Detect fake brand and ambassador offers through independent sender verification, contract, payment, link and attachment security checks.
Assess a suspicious brand collaboration by verifying it through a channel you find independently—not a link, number or contact supplied in the message. Inspect the full sender domain, and treat urgency, advance fees, gift card or crypto demands, password or verification-code requests, unknown downloads and contract-free high-income promises as red flags. Until verification is complete, do not click, open an attachment, pay or share data.
Scammers do not impersonate only small or unknown businesses. They can copy the logo, employee photograph, campaign language and lookalike domain of a familiar company. They may also message from a real social account that has been compromised. A verified badge, polished design or personalised greeting is therefore not proof by itself.
The US Federal Trade Commission specifically warns creators about fake “brand ambassador manager” offers that use a recognised brand, free products and high payment to obtain personal or banking information. Its central advice is to research the offer and contact the company through information you know independently to be legitimate.
Common warning signs
| Sign | Why it is risky | Safer response |
|---|---|---|
| Display name is a brand, but the full address uses free or lookalike email | Display names are easy to copy | Inspect every character and verify through the brand's official site |
| “Reply today or lose the deal” pressure | Prevents research | Request time and stop until independent verification is complete |
| You must pay shipping, insurance, membership or activation first | A creator should not normally pay to receive a job | Pay nothing and ask the company through its official channel |
| Gift card, crypto, wire transfer or returning part of a cheque | Common in irreversible-payment and fake-cheque schemes | End the conversation and preserve evidence |
| Password, backup code, two-factor code or login approval requested | Account takeover attempt | Never share an authentication secret with a partner |
| Password-protected archive, executable, macro document or unknown app | Can deliver malware or steal a session | Do not open it; request a verified page or standard PDF |
| Extraordinary income but no defined work | Excitement replaces business detail | Ask for deliverables, rights, revisions and payment schedule in writing |
| Immediate move to an off-platform chat | Can evade records and controls | Complete verification through corporate email and an official channel |
One warning sign does not always prove fraud. A very small company might use free email, for example. Several signs should raise your risk assessment, and an offer that cannot be independently verified should be declined. Fear of missing an opportunity is less important than protecting your account and money.
1. Inspect the full sender, not the display name
“GlobalBrand Partnerships” on screen does not mean GlobalBrand sent the email. Read the complete address after the @ symbol. Look for substituted letters, an extra hyphen, an unusual extension or a long address designed to place the real brand name before someone else's domain. In brand.example-security.com, the controlling domain is example-security.com; “brand” at the beginning proves nothing.
Google recommends checking whether the sender name and address match, hovering over links to compare displayed and destination URLs, and respecting suspicious-message warnings. A corporate domain still is not final proof because a real mailbox can be compromised. Type the known brand site into the browser yourself and use its published contact route.
2. Verify through an independent brand channel
Do not use the phone number, link or supposed manager page in the approach. Search advertisements and cloned results can also mislead, so prefer a known official site or verified company profile. A short message is enough:
“I received an offer for [campaign] from [name/address]. I am verifying the person and campaign independently before opening any links.”
If the company says it did not send the offer, stop. If no one replies, the offer remains unverified. When an agency is involved, confirm the agency relationship with the brand or verify the employee through the agency's independently found corporate channel.
3. Ask for real work details
A legitimate offer is more than praise and a payment figure. It should be possible to define:
- Campaign objective, brand and product,
- Number and format of deliverables,
- Publishing channel and timetable,
- Revision limit and approval process,
- Organic reuse, paid-media rights, duration and territory,
- Category exclusivity,
- Fee, invoice or payment record, currency and schedule,
- Advertising disclosure and responsible contact,
- Cancellation, delay and dispute terms.
These details do not automatically prove legitimacy, but a request for identity or bank data before any scope exists is high risk. Use our brand collaboration brief guide for scope and our safe payment and tax guide for the payment flow.
4. Treat links and attachments as a separate security decision
A file called “brief,” “media kit viewer,” “video codec,” “brand assets” or “contract” can be malicious even when the message looks convincing. Do not run executables, install unknown browser extensions, enable document macros or open a password-protected archive from an unverified sender. Close any page that asks you to log into social media merely to read a contract.
Ask for a safer format: a page on the verified corporate domain, a standard PDF or a recognised contract system. A real cloud-document page can still contain a malicious external link. Do not solve uncertainty by asking a colleague to click; report the URL as text or a screenshot to whoever handles security.
5. Reject payment arrangements that reverse the job
In a collaboration, the creator supplies agreed work and receives payment under a contract. Stop if the supposed brand asks you first to pay for “shipping release,” “ambassador membership,” a discounted product, tax activation or insurance. A fake-cheque scheme may send too much and ask you to transfer the difference; the bank can show provisional funds before the cheque is later rejected.
