Freelance Scams: The Patterns and How to Avoid Them

Every freelance scam attacks the same moment: the handoff of work or money before either is secured. Learn the seven recurring patterns, what a legitimate client never asks you for, how to verify one in five minutes, and exactly what to do in the first hour after you realise something is wrong.

If you are reading this because a message just arrived that feels slightly wrong, trust that feeling and read the patterns below before you reply. Freelance scams are not creative. There are perhaps seven of them, they have been running unchanged for years, and every single one attacks the same moment: the handoff, when work or money has to move before the other side is secured. Once you can see that shared structure, the individual variations stop being surprising — and the defence is the same in every case, which is why it is worth ten minutes to learn.

They all attack the same moment

In any freelance deal there is a gap. You have to deliver work before you are paid, or the client has to pay before they see the work. Somebody moves first, and whoever moves first is exposed. Everything that follows in this article is a variation on manufacturing that gap and then standing on the safe side of it.

This is genuinely useful to know, because it means you do not have to recognise each scam individually. You only have to recognise pressure to move first, outside any structure that protects you. A stranger who wants you to start work before a milestone is funded, or to accept payment through a route with no record, or to send money for any reason whatsoever, is asking you to stand in that gap alone. The specific story wrapped around the request — the urgency, the flattery, the large budget, the tight deadline — is decoration.

The seven patterns

Each of these has been circulating for years in more or less identical form. You will see several of them within your first few months.

1. Move the payment off-platform. The opening is friendly and often plausible: fees are lower elsewhere, their accounts team only uses direct transfers, the platform is “too slow”. What actually happens is that you lose the funded milestone, the message record, the review and any route to a dispute, all at once. This is the most common pattern by a wide margin, and the one that makes every other pattern possible.
2. An advance fee from you. A registration charge, a “security deposit”, a training or onboarding fee, a software licence you must buy, a refundable verification payment. The rule has no exceptions: a client never needs money from you. Work flows one way and payment flows the other, and anything else is not a job.
3. Overpayment and refund. You are sent more than the agreed amount — often with a story about an accounting error or a mistyped figure — and asked to refund the difference through a different channel. The original payment is later reversed or was never real, and the refund you sent was your own money. The test is simple: never return an overpayment through a route different from the one it arrived by, and never in a hurry.
4. The “test” that is the whole job. A sample chapter, one page of the design, a trial translation, a small dataset. Individually plausible; the tell is when the test is a complete, usable deliverable, or when the same test is being distributed to many freelancers who each unknowingly build one piece of the finished thing. Paid trials are normal and good. Unpaid ones that produce something shippable are not a test.
5. Stolen portfolios and stolen identities. Someone approaches you with a portfolio that is not theirs, or impersonates a real company to lend weight to an offer. The other direction happens too: your own work shows up on someone else's profile. Both are worth reporting rather than shrugging at.
6. A screenshot of a payment that does not exist. An image of a bank transfer, a payment confirmation or a funded escrow balance, sent to persuade you that money is secured so you will start work. A screenshot is a picture. Only ever act on what you can see yourself in your own account or in the project itself.
7. The too-good offer with a tight deadline. A budget noticeably above the market, minimal questions about your ability, and pressure to commit today. The generosity buys your enthusiasm and the deadline removes your time to think, which is the entire mechanism. Real clients with real budgets ask more questions, not fewer.

Verifying a client in five minutes

Verification sounds like work. It is four checks and it costs nothing, and it resolves almost every uncertainty you will have about a new client.

• What the posting itself shows. There is no client profile here with a hire history or a rating on it, so the brief is your evidence: specifics only someone with a real project would bother to write, a budget coherent with the scope, a deadline attached to something real. A thin posting is not itself proof of anything; a thin posting plus an unusual request is.
• Does the company exist, independently of what they told you? Search the company name on its own. A real business has a footprint that is not just the website they sent you — and if they claim to be a known company, check whether the email domain matches it rather than trusting the display name.
• Does the story hold together? A large company that cannot use a standard payment process, a hiring manager with a free email address, an “agency” whose staff photographs appear elsewhere. One inconsistency is worth a question; three are an answer.
• A reverse image check on the portfolio or profile photo. Thirty seconds, and it catches stolen identities and lifted portfolios more often than you would expect.

Then apply one final test, which catches things the checks miss: ask a specific question that only a real client could answer — about their existing system, their customers, the decision they are trying to make. Someone running a script will deflect, answer vaguely or pivot back to the urgency. Someone with a real project will answer, often at length, because it is their project and they have been thinking about it.

Staying on the platform is the protection, not a rule you are humouring

It is easy to read “keep everything on the platform” as a commercial preference dressed up as safety advice. It is worth understanding why it is actually the mechanism, because that understanding is what makes you decline confidently rather than apologetically.

Four separate protections exist only inside the platform, and they are exactly the four that a scam needs removed. A funded milestone is a dated, itemised commitment from a named account to pay a stated amount for a stated deliverable. Be precise about what that is: on LanceGuru today it records the commitment rather than