Fake Brand Deals: How Creators Spot Sponsorship Scams Early

Treat any brand deal that asks you to pay, log in through a link, install software, share a login code or move to a private chat app as suspect until you've verified it. Find the brand's official website yourself and confirm the offer through a company email address or the brand's real account before you share anything. Genuine brands pay creators; they don't charge creators for the chance to work with them.

Key takeaways

• The clearest warning signs of a fake brand deal are a request for money, a login link, a file to install, or a request for a one-time password or login code.
• Never use the links or contact details in the pitch to verify it. Search for the brand's official website yourself.
• Instagram's Help Center says Instagram doesn't contact people about account security through Direct messages.
• If you paid money in India, call the 1930 helpline or report it on cybercrime.gov.in as soon as possible, and tell your bank.
• A structured, login-gated contact inbox cuts down on spam, but it doesn't replace checking who is really behind an offer.

What is a fake brand deal?

A fake brand deal is a sponsorship or collaboration offer that exists to take something from you: money, your account, your personal details or your followers' trust. Some scams copy a real brand's name and logo. Others invent a brand or a "talent agency" that doesn't exist. Most follow a handful of patterns, and once you know them they're easy to spot.

The most common scam patterns

Fee-to-collab

The "brand" offers a paid campaign, then asks for a registration fee, an onboarding fee, a "refundable deposit" or shipping charges before anything happens. A variation asks you to buy the product first and promises a refund plus your fee later. In a real deal, money flows from the brand to you.

Phishing "contract" or "brief" links

You're sent a link to "view the contract", "accept the campaign" or "claim your payment". It opens a page that looks like an Instagram, Google or Microsoft login. If you enter your password there, someone else can take over your account.

Malicious files disguised as contracts

The contract or brief arrives as a file you have to download and open, sometimes inside a password-protected archive or with instructions to "enable editing" or install a viewer. A real contract can be read in a browser or a normal PDF viewer and never needs you to install anything.

Fake agencies and impersonated brands

The account or email uses a well-known brand's name with a small change, such as an extra letter, an underscore or an unusual domain. Fake "talent agencies" may promise a roster of big brands in exchange for a sign-up fee.

Account-takeover "verification"

A message claims your account will be verified, or will be deleted for a copyright issue, unless you confirm your details. It may ask for a login code that was just sent to your phone. Anyone with that code can sign in as you.

Overpayment and refund

The "brand" claims to have paid more than agreed, often with a screenshot, and asks you to send back the difference by UPI or bank transfer. The original payment never arrived, or it gets reversed.

Red flags in the first message

• It's addressed to "Dear influencer", or gets your name or niche wrong.
• The offer is unusually generous for your audience size, and urgent ("reply in 2 hours").
• It pushes you to WhatsApp or Telegram before anything is in writing.
• It asks for money, ID documents or bank details before there's a signed agreement.

A five-step verification checklist

1. Find the brand yourself. Search for its official website and social accounts instead of using links or numbers from the message.
2. Match the sender. Check that the email domain matches the official website. On Instagram, open the profile's menu and choose About This Account. Instagram's Help Center says it shows when the account joined and, for some accounts, the country it's based in. A "global brand" that joined last month deserves a closer look.
3. Confirm through an official channel. Email the marketing or press address on the brand's website and ask whether the person and the campaign are real.
4. Get the terms in writing. Ask for deliverables, fee, payment timing and usage rights in the email body. Refuse any upfront fee.
5. Protect your logins. Never share passwords, login codes or remote access, and turn on two-factor login everywhere you can.

Genuine partnerships look different: a named contact at a real company, a clear brief and payment terms that favour you. See how to land direct affiliate partnerships with brands for what a normal process looks like.