The FTC states that an honest prospective employer will not send a cheque and instruct you to return part of it or buy gift cards. Genuine tax and invoice obligations are not completed by sending activation money to a personal wallet.
6. Never make account access a collaboration condition
A brand can request aggregated Insights; it does not need your password. Use a dated screenshot, an official partnership tool or properly scoped access. Never share a password, SMS code, authenticator code, backup code, recovery link or device approval.
Meta says Instagram does not send in-app direct messages about account problems and lets users review official Instagram emails from the last 14 days in settings. If a “brand campaign” says you must fix a copyright issue, open platform settings yourself rather than following its link.
7. Use a simple risk score consistently
This score does not legally prove fraud; it helps a creator or team make repeatable decisions.
| Check | 0 points | 1 point | 3 points |
|---|---|---|---|
| Sender | Verified through official route | Agency or domain not yet verified | Lookalike domain or identity conflict |
| Pressure | Reasonable review time | Unnecessary urgency | Threat or immediate-action condition |
| Money | Contracted payment to you | Unclear schedule | Advance fee, gift card, crypto or return transfer |
| Access | No password request | Excessive data request | Password, 2FA code or login link |
| File | Verified standard document | Unknown cloud link | Executable, encrypted file or extension |
- 0–2: Continue only after scope and contract review.
- 3–5: Pause and verify the brand independently.
- 6+ or any critical 3: Do not click, pay or share data; reject and report.
A low score is not a guarantee, particularly when the brand itself has not confirmed the approach.
Measure your security workflow
| Monthly measure | Calculation | Purpose |
|---|---|---|
| Independent verification rate | Offers confirmed independently / offers progressed | Reduce rushed decisions |
| Pre-loss stop rate | Suspicious offers stopped before data/payment / suspicious offers | Test whether controls act in time |
| Incident reporting time | First suspicion to platform/authority report | Improve response workflow |
| Two-factor coverage | Critical accounts with 2FA / all critical accounts | Reduce account-takeover impact |
| Evidence completeness | Incidents retaining header, sender, URL, date and screenshot / all incidents | Improve reporting quality |
Each month, add anonymised examples of domains, file types and pressure language to a team warning list. Do not spread personal data or share malicious URLs as clickable links.
Ten-point offer checklist
- I checked the full email address and domain, not only the display name.
- I reached the brand without using the message link.
- An independent corporate channel confirmed the person and campaign.
- Deliverables, rights, revisions and payment are written.
- There is no advance fee, gift card, crypto or return transfer.
- No password, 2FA code, backup code or device approval is shared.
- No unknown attachment, extension or login page is opened.
- The contracting entity and payer are consistent.
- Advertising disclosure responsibility appears in the brief.
- Correspondence, headers, contract and verification records are retained.
What if you already clicked?
Close the page, do not run a downloaded file and review active sessions in account security even if you entered no password. If you supplied a password or code, change the password from a trusted device, terminate other sessions, restore two-factor authentication and update any other account using the same password. Secure email first because it is often the recovery key for social accounts.
If you supplied money or banking information, contact your bank promptly through its official number. Preserve screenshots, full sender address, URL, date/time and payment information before deleting anything; report the account to the platform. For a concrete loss in Türkiye, follow current application routes published by the Turkish National Police Cybercrime Department and competent authorities. These general steps are not a substitute for incident-specific legal or forensic advice.
Legal and ethical note
Publicly accusing a person or company before verification can harm an innocent employee or the owner of a compromised account. Preserve evidence, inform the brand independently and report through the platform or competent authority. Do not publish identification, bank details or personal data from a contract. If the offer is legitimate, the commercial relationship still needs transparent disclosure; our August 2026 influencer ad-label guide explains the current publication check.
Frequently asked questions
Does a corporate email prove an offer is genuine?
No. A lookalike domain can appear corporate, and a real mailbox can be compromised. Confirm the offer separately through the company's official channel.
The brand wants me to pay shipping first. Is that normal?
Treat it as a serious warning sign. Never send money to a personal account, gift card or crypto address, and pay no “activation” fee before independent verification.
Is it safe to send a media kit?
You can share a public business email and aggregated performance data. Do not send a home address, identity document, password, 2FA code or unnecessary bank information at the first stage.
Sources
- FTC Consumer Advice — Influencers: Spot a Job Scam
- Instagram Help Center — Avoid Scams on Instagram
- Google Help — Avoid and Report Phishing Emails
- Turkish National Police — Cybercrime Frequently Asked Questions
Create your creator account and follow verifiable brand campaigns through a safer workflow.