Scam library · Small business · Email & phishing · Jobs
Fake brand deal scam targeting creators
A brand you might recognize emails you: they love your content and want to pay you $1,500 for a sponsored post. The details are in an attached 'brief' or a link to a contract.
For creators and small businesses that run social accounts, this is a common way to steal account access or install malware.
What the message looks like
From: Partnerships Team <collabs.brandteam@gmail[.]com>
Subject: Paid partnership offer for your channel
Hi! We love your content and would like to offer a paid partnership: $1,500 for one integrated video.
Please download the campaign brief (Brief_2026.zip, password: 2026) and confirm by Friday.
How this scam works
The 'brief' is often a password-protected archive that contains a malicious program, or a link to a fake login page that steals your social media or Google account. Scammers then take over your channel or page, change the name and use it to run crypto scams to your audience.
Other versions are payment scams: you're asked to buy the product first and get reimbursed later, or pay for 'shipping' of samples. Some send a fake check for the fee and ask you to pay a 'designer' part of it.
Real brands usually work through agencies or creator platforms, use their own company domain, and send contracts through recognized signing tools.
Red flags
- A brand using a free email address instead of its company domain.
- Password-protected attachments or downloads to 'view the brief'.
- Being asked to log in to see a contract or campaign.
- Requests to buy the product or pay for samples upfront.
- Very high pay for a small channel, with little detail.
How to tell it’s fake
- Check the sender domain against the brand's real website, and contact the brand through its official site.
- Never run downloaded files to read a brief. Real briefs are documents or shared links on recognized platforms.
- Use a creator platform or agency with a track record when possible.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- If you downloaded but didn't open the file, delete it. If you opened it, disconnect from the internet, run a full security scan and change passwords from another device.
If you paid
- If you paid for samples or 'fees', contact your bank or payment app to dispute it.
If you shared personal info, a password or a code
- If you logged in on a fake page, change the password, sign out of all sessions and turn on two-step verification. Check that your channel's recovery email and phone are still yours.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard runs in Chrome and Edge on your computer and checks sponsorship emails you have open in Gmail or Outlook on the web. It flags free-email 'brand' senders, password-protected 'briefs' and fake login pages before you download or sign in. If a deal seems legit, get an expert second look before you open anything.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- How do I know if a brand deal is real?
- Check that the email comes from the brand's own domain, find the brand's contact on its website and ask them directly.
- Why do scammers want my channel?
- Hijacked channels with real followers are used to run crypto and giveaway scams.
- I opened the zip file. What now?
- Treat the computer as compromised: scan it, change passwords from another device, and secure your accounts.