What to do if you clicked or paid

• You entered your password on a strange page. Open the app directly, not through any link, and change your password. Log out of devices you don't recognise and turn on two-factor authentication. To check whether a security email is genuine, look in the app, not your inbox: Instagram's Help Center describes a list of emails Instagram sent you in the last 14 days, in Accounts Center's password and security settings.
• You sent money. In India, the Indian Cybercrime Coordination Centre (I4C) says financial cyber fraud can be reported on the 1930 helpline or the National Cybercrime Reporting Portal. Contact your bank or UPI app too. Report quickly, because the system is built to help stop money moving onward.
• You opened a downloaded file. Disconnect from the internet, run a security scan, and change important passwords from a different, trusted device.
• Your account sent messages you didn't write. Once you're back in control, warn your followers in a story.
• In every case, keep evidence. Save screenshots, usernames, email addresses, links and transaction IDs before you block anyone.

Where to report

• On Instagram. Press and hold the message to report it, report the profile, and use the impersonation report if the account pretends to be a brand or a person. Instagram says you can forward suspicious emails to phish@instagram.com.
• In India. Use the 1930 helpline for financial fraud, or report any type of cybercrime at cybercrime.gov.in, the National Cybercrime Reporting Portal run by I4C under the Ministry of Home Affairs.
• In the United States. The FTC takes fraud reports at ReportFraud.ftc.gov.
• Elsewhere. Use your national police cybercrime reporting service.
• To the real brand. Tell them someone is using their name.

How a login-gated inbox and blocking help

Scammers like open channels: a public email address, open DMs, anonymous contact forms. A structured inbox raises the effort for them and makes checking easier for you.

On QKAP, the inbox button on your page only lets people message you after they log in with a free QKAP account. Partnership, sponsorship and collab requests have fields for the brand name and website, so a genuine sender can give you something concrete to check from the first message. Each sender is limited to 5 new conversations an hour and 20 a day, and can send only 5 messages in a row before you reply. You can block a sender or mark them as spam. When three different creators mark the same sender as spam within 30 days, that person can no longer start conversations.

The inbox doesn't accept attachments, so nobody can send you a file through it, and each message can carry at most five links. QKAP's email notifications never include the message text. If an email claiming to be a QKAP message is full of links, open your dashboard directly instead of clicking. You can also turn on two-factor login in Dashboard → Settings → Security.

None of this proves a sender really works for the brand they name, so still run the five-step check. The inbox is on every plan, including Free (see the inbox feature page).

Protect your followers too

If you promote a brand you couldn't verify, followers may pay for something that never arrives, and trust is slow to rebuild. Building trust as an affiliate creator starts with checking what you recommend. Never share your home address, ID or followers' details with an unverified brand either. Privacy basics for creators covers handling follower emails responsibly.

Frequently asked questions

Do real brands ever ask creators to pay?

In a normal sponsorship, no. The brand pays you, or sends a product with no strings attached. Paid courses, events or marketplaces with published fees are a different thing, but a "brand" asking for a fee before it pays you is a classic warning sign.

Is a Gmail address always a red flag?

Not always. Small brands, solo founders and freelancers often use free email addresses. But if someone claims to represent a large company and writes from a free address, confirm through the company's official website before going further.

How do I report a fake brand?

Report the message and profile on the platform where it reached you, using impersonation reporting where it fits. Tell the real brand. If you lost money in India, call 1930 or report on cybercrime.gov.in, and contact your bank.

What if a brand wants to move to WhatsApp or Telegram?

Some real marketers use chat apps for quick coordination. Keep the agreement itself in writing on email, and stop if the chat turns to fees, login links or downloads.

Can someone take over my account through a DM link?

Yes, if the link leads to a fake login page and you enter your password, or if you share a login code. Two-factor authentication and never typing your password into a page you reached from a message prevent most takeovers.

Sources

Checked in October 2026:

• I4C, National Cybercrime Reporting Portal and 1930 helpline: i4c.mha.gov.in
• Instagram Help Center, protecting yourself from phishing: help.instagram.com
• Instagram Help Center, avoiding scams: help.instagram.com
• Instagram Help Center, reviewing recent emails from Instagram: help.instagram.com
• Instagram Help Center, impersonation: help.instagram.com
• Instagram Help Center, About this account: help.instagram.com
• FTC fraud reporting: reportfraud.ftc.gov
• QKAP inbox protections: our own product, see the inbox feature page