Fake OnlyFans agency DMs: how creators can verify who is really messaging them

Treat the first message as an introduction, not verification

A first message can tell you what the sender claims, but it cannot prove who controls the account. A polished profile, old posts, followers, testimonials or a professional logo can all be copied, purchased or inherited after an account compromise.

Keep the first exchange limited to basic questions. You do not need to send identification, private photos, account credentials, payout information or a signed agreement merely to learn who is contacting you and why.

Check the exact account, not only the display name

Read the username character by character. Look for substituted letters, extra punctuation, recently changed names and links that use a different brand or domain. A display name can be duplicated easily and should never be the main identity check.

Review the account history as context, not proof. Sudden changes in topic, language, posting style or contact details may deserve a direct explanation. A verified badge or large audience can reduce uncertainty in some situations, but neither replaces an independent check of the business and the person making the offer.

Verify through a second channel you find yourself

Do not use only the phone number, email address or website supplied inside the message. Find the agency's official website or established public contact independently, then ask whether the named person and social account are authorised to recruit creators.

The second channel should be meaningfully separate. Sending another message to a different account linked from the suspicious profile may still keep you inside the same impersonation network. Use contact information you located through a source you already trust or can verify independently.

Ask for the legal operator and a clear business explanation

A legitimate recruiter should be able to explain the agency's legal or responsible operator, business contact, services, target creator profile and the reason you were approached. A social-media brand without an accountable person or company is difficult to evaluate and harder to hold responsible later.

The answer does not need to arrive in one message, but repeated avoidance matters. Vague claims such as working with major creators, having a secret team or being unable to disclose any business information should not replace basic identification.

• Who is the person speaking with me?
• Which company or responsible operator stands behind the agency?
• Where can I verify the official contact details?
• What exact service is being proposed?
• Why does the agency believe I may fit?

Be cautious with borrowed creator identities

Some recruitment messages appear to come from another creator, a creator's assistant or a manager using a creator-branded account. That arrangement is not automatically dishonest, but the sender should identify their role clearly and obtain permission before using somebody else's identity or audience as proof.

Verify with the creator through a separate established channel before assuming she personally recommended the agency. Do not rely on screenshots of conversations, earnings or dashboards; images can be edited, taken out of context or shared without the creator's consent.

Do not open unexpected files or sign-in links

Unexpected links and attachments can lead to credential theft, malware or fake login pages. If a message says you must log in, verify an account, open a contract or view private proof, pause and access the relevant service through a bookmark or address you type yourself.

A real opportunity can survive a security check. Pressure to open a link immediately, share a one-time code or enter an email password is a reason to stop. Never provide an authentication code to somebody who contacted you, even when the message claims that the code is needed to confirm your identity or connect an account.

Separate portfolio review from account access

An agency may need enough information to assess fit, but a first review normally does not require control of your email, payout method or recovery settings. It also does not require unrestricted access to every private photo or document you own.

Share information in stages. Begin with professional context such as your platform stage, goals, public profiles, availability and boundaries. Move to private media or account access only when you know the recipient, understand the purpose and have agreed how the information will be stored, used and deleted.

Watch how the recruiter responds to normal questions

Verification is not only about the documents you receive. It is also about behaviour. A professional recruiter should expect creators to ask about identity, services, contracts, account control, payments, references and data handling.

Deflection, hostility, artificial urgency or attempts to make you feel ungrateful are useful information. A legitimate agency may decline to share confidential client details, but it should still be able to explain its own identity, process and terms without punishing you for asking.

Verify the opportunity before sending a contract or deposit

Read the written agreement only after confirming who sent it. Check that the contracting party matches the business you verified and that the payment instructions, email domain and signatory are consistent. A genuine-looking contract can still contain the wrong entity or fraudulent bank details.

Creators should be especially careful when a recruitment message requests an application fee, security deposit, software purchase, crypto transfer or payment to unlock an opportunity. Ask why the payment exists, who receives it and where that obligation appears in the written terms.

What to do when the message appears fraudulent

Stop the conversation before providing more information. Preserve screenshots, usernames, links, payment requests and timestamps. Report the account through the platform's reporting tools and alert the real agency or creator whose identity may have been copied.

If you entered a password or shared a one-time code, change the affected password from the official service, review active sessions, secure the recovery email and enable multi-factor authentication. If financial or identity information was exposed, contact the relevant provider promptly and follow the recovery guidance for your country.

A five-minute verification checklist

You do not need to conduct a full investigation before replying to every message. A short repeatable check catches many avoidable risks and gives a real recruiter a clear path to prove the introduction.

• Confirm the exact username and inspect recent account changes.
• Find an official contact independently and verify the recruiter there.
• Ask for the responsible operator and exact service in writing.
• Do not use unexpected sign-in links, attachments or one-time-code requests.
• Share professional context first and sensitive information only for a defined purpose.
• Match the contract, signatory and payment details to the verified business.
• Leave when normal verification questions lead to pressure or hostility.