to any gain since you received it, but not to the amount you already paid Income Tax on.

Tax, for UK sellers

• A small allowance exists. HMRC allows up to £1,000 (14 Oct) source a tax year of trading and miscellaneous income, and crypto income counts towards it.

At x402 prices you may receive hundreds of tiny payments a day, so record them automatically. Every settled payment returns a transaction hash in the PAYMENT-RESPONSE header (lesson 5), and your server can log the hash, the time and the amount for each one. Outside the UK, the rules are different, so check your own tax authority.

Refunds and disputes

Coinbase’s documentation is plain about it: payments made with the exact or upto schemes cannot be reversed once settled, so there are no chargebacks. To refund someone, you send a transfer back to the payer’s address from the settlement record.

That cuts both ways. Nobody can claw money back from you. But a buyer with a complaint has nobody to go to but you, so decide your refund rule before you sell, and say what it is.

Refunds and disputes

Two things help:

• The official Express middleware settles a payment only after your code has answered. If your code returns an error status, such as 500, the payment is cancelled and the buyer is not charged. We checked this in the 2.28.0 source.
• A newer scheme, auth-capture, holds the money in escrow and releases or refunds it later. It is for sales where something could go wrong after payment. It is new, so check that your facilitator supports it.

Who is paying you

Big numbers on x402 are often not customers. Examples from the research, all on Base:

• Cluster Protocol had the biggest 30-day total of any registered app on Base, $54,756 from 722 buyers. Its public token disclosure listed x402 payers as eligible for a token airdrop, 27 of 30 sampled payers had never made a transaction before, and payments stopped on 2026-10-02.

Who is paying you

• AX1 took 412,049 payments of exactly $0.02. AX1’s own post says the payment is the entry fee to a weekly rewards contest.
• KORUS’s 100 largest payments were all exactly 2.997948 USDC, from 100 different wallets. Every payer the researchers sampled had never made a transaction before.
• X Pay charged $10 and $20 for a text-analysis call. A $10 sentiment check is not a market price, and the researchers read it as volume paid for by the seller.

Who is paying you

Some schemes pay for volume. Meridian, a facilitator that pays cashback in its own token, carried a closed loop of wallets that made up 36% of Base x402 dollars in six months.

So when someone offers to “bring volume”, or buyers appear overnight, check three things: how many different wallets paid, whether the same ones come back week after week, and whether those wallets do anything else.

Who is paying you

Your facilitator is a counterparty too. If it shuts down, your endpoint stops getting paid, and the research found several that did. Coinbase’s facilitator screens every payment against sanctions lists before it settles. If you use another one, ask whether it does the same.

Big companies moving in

One commenter warned that “whatever you offer, a big company will snatch it away straight away and claim all that traffic.” The big companies are certainly here. Cloudflare runs the Monetization Gateway, Coinbase runs the main facilitator and its own catalogue, AWS made agent payments generally available in August 2026, and Stripe accepts x402 while steering merchants to its own protocol, MPP.

Big companies moving in

Most of what they build is the payment plumbing, not the thing being sold. A big company can undercut generic data or a common tool: in lesson 1, one seller offered crypto news at $0.001 against another’s $0.03. It is much harder to copy readings from your own gauge, your local knowledge or your own records. The defence is the uniqueness test from lesson 1.

Big companies moving in

The plumbing itself may change. Solana carried 76% of x402 transactions in the four weeks to 2026-09-22 on one data provider’s figures. Some x402 gateways now also sell card-funded API keys or prepaid balances. Stripe’s MPP competes with x402 directly. Sell what you make in a way that does not depend on one payment method: offer it by API key or subscription as well, so that a change in the rails does not end the business.