OnlyFans agency not paying or locked you out: what to do now

Do these six things first

Start with the systems that can reset everything else. Secure your primary email, phone number and password manager before you focus on the creator platform itself. If another person still controls your recovery email or authentication method, changing one account password may not keep them out.

Work from a device you trust. Do not negotiate account access through unfamiliar links, screen-sharing software or files sent by the agency. Use the official website or app for every password reset and support request.

• Change the password for your primary email and review its recovery details.
• Check email forwarding rules, active sessions and unknown devices.
• Secure the phone number or authenticator used for two-factor authentication.
• Save contracts, messages, payout records and login alerts before anything disappears.
• Contact the platform through its official support route if access or payout settings changed.
• Move urgent communication with the agency into a short written channel you can preserve.

Identify which emergency you actually have

Creators often say they have been locked out when several different events may have happened. The agency may have changed a password, the platform may have restricted the account, a recovery email may have been replaced, a payout may be pending or a private contractual payment may be overdue. Each problem needs different evidence and a different recipient.

Write down the last moment when you had normal access, the last payout you received, the exact error or message you now see and every security change you know about. Avoid guessing who caused the problem until you have checked the platform notifications and account history available to you.

• Access emergency: you cannot sign in or recovery details were changed.
• Platform emergency: the account is restricted, reviewed or suspended.
• Payout emergency: platform earnings or withdrawal settings changed unexpectedly.
• Contract dispute: the agency owes money under your agreement but account access still works.
• Safety emergency: threats, blackmail, impersonation or pressure involve your private material or physical safety.

Secure the email account before the creator account

The email connected to a creator business can reset platform passwords, receive payout notices and approve security changes. Change its password to a unique one, sign out unknown sessions and confirm that the recovery email and phone belong to you. Review forwarding rules and filters because an intruder can quietly copy or hide security messages even after the visible password changes.

Change reused or similar passwords on other important accounts as well. Turn on two-factor authentication using an authenticator where available and store the recovery codes somewhere the agency cannot access. Never send a one-time code to somebody who says it is needed to reconnect your account.

Recover platform access through the official route

Use the platform's normal password-reset and account-recovery process first. If that does not work, contact official support from an email address you control. Include your creator username, the email previously connected to the account, the approximate time access changed and the specific recovery detail or payout setting you believe was altered.

Keep the first support message factual and compact. Support teams can verify account ownership and platform activity more easily when the request separates confirmed facts from suspicions about a manager. Do not ask an agency employee to submit the recovery request on your behalf when the dispute is about that employee's access.

• Use only the support link found on the official platform website or app.
• State which login, recovery or payout detail changed and when you noticed it.
• Provide requested identity verification only through the platform's official process.
• Ask support to preserve relevant account-access and payout records where possible.
• Save the case number, confirmation email and every reply.

Preserve evidence before you confront anyone

A dispute becomes harder to explain when messages, dashboards and documents are deleted in anger. Save the signed contract, amendments, invoices, revenue statements, payout confirmations, account alerts, staff names, access instructions and the messages where payment or ownership was discussed. Export or screenshot information with visible dates and enough surrounding context to understand what it shows.

Keep original files as well as screenshots. Record when each item was collected and store copies outside the affected email or cloud account. Do not edit a screenshot to make it cleaner. A complete, ordinary record is usually more useful than a dramatic collage with missing context.

• The final signed contract and every later amendment
• The agreed commission base, payment dates and permitted expenses
• Platform revenue, available balance and withdrawal history
• Bank or payment-provider records showing what was received
• Login alerts, recovery changes and access instructions
• Messages about delayed payment, termination or returning control
• A list of agency staff and contractors known to have access

Trace the money instead of arguing about one total

The phrase not paying can describe several points in the money flow. Separate revenue generated, revenue available for withdrawal, money withdrawn from the platform, money received by a bank or company and the amount owed to you after the agreed calculation. This shows whether the problem sits with the platform, the payout destination, the agency's accounting or the contract itself.

Compare the agency's calculation with the written agreement. Check whether commission applies before or after platform fees, refunds, chargebacks and approved costs. Ask for a reconciliation for a specific period rather than a general promise that accounting will be fixed later.

• Which period is disputed?
• What gross revenue was generated during that period?
• What fees, refunds or chargebacks are documented?
• Which account received each withdrawal?
• What commission formula does the contract require?
• What amount has already been paid and what remains disputed?

