Depending on the nature of your business, the concern you express can be a matter of choice (if you're not a regulated financial institution, for example) or a matter of obligation (if you are a regulated entity subject to obligatory compliance). In general, it is the payment processor whose plugin you're utilizing to capture bitcoins that has the responsibility and technical capabilities to minimize the risks that illegitimate money is being used to purchase your product or service. Of course, you also have the option to implement additional controls of your own. Deterrents for criminals include forcing people to submit proof of identification and address, and verifying them (a process popularly known as Know Your Customer or KYC), as well as running the incoming bitcoins through an analytics platform featuring a risk score, or some other form of taint analysis. Regulated entities, such as payment processors, are mandated to implement deterrent and detective tools and techniques that are risk-based, reasonable and effective. As a merchant you should partner with someone with high technical expertise and capabilities and who is committed to implementing the latest best practices available.