How can a customer prove me that he owns a certain address and made a certain transaction?

Question

In my e-shops there may be situations when a customer sent me coins but forgot to add secret order pin code in the memo. In such cases he'd contact me via email and claim that a certain transaction was the one he sent, and then I'd verify it for myself and mark his order as paid.

However, if there were very few transactions, 1-2 per day, it might work. But if there were dozens, a customer might try to cheat me - "that transaction was sent by me, not by that customer who claims otherwise, he didn't send it, I did".

How would I ask a customer to verify his ownership of a certain address then, in order to verify that a transaction was, in fact, made by him? And without too much hussle such as calling, screen-sharing and similar things.

I don't consider using third-party paid services. A public blockchain explorer wouldn't fall in this category.

Answer 1

You can ask the customer to sign a message with their address.

https://support.mycrypto.com/how-to/getting-started/how-to-sign-and-verify-messages-on-ethereum describes how to sign and verify messages.

Here is an example of a signed message by address 0x2a3052...

{
  "address": "0x2a3052ef570a031400BffD61438b2D19e0E8abef",
  "msg": "This is proof that I, user A, have access to this address.",
  "sig": "0x4e1ce8ea60bc6dfd4068a35462612495850cb645a1c9f475eb969bff21d0b0fb414112aaf13f01dd18a3527cb648cdd51b618ae49d4999112c33f86b7b26e9731b",
  "version": "2"
}

This signed message can be verified by anyone using a tool such as https://app.mycrypto.com/verify-message

The signed message can only be produced by the private key corresponding to the address, otherwise the signature (sig) will be invalid and the verification will not succeed.