Send one clear written notice to the agency

After securing accounts and preserving evidence, send a short written notice to the agency's official contact and the person responsible for your account. Identify the exact access or payment problem, the period involved, what information or action you need and a reasonable date for a written response. Keep the tone professional even when the behaviour has not been professional.

Avoid a stream of emotional messages across several apps. One complete notice creates a better record and makes it harder for the recipient to claim that the request was unclear. Do not include new passwords, recovery codes or more identity documents in the notice.

• State your name, creator account and contract date.
• Describe the confirmed problem without exaggeration.
• List the records you want, such as a payout reconciliation or access handover.
• Ask that no settings, content or records be deleted while the issue is reviewed.
• Request a written response by a specific date.
• Reserve your rights without inventing legal claims or threats.

Separate platform support from the private contract dispute

Platform support may be able to help with account ownership, suspicious access, identity verification, security events or platform payout settings. It may not decide whether an agency breached a separate management agreement or calculate private commission owed under that agreement.

Send each organisation the problem it can actually solve. Give the platform the account and security facts. Give the agency a payment and handover request. Give a qualified adviser the contract and full evidence if the dispute continues. Mixing every accusation into one support ticket can slow down the part that needs immediate action.

Contact the bank or payment provider for unauthorised movement

If money moved without your authorisation, contact the relevant bank or payment provider using contact details from its official website or app. Explain the transaction you do not recognise and follow its fraud process promptly. Preserve the reference numbers and written outcome.

A contractual disagreement is not automatically an unauthorised transaction. Do not describe a payment you knowingly approved as fraud merely because the business relationship later deteriorated. Give the provider accurate facts and let it classify the issue under its own process.

Review the exit and account-control clauses carefully

Read the contract sections on termination, notice, post-termination commission, account access, intellectual property, confidentiality, data return and dispute resolution. Also check whether the agency signed through the same legal entity that received money or controlled the account. A social-media brand name may not be the contracting party.

Do not assume that a clause is enforceable or unenforceable based on a social-media comment. Contract rules and remedies vary by country and facts. Where significant money, long exclusivity, identity documents or threats are involved, obtain independent advice from a lawyer or appropriate local service rather than relying on the agency's interpretation of its own contract.

Treat threats, blackmail and private-content misuse as a safety issue

Threats to publish private material, impersonate you, contact family, expose your address or force you to continue working are not ordinary accounting pressure. Preserve the message, username, phone number, link and timestamp. Stop sharing new material and tell a trusted person what is happening so you are not managing the risk alone.

Report threats and non-consensual sharing through the relevant platform. Where there is extortion, identity theft, stalking, unauthorised access or a credible threat to physical safety, contact the appropriate police or specialist support service in your location. Do not arrange an in-person confrontation to recover a digital account.

What not to do during the first 24 hours

Urgency can push creators into actions that remove evidence or create a second problem. The safest immediate response is controlled, documented and reversible wherever possible.

• Do not delete the creator account, content library or message history in panic.
• Do not publish unverified accusations or private staff information as leverage.
• Do not send money, crypto or more content to regain an account.
• Do not share passwords or authentication codes with a new recovery helper you have not verified.
• Do not threaten hacking, retaliation or false reports.
• Do not sign a new settlement or release before understanding what rights it changes.
• Do not meet agency representatives alone when the relationship includes threats or coercion.

A practical 24-hour, 72-hour and seven-day plan

The exact timeline depends on whether the issue is access, money or safety, but a staged plan prevents important work from being buried under constant messaging.

• First 24 hours: secure email and recovery channels, preserve evidence, open official support cases and notify the agency in writing.
• By 72 hours: complete the revenue and payout reconciliation, review the contract, confirm who still has access and follow up on unresolved security changes.
• Within seven days: decide whether the relationship can be repaired, formally terminated or escalated for independent legal, financial or safety support.
• After recovery: replace shared credentials, document an access policy, review payout ownership and create regular backups of contracts and reports.

Common questions creators ask

Can an agency keep my account because the contract says it manages it? Management permission and ownership are not the same thing, but the answer depends on the contract, platform terms and local law. Recover control through the platform and get independent advice where the agency disputes ownership or termination.

Will the platform force the agency to pay me? Platform support can review platform activity and account controls, but a private commission dispute may need to be resolved through the contract's dispute process or local legal remedies.

Should I change every password immediately? Start with the primary email, recovery channels and accounts using the same or similar password. Then revoke sessions and access in a controlled order so you do not accidentally lose evidence or your own recovery path.

Should I warn other creators publicly? First secure yourself and document facts. A factual report to the platform, business operator or authorities is different from publishing allegations while key details are still uncertain.