Stopping a Brand Impersonation Ring Exploiting OnlyFans Creators

Background

A prominent OnlyFans creator discovered that their photos and videos were being used without permission across 12 fake accounts on OnlyFans, Instagram, and Telegram, complete with fake subscription pages designed to steal payment information from fans.

Investigation Methodology

1. Content Fingerprinting: We hashed the creator's original content and scanned for matches across known impersonation databases.
2. Payment Trail Analysis: The fake subscription pages used third-party payment processors. We traced the merchant IDs back to a single registration.
3. Registration Pattern Analysis: All 12 fake accounts showed identical registration patterns: same email domain, similar usernames, and creation within a 48-hour window.

Key Findings

• The 12 fake accounts had collectively stolen an estimated $23,000 in fraudulent subscription payments.
• The payment processor linked all accounts to a single individual operating from Eastern Europe.
• The operator was running identical schemes against 8 other creators simultaneously, totaling over $200,000 in fraud.

Outcome

All 12 accounts were reported and removed within 72 hours. The full investigation report was delivered to the creator's legal team and shared with a cybercrime task force. Total investigation time: 10 days.