Fake Brand Deals: How Creators Spot and Avoid Scams

You can spot fake brand deals by one pattern — money, data or access is supposed to flow the wrong way: you’re asked to open a file, log in via an unfamiliar link, pay a fee or buy the product yourself first. A real brand pays you, not the other way round — and it can be verified through its official website. This guide covers the most common scams targeting creators, how to unmask fake senders, which checklist to run before every yes, and what to do if your account has already been hacked.

Phishing disguised as a collab request: malware and fake logins

The most dangerous fake brand deal doesn’t want your money — it wants your account, and a collaboration request is the perfect bait, because you want to open it.

How well this works was documented by Google’s Threat Analysis Group in a report from October 2021: attackers contacted YouTube creators with forged business emails, posed as existing companies and offered a paid advertising collaboration in a video. After the creator agreed, a link arrived to the software that was supposed to be featured — antivirus, VPN, a music player, a photo editor or a game. In reality it was malware that stole browser cookies and passwords. According to Google, the attackers set up at least 1,011 domains purely for distribution; hijacked channels were sold or used for crypto scams.

Typical variants that still turn up today:

• The “contract” as an archive: the brief or contract arrives as a password-protected ZIP file, an executable or a download link. Google explicitly names encrypted archives as a trick to get past virus scanners.
• “Test our app first”: you’re asked to install a program so you can show it in your video.
• Fake login page: a link leads to a page that looks like Instagram, TikTok or Google: “Log in to view the campaign brief.” Anyone who enters a password and verification code there hands over both.

Stolen session cookies are particularly nasty: Google describes cookie theft as hijacking an existing session — the attacker uses the login stored in the browser and doesn’t need to sign in again. As a possible reason for the method’s comeback, Google points to the wider adoption of multi-factor authentication. Two-factor authentication is still a must — it just doesn’t protect you from launching malware yourself.

When you’re asked to pay: upfront costs, codes, fake agencies

The second group of scams is after your money — directly or through your reach. The ground rule is simple: in a real collaboration, money flows from the brand to you, never the other way round.

• Buy the product yourself first: you’re told to order from the shop and get reimbursed “after publication”. Often the shop simply profits from your purchase, and the refund never comes. Reputable brands send the product free of charge or pay for it upfront.
• Ambassador program with a discount code: “We’ve picked you as an ambassador!” — followed by a code that lets you order more cheaply yourself. There’s no fee for your content — it’s a sales channel at your expense. Fair affiliate commissions are an add-on to a fee, not a replacement.
• Fake agencies with upfront fees: a supposed agency promises deals but first asks for a sign-up fee, a paid portfolio shoot or a “verification”. Reputable management companies earn a commission on your collaboration income — usually 15–25% for exclusive and 10–20% for non-exclusive management — due only once money comes in from the brand.
• Activation fee for partner programs: in May 2026, the analytics firm Graphika documented a fake partner program in the name of a well-known US fashion brand, reported on TikTok and X: after applying through a professional-looking form that asked for follower and engagement figures, creators were told to pay an “activation fee” of $60–80 — supposedly refundable.

The same question helps with all four schemes: who is paying whom? If the answer is “me first”, the request is not a collaboration.

Unmasking fake brand profiles and senders

Almost every scam starts with an identity that doesn’t add up: an account that looks like the brand, or an email that sounds like its marketing team. Four checks expose most fakes.

• Handle and profile: fake brand profiles add extras to the name — “.collab”, “_partners”, “official.team” — or swap individual letters. Check whether the brand’s official website links to the profile, how old it is and whether it shows real content. A new profile with three posts writing on behalf of a big brand is a warning sign.
• Sender domain: a real brand writes from its own domain. Be suspicious of free email addresses and of addresses where the brand name only sits at the front: in “brand.influencerprogram.app”, the actual domain “influencerprogram.app” doesn’t belong to the brand. The Graphika case domains followed this pattern. Also watch for swapped characters (“rn” instead of “m”) and the address behind the display name.
• Legal notice: anyone offering commercial digital services in Germany must, under Section 5 of the German Digital Services Act (DDG), clearly state their name, address and email address, among other things — registered companies also their register and registration number. If a German brand’s legal notice (Impressum) is missing or doesn’t match the sender domain, be careful. Companies abroad often follow different rules.
• Cross-check through known channels: Germany’s Federal Office for Information Security (BSI) advises contacting the company through a different channel when a request seems suspicious. Use contact details you found yourself on the official website or the verified profile — never a number, link or address from the suspicious message — and ask whether the campaign exists.

The same goes for agencies: a real agency names its company in the legal notice, introduces its team by name — ours is on our about us page — and gives references you can check.

Stopping fake brand deals: the checklist before every yes

Before accepting a request, opening a file or entering data, run through these points. Five minutes of checking costs less than a lost account.

• Cross-check the sender: compare domain, handle, profile age and legal notice with the official website and have the request confirmed there — not via links in the message.
• No executable files: don’t open programs, shortcuts or password-protected archives. Reputable brands usually send contracts as a PDF or via a well-known e-signature service. YouTube’s help center also advises never downloading files or software from untrusted sources.
• Log in only in the app: never sign in via a link from a collaboration email — not even to “approve a partnership ad”.
• Two-factor authentication everywhere: the BSI recommends it for every service that offers it, especially email and social networks — and advises registering several second factors so losing your phone doesn’t lock you out. The Verbraucherzentrale (consumer advice center) recommends an authenticator app over SMS codes.
• Protect your email inbox first: whoever has your inbox can reset almost every other password. Use a strong, unique password from a password manager.
• Never pay upfront, never share codes: no fee, no advance purchase, no verification code — not even to supposed platform support.
• Contract in writing: deliverables, fee, payment terms, company name with address. Without these details, you’ll struggle to claim your fee later.

A separate email address for collab requests that isn’t the recovery address of your social accounts also helps: the contact address in your bio is public and the first target of such requests. For managed creators, requests land with the management first, which checks sender, budget and contract before the creator invests time. At creatorhub, management has handled this vetting since 2019 for every creator we represent — on Instagram, TikTok, Snapchat and YouTube; our creator page describes the process.

Account hacked: the official ways back

If you can no longer log in, posts appear that aren’t yours, or your email address has been changed, every hour counts. Here’s what to do:

• Secure your email inbox: change the password, remove unknown forwarding rules and devices, turn on two-factor authentication. Password resets and security codes run through your inbox — if you don’t secure it first, the attacker can lock you out again.
• Instagram: Instagram bundles its official help for hacked accounts at instagram.com/hacked. There you select what happened and follow the recovery steps. If you still have access, check the login activity in your security settings for unknown devices and locations — the Verbraucherzentrale recommends this too.
• TikTok: report the case in the app using the report-a-problem function; TikTok’s official help center has a dedicated guide for hacked accounts.
• YouTube: YouTube’s help center names three steps: first recover and secure the linked Google Account, then immediately revert unwanted changes to the channel so no Community Guidelines or copyright strikes stick, and finally review security for everyone with channel access. If you can’t reach Creator Support, YouTube points to @TeamYouTube on X.

Afterwards, let your community know via another channel that messages from your account aren’t from you right now, and inform current brand partners. Never pay recovery services that offer help in comments or DMs — anyone who “gets your account back” for money is usually the next scammer.

You can report phishing messages to the Verbraucherzentrale’s Phishing-Radar and file a criminal complaint through your state police’s online service (Onlinewache) or at your local police station — the BSI names both channels. This article does not replace legal or IT security advice.

Scams targeting creators at a glance

Often combined: first a fake brand profile builds trust, then comes the login link or the fee.