Spot suspicious messages during creator negotiations and protect payment details

Pause an unexpected invoice or payment-detail change until you confirm it through a contact route you set up before the message arrived. Call the creator or their authorized representative on a number you verified earlier. Check the invoice against the agreement, then have finance approve any change before paying. A strange address, an urgent deadline or a new bank account is a reason to check. None of them proves fraud by itself.

An influencer collaboration email scam can arrive in the middle of a real negotiation. Australia's cyber security guidance on business email compromise describes both impersonation and the use of compromised email accounts. A familiar sender still needs a payment-change check.

Keep payment details out of the campaign thread as well. Bank and tax details go to finance through an approved, access-controlled intake. Campaign notes keep only the payment status, the owner and a record reference. A creator manager needs to know whether a payment is blocked, and rarely needs the account number behind the block.

The steps below are operational recommendations for a campaign team, based on Australian, US FTC and FBI guidance. They are not a statement of legal compliance or a legal payment deadline, and they give no permission to ignore your agreement. Ask qualified advisers which privacy, tax and recordkeeping rules apply to your business and your creators.

Separate campaign risk from payment verification

Modash's article on risky collaborations covers creator vetting, communication and limits on campaign risk. Those checks answer whether a partnership suits your brand and campaign. Payment verification asks a narrower question, which is whether the authorized person requested this specific invoice or change.

Keep three decisions apart:

• Identity asks whether you are speaking with the creator or with a representative whose role you have confirmed.
• Authority asks whether that person can approve this invoice, payment recipient or account change.
• Payment asks whether the request matches the agreed work, amount, currency and payment milestone.

Knowing the campaign name answers none of these on its own. The Australian guidance on invoice fraud explains that someone with access to a vendor's email can alter a real invoice and send it from that account. The FBI's business email compromise page also warns that criminals can get into genuine billing conversations and time their requests to match.

Keep the payment record apart from campaign notes

Modash's guide to paying influencers describes a manual flow in which someone receives an invoice, checks it and passes it to finance. Add a data boundary to that handoff. The campaign record should show what finance must do without copying everything finance needs to pay.

Use two records with different permissions:

• The campaign record holds the creator reference, campaign, agreed milestone, approval status, invoice reference, due date, finance owner and next action.
• Fee amounts in the campaign record stay visible only to people who need budget information.
• The restricted finance record holds payee identity, bank or payout details, original invoices, required tax documents, verification history and payment evidence.
• Finance owns access to the restricted record and every change made to it.

An invoice may contain banking or tax information, so treat the original as restricted even when its filename looks harmless. When marketing must review the commercial terms, share an approval summary or a redacted copy.

The FTC's business data-security guide recommends collecting only the information you need and limiting employee access by job need. Keeping bank details out of a shared brief applies that advice to creator payments. The FTC does not prescribe a creator-specific folder layout.

Map each handoff and its access question

Use this map when you set up a payment process. In a small team one person may fill more than one role, so write down which role they are using at each step.

Keep the permissions to view, edit, export and approve separate where your system allows it. Someone who can update campaign status should not gain permission to change a payout destination along with it.

For a wider review of contractors, shared folders and departing staff, run the campaign-data access audit. Name payment access as one part of that review.

Set the payment route before the first invoice

Tell the creator who handles payment setup, which intake route to use and how to check an unexpected request. During onboarding, save a contact route that finance can use later to confirm changes, while there is still time to check it.

Choose an intake method your finance and security owners have approved. It should limit access to named users, protect the data in transit and keep a record of changes. Turn on multifactor authentication where it is available, as the FBI guidance recommends.

Do not ask creators to reply-all with banking information. The FTC warns that ordinary email is unsuitable for sending sensitive data and recommends encrypted transmission. A password-protected attachment still needs an approved handling process, because the password does not control who can open downloaded copies.

Ask finance which fields it needs for the chosen payment method and country. Do not collect identity documents or extra tax information as a precaution without a defined need. Marketing can record that setup is complete without ever receiving the documents.

Decide what needs a hold

Put the hold on the affected payment and on the payment-record change. Do not label the creator as fraudulent while you check.

The Australian government's warning signs include bank-detail changes, urgency, domain mismatches and pressure to bypass business processes. Treat them as reasons to investigate. A creator may have changed agencies or banks for a real reason.

Do not open an attachment to see what a suspicious request contains. The US FTC's phishing advice warns that links and attachments can install harmful software. Ask your security team how to keep and inspect the message.

Verify outside the incoming message

Start with the campaign's existing records. Find the agreed fee, the payment trigger, the known representative and the contact details you verified before this request arrived.

Call the saved number yourself. Do not use a new number from the invoice, the signature or the reply. The FTC recommends contacting a known company through a phone number or website you know is real, separately from the suspect message.

