Brand Deal Scams: How Creators Spot Them

A brand deal scam looks like a real brief until it asks for a joining fee, a deposit, a login or code, a download, or an overpayment refund. Judge the ask, not the logo or how well the sender knows your videos.

Most popular advice gets this backwards. You're told to look for bad spelling, a Gmail address, or a small follower count, as if polish proves a sender is real. It doesn't. Scammers copy branding in minutes, and plenty of real founders write rough emails from personal accounts.

What Makes a Brand Deal Scam

A brand deal scam copies a real brand's logo, tone or campaign style, then asks you for money, a login, a one-time code, a file download, or a refund of an overpayment. That's the definition worth using. Everything before that ask, the personalised opening, the fee that sounds plausible, the tidy brief, can be built from public information.

The look of a message decides nothing. A Gmail address can be genuine. An agency you've never heard of can be genuine. A brand account with few followers can be genuine, especially in Singapore, Kuala Lumpur, Sydney or Hong Kong where a small label may run outreach from a founder's own account. Equally, a polished branded email can be faked from a domain registered yesterday.

The five asks that settle it

Learn to spot the ask and you can sort most messages in under a minute.

• Pay to join: a fee to enter an ambassador programme or access campaigns
• Pay first: a deposit, a shipping charge, or a demand to buy the product before the collab starts
• Hand over access: a password, a verification code, or a sign in with Google, Meta or TikTok on a page the sender supplied
• Open the file: a brief, contract or campaign tool from a domain that almost matches the brand
• Send money back: bank an overpayment, then return the surplus by gift card, crypto, payment app or wire

The plain rule: if you have to pay, log in, download or forward money before there's a signed agreement from a verified entity, stop. No real collab needs any of those steps at first contact.

Two messages, opposite verdicts

Say a small skincare founder writes from Gmail with no logo and one typo. She names two deliverables, pastes the brief as text, offers product plus a fee, and asks for your rate and invoice details after you've both signed. The presentation is weak. The ask is normal. That message deserves a careful reply.

Now say a beautifully branded email cites your last three videos by title. It negotiates inside a believable rate band, links to a campaign page with charts and an earnings estimate, then asks you to sign in with Google to verify your channel. The presentation is strong. The ask is the theft. That message fails, and it fails completely.

This is general information, not legal or tax advice. It's also narrower than general deal quality. A low fee, vague usage or unlimited revisions from a real brand is a commercial problem, not fraud, and the guide to brand deal red flags covers those poor but genuine offers. If you're weighing whether a verified offer is worth taking, the check on whether a brand deal offer is fair is the right next read.

Before you reply, quote a rate or open anything, match your message against the table in the next section. If it lands on a row, you don't need more evidence. One bad ask outweighs ten convincing details.

Five Brand Deal Scams and the Ask Behind Them

A convincing fake can copy a brand's logo, quote plausible rates and refer to your own videos. Those details make a message look credible. They do not make its request safe.

Pay-to-join ambassador schemes turn the creator into the customer. The fee may be described as covering onboarding, a media kit, a starter pack or access to campaigns. You pay, then the promised work fails to arrive or amounts to discount codes.

Deposits and buy-first demands can look like ordinary collaboration costs. You may be asked to pay for stock, shipping or a refundable deposit, with the refund tied to posting, sales or recruiting someone else. A gift is a product sent without requiring you to buy it. If money must leave your account first, treat the offer as suspect.

Login and code requests are requests for account access, whatever the sender calls them. A brand can send a brief without your password, one-time code or channel-management permission. A tidy brief and a familiar logo prove nothing if the next step is to sign in or install software.

Lookalike domains can make an impersonation convincing. A swapped letter, extra word or different ending may be the only visible difference between the sender's address and the brand's real domain. Filing the offer in a deal workspace records its details; it does not authenticate the brand.

Overpayment refunds rely on you returning money before the original payment is secure. The sender asks you to send the excess back quickly, often through a hard-to-reverse payment method. If the incoming payment later reverses, the money you sent may be gone.

