In short
Reviewed
A legit OnlyFans agency passes four checks you can run yourself. The company: its legal name is in a state business registry, active, and the same as on the contract and invoices. The terms: commission, basis, notice, exit and any commission after you leave are in writing before you sign. Your login: you keep your password, email, 2FA and payouts, and nobody asks you to send a code. The contact: whoever writes to you is listed on the agency's own website, found by you, not through a link in the message.
Fakes usually fail one of these: no company you can find, terms only on a call, an upfront fee, a request for a login code, or a lookalike handle borrowing a real agency's name. A registry record proves a company exists, not that the deal is fair or that the person messaging you works there. This guide is general information, not legal advice.
What does “legit” mean for an OnlyFans agency?
Four different questions hide in “is it legit?”, and each one has its own proof.
| Question | What proves it | What doesn't |
|---|---|---|
| Is the company real? | A state registry record under the legal name on the contract | A logo, a website, a follower count |
| Is the deal what they say? | Written terms, and a contract you can read before a call | Testimonials, earnings screenshots, promises on a call |
| Do you stay in control? | You enter the 2FA code yourself; payouts go to your bank | “Trust us”, or a request for your password |
| Is this person really from them? | The sender is listed on the agency's own website | A familiar name or logo in a message |
Most scams fail the last two rows. An impersonator can even send you a real company's registry record.
How do you check an OnlyFans agency in a state registry?
US companies register with a state, usually through the Secretary of State, and the record is public. The check takes a few minutes:
- Get the exact legal name and state in writing. A brand name isn't enough; ask for the full name with “LLC” or “Inc.”.
- Open the state's business search yourself, not through a link the agency sent.
- Search by filing ID if you have one. Similar names are common; the ID tells companies apart.
- Read the record: status (active, in good standing or something else; the wording varies by state), filing date, registered agent.
- Match it against the name on the contract, the invoices and the website.
What the record tells you
- The company exists, and when it was filed
- Whether it's active or in good standing
- Its registered agent, for legal mail
- The exact name to expect on the contract
What it doesn't tell you
- Who owns or runs it; many states don't list owners
- Where the team actually works
- Whether the terms are fair
- Whether the person messaging you works there
Some things look odd but aren't red flags alone: a registered agent address is for legal mail, not an office, and many companies share one; a US LLC can be run from anywhere; a recent filing date can just mean a new company. What matters is whether the record matches what you were told. If nothing matches, the status says dissolved or inactive, or the contract names a different company, stop and ask why in writing.
What should a legit agency put in writing before you sign?
A legitimate agency can tell you its price and exit terms before it sees your statements. Ask by email, before any call, for:
- the commission rate, and whether it's taken from gross or net (OnlyFans keeps 20%, so the basis changes the price);
- what it includes, and any upfront, setup, tool or ad fees;
- the minimum term, notice period, exit fee and auto-renewal;
- any commission after the end date;
- how account access works, and where payouts go;
- who owns your content and the marketing pages;
- who chats with your fans, and whether AI writes messages;
- the legal company name, where it's registered, and who signs.
Every answer should end up as a clause: many contracts have an entire-agreement clause, so the signed document replaces earlier emails. A mutual NDA is reasonable; one you must sign before you see the commission and exit terms mostly protects the agency. Not legal advice: with real money at stake, a lawyer's read is worth it.
Warning signs in the paperwork
- The rate is only available on a call, or “after we see your stats”.
- The contract names a different company than the website, or no company at all.
- Invoices come from a person or company that isn't on the contract.
- Your payouts would go to an account in the agency's name.
To test a contract you already have, use the contract red-flag check. A complete set of written terms looks like our sample term sheet, and the questions to send are in questions to ask before signing.
Who should hold your login, 2FA and payouts?
You. OnlyFans has no manager or agency role, so an agency that chats for you works inside your logged-in session. A legit agency sets that up without taking your keys: you log in and enter the 2FA code yourself, on a call, and a new password ends its access. Payouts go from OnlyFans to your bank, and the agency invoices you; more in how OnlyFans agencies get paid.
Also stop if anyone asks you to change the email behind your account, your 2FA phone or your payout details; whoever controls the email can reset everything else. More in does an OnlyFans agency own your account?
How do fake OnlyFans agencies and impersonators work?
Some fakes invent an agency. Others borrow a real one, with its name, logo, website text and even registry details, and write from a handle or address that's almost right. Real agencies do reach out first sometimes, so a first message isn't the warning sign. What it asks for is.
| The message says | It's after | What to do |
|---|---|---|
| “We need to verify your account. Send the code you just got.” | Your login | Don't send it. No agency needs a code by message. |
| “Pay the onboarding fee to reserve your spot.” | Money before any work | Get every fee in the written terms; pay nothing before you've read the contract. |
| “Send a photo of your ID and a selfie to get started.” | Your identity | Check the company and the contract first, and ask why it's needed. |
| “Move your payouts to our account. We'll pay you your share.” | Your earnings | Keep payouts going to your own bank. An agency can invoice you. |
| “Message my personal account instead.” | A channel nobody can verify | Reply only through channels listed on the agency's own site. |
How to spot a lookalike
- A handle with an extra letter, dot or underscore.
- A free email address, or a domain with a different ending from the one on the agency's site.
- A display name that says the agency while the address after the @ says something else.
- A link to a login page or “contract portal” you didn't find yourself.
How do you check that a message really comes from an agency?
- Use nothing from the message. No links, numbers or handles from it. Find the agency's website yourself.
- Compare the sender letter by letter with the channels the website lists: the handle, the email domain, the phone number.
- Ask through a listed channel. Email the address on the website and ask whether the person who contacted you works there.
- Share nothing until it's confirmed: no statements, no ID, no payment. And never a password or a code, even after it's confirmed.
- If it isn't them, report the account on the platform where it wrote to you, and tell the real agency.
What if you already sent a code, a password or money?
Move fast, in this order. None of it needs anyone's cooperation.
- Change your OnlyFans password and sign out of other sessions. That ends a session started with what you sent. If you also shared your email password, secure the email first, because password resets go there.
- Check the account email, phone number, 2FA and payout details. Change anything you didn't set.
- If you paid, contact your bank or payment provider and ask what they can do.
- Save the evidence: the handle or address, the messages, the dates. Report the account to the platform, and tell the agency whose name was used.
- If someone threatens to leak content, don't negotiate: save every message, talk to a lawyer, and file takedown notices. In many places, sharing intimate content without consent is a crime you can report to the police.
Is a legit agency automatically a good one?
No. Legit means the company exists, writes down its terms and leaves you in control. Whether it's right for you depends on what those terms say and on the work itself: the commission basis, the exit, the reports and who talks to your fans.
- To compare offers, use the 14 things to get in writing and read reviews for patterns.
- To test the price, the break-even calculator shows how much an agency has to add to be worth its commission.
- Already signed and seeing problems? Read 10 signs it's time to switch.