A reply in the same thread cannot give you that separation when the mailbox itself may be compromised. A second email address supplied by the sender has the same weakness. An unsolicited callback also needs checking through your saved route.

If you have no trusted number, keep the payment on hold while you set one up. For an agency, start from its official website, reached on your own, and ask for the named representative. For a creator, use your onboarding contact process. Verify that a contact page belongs to the creator before you treat a newly found page as proof of identity.

Public profile links can help you find a contact route. They do not show that the person who answers may redirect payment. If you cannot confirm identity and authority, escalate instead of guessing.

Use a payment-change verification script

The following script is an example for a call you place through a route you verified earlier. It contains no real campaign or customer details.

I'm checking a payment request connected with our collaboration. Our process requires a separate check before we change the recipient or bank details.

Did you request a payment change? Please describe what changed and why.

Which invoice, amount, currency and payment milestone does it concern?

Who is authorized to approve this change? If an agency will receive payment, can we confirm that arrangement through our agreed approval process?

Finance will collect the confirmed details through our approved payment process. We will release payment after the change and invoice have been approved.

Ask the person to describe the request before you give them its details. Matching campaign details support the review, but details alone do not prove identity. Keep the independent contact check and the finance approval in place.

Do not ask for passwords, sign-in codes or bank-login access. Do not paste full banking details into a group campaign thread.

Treat a changed payee as a new approval

A familiar email address and an existing invoice thread are not enough evidence that a change is genuine. The FBI recommends verifying changes to account numbers or payment procedures with the person who asked for them. The sequence below is our recommendation for applying that advice.

1. Pause the affected payment, mark it as awaiting verification and keep the request in the restricted record.
2. Contact the creator or authorized representative through the number or route you verified earlier, never a replacement number from the change request.
3. Confirm that the person requested the change and is allowed to change the payment instructions.
4. Have finance resolve any different payee name or new agency recipient before going further.
5. Have the creator send the new details through the approved intake, not the campaign thread.
6. Record who verified the request, when and by which route, without copying account numbers into campaign notes.
7. Ask a second authorized reviewer to check the change before release.
8. If the team cannot split those roles, document the exception and arrange an outside check before paying.

Urgency does not remove the verification step. If the creator is unavailable, keep the payment on hold and tell them what finance needs. For payment timing and evidence, use agreed creator milestones.

Resolve the request with a recorded decision

Every check ends in one of three outcomes:

Here is a hypothetical case. A creator's usual address sends an invoice with a new agency as the beneficiary. The campaign manager calls the number verified during onboarding. The creator confirms a new agency relationship but says they have not approved the invoice. The invoice stays pending while finance checks the agency's authority and the billing milestone. Confirming the agency relationship alone does not complete the payment check.

A campaign note that finance can act on

This example is hypothetical too. It holds no real creator information, account details or payment amounts.

Link to a permission-controlled record or use its reference ID, never an unrestricted sharing link. Test access with the intended role before you rely on the split. Check notifications and exports as well, because copied fields can show up outside the original record.

When a real management change explains a request, prepare a creator-manager handover so the next invoice has a clear owner. Pass on the open hold and the finance owner's name. The new manager does not need a copy of the creator's bank documents.

Escalation checklist if something went wrong

If you already acted, stop further payments and tell finance and security what happened. Then work through this list:

• Record whether you only received the message, clicked a link, opened a file, entered credentials or sent funds.
• Keep the original message and payment reference through the team's incident process, and do not forward suspicious attachments to campaign colleagues.
• If you sent money or banking details to a suspected scammer, contact your bank at once through its usual channel, as the Australian guidance advises.
• Ask the bank what it can do, and do not assume the money comes back.
• In the US, report business email compromise to IC3, which the FBI guidance names as the reporting route.
• The FTC's phishing guidance lists further US reporting and identity-theft resources.
• Outside the US, use your country's reporting route, such as the cybercrime route linked from the Australian guidance.
• If credentials or a device may be compromised, bring in the person responsible for account security, and do not sign in again through the suspicious link.
• Tell the verified creator contact which request is on hold without making an accusation you cannot support.

If bank details already sit in campaign notes, restrict access and alert the finance or security owner. Find the attachments, exports and shared links that may hold copies. Follow the incident process before you delete anything that may be needed as evidence.

After that review, remove extra copies under your approved retention policy instead of a made-up deletion deadline. The FTC recommends a written policy that covers what to keep, how to protect it, how long to keep it and how to dispose of it. Finance and qualified advisers should match that policy to your recordkeeping duties.

Before the next creator payment, name the person who verifies changes and the person who approves them. Then open that payment's campaign note with the campaign manager's permissions. It should say who owns the payment and what happens next, with no payout details or bank documents in view.