A high fee is context, not proof

The U.S. Federal Trade Commission's warning about bogus brand ambassador managers describes impersonators offering free products and unusually high payments, then asking for personal or bank-account information to issue payment.

Fees generally rise with audience size and with the length and scope of paid-ad usage. Compare the offer with what creators of a similar size receive for similar work and usage. A figure far above that range deserves closer checking, but a high offer alone does not prove fraud. Focus on the ask: a fee to access the deal, a deposit, a login, a download or a request to return money.

Keep the original message. Before sharing tax or bank details, confirm the sender and deal through a contact channel you found independently, not one supplied in the pitch.

How to Check a Brand Before You Reply

Run these checks on one message, in order, before you negotiate. They take minutes and they don't require replying to the sender at all.

1. Read the full sender domain. Compare it with the domain on the brand's own website, character by character, including the ending after the last dot. Display names and logos can say anything. The domain is the part that's hard to fake.
2. Look up the named person. Check whether they list that brand on LinkedIn and whether the role fits. Treat a profile as supporting evidence only, since profiles can be copied too.
3. Search the brand name plus scam. Search the exact sender domain as well. Other creators in your niche often post the domain within days of a campaign starting.
4. Open nothing. Don't open attachments, macros or zip files, don't follow links, and don't enter a password or verification code. A real brand can paste the brief as plain text or send it through a platform you already use.
5. Write to a contact you found yourself. Use an address from the brand's website, shop listing or press page. Never use the phone number, email or link inside the pitch, because those route back to the sender.
6. Inspect any portal before touching it. Check the destination domain. Refuse any page that asks for a Google, YouTube or Meta login, and read the permissions list if one appears.

Step six matters more than it used to. Reporting by WeLiveSecurity on a brand deal scam targeting YouTube creators describes a campaign impersonating Hollyland with personalised emails referencing a creator's own videos, rate negotiations, professional-looking campaign pages, brand logos, performance metrics, income calculators, and a final request to sign in with Google to verify the channel. It also notes that a site claiming only to verify a channel shouldn't need management access. Personalised lines, charts and a plausible rate discussion are trust-building, not evidence.

The email to copy

Hello, I received a collaboration offer using your brand name from [full email or handle]. I haven't opened any attachment or entered any login. Please confirm whether [named person] is authorised to contract this, and send any brief from your corporate domain or as plain text.

Send that to the independently found contact, not as a reply. Keep the original message, headers and URL in case the brand or platform wants them. If the independent contact doesn't recognise the offer, stop there. Don't negotiate a rate with the first sender while you wait, because a rate discussion is exactly what keeps you engaged.

If the brand confirms the person and resends the brief from its real domain, you're back to normal deal admin. At that point it helps to agree usage rights, revisions and payment terms in writing, along the lines of a brand deal contract template, before any filming starts.

Brief Files and Logins That Take the Account

Some fake sponsorships aren't after a deposit at all. They're built to steal the channel, because a channel with an audience can be resold, used to run other scams, or used to message your collaborators as you.

Google's threat-analysis work tracked campaigns against YouTube creators since 2019, and reporting in TubeBuddy's guide to YouTube sponsorship scams puts one reported campaign at at least 1,011 purpose-built domains and approximately 15,000 accounts, with about 1.6 million messages blocked and roughly 4,000 compromised accounts restored. The same reporting cites hijacked channels resold for approximately US$3 to US$4,000 depending on subscriber count. Treat that resale range as reported, not verified, but the point stands. A mid-sized account is worth stealing.

How the bait is packaged

The file is usually something you'd expect to receive. A brief. A contract. A media kit. A piece of campaign software you supposedly need to view terms or track deliverables. Pressure to open it today does the rest, because a deadline makes caution feel like you're risking the deal.

You don't need to understand the technical payload to refuse it safely. You only need one habit. Verify the sender on the brand's official domain first, then ask for the brief as text. A brand that can't paste its own brief into an email is telling you something.

• Don't install anything to view a collab. No browser extension, desktop tool or mobile app is required to read deliverables and a fee.
• Don't approve broad permissions. A login that requests channel management, posting rights or access to brand accounts you own goes far beyond verifying that the channel is yours.
• Don't treat a code as routine. If a verification code arrives that you didn't request, someone may already be trying to get in.

Keep deal admin away from credentials

Your password doesn't belong in a notes app, a shared document or an inbox rule. A shared brief isn't a reason to hand an assistant, editor or virtual assistant your login either. Give people the narrowest platform role that lets them do their job, and keep the master credentials with you.

Turn on two-factor authentication with an authenticator app or hardware key rather than SMS where the platform allows it. If you need to change a password, start from a bookmark or a typed address, never from a link in the message that made you suspicious.

Discuss deliverables only after the file and the login have been refused or independently confirmed. That order feels slow. It's the order that keeps the account yours.

Overpayments and Bank Details That Do Not Match

A real brand can still send a false payment instruction. After you have signed or delivered, a compromised brand inbox or an impersonated finance contact may announce new bank details. An oversized payment can be another trap. Check the payment, not just the brand's logo or the history of the thread.

Keep three checks in view. The payee and account name should match the legal entity on your signed agreement. If they don't, get an explanation from a contact you already know, not from the sender of the new details. Confirm any change through a separate contact route, rather than replying to the message announcing it.

The Federal Trade Commission's guidance on influencer job scams lists pressure to sign up quickly, contact from personal accounts, upfront payment requests, and demands for gift cards, cryptocurrency, payment apps or wire transfers as warning signs. A polished brief, a familiar logo or a tidy workspace does not prove who is behind the request.

International payments can involve currency conversion and intermediary banks, making unusual instructions easier to explain away. Put the deposit, balance, currency and payment milestones in writing before work begins. A guide to invoicing a brand can help you check what to include on the invoice.

Once you have independently confirmed the payer, keep the agreed fee, usage terms and payee together with the deal. The Creator List workspace can organise deals you already have, but filing a deal does not authenticate the brand. If you only need an invoice PDF, the free invoice tools create one without sending payment anywhere.

Recover, Report and Warn Peers

Assume you've already replied, opened something, or shared details. Speed matters more than embarrassment. Work through these steps in order, and pay nothing further to release a kit, a refund or your own account.

1. Change passwords from a clean starting point. Start with email, then social and bank logins. Use a bookmark or typed address, not a link from the scammer.
2. Turn on two-factor authentication. Prefer an authenticator app or hardware key over SMS, and review signed-in devices and third-party access while you're there.
3. Call your bank if payment details were shared. Ask what can still be recalled or disputed, and whether the account should be monitored or replaced.
4. Report the profile, email and messages to the platform. Also report through the consumer or police cybercrime channel in your market, and tell the impersonated brand via a contact on its own website.
5. Warn creators in your niche. Share the sender domain and the exact ask. Don't forward the malicious file itself.
6. Keep everything. Headers, screenshots and receipts support a platform report, a bank dispute and the brand's own takedown. Don't delete the thread.

The payment side deserves equal care after the fact. Federal Trade Commission guidance on fake cheque scams warns that scammers may send a cheque, then demand part of the money back or ask for gift cards, and that the cheque can later bounce, leaving you responsible for repayment. If money arrived and you've been asked to forward any of it, tell your bank before you touch it.

Keeping a clean record also protects the next deal. Retaining the brief, signed terms, approvals and invoice for each confirmed collab, in the spirit of a creator paper trail from deal to sign-off, gives you a baseline to compare future payment instructions against. The free invoice generator is useful at that stage, once the payer is confirmed.

Four lines to keep. The ask exposes the scam. Rough outreach can still be real. Files and logins wait for an independent check. Bank changes are confirmed on a channel the sender didn't supply.

---

The Creator List isn't somewhere to hire creators. It's the workspace creators use to manage deals they've already agreed, and if a creator you work with uses it, you review drafts, leave notes and approve the final cut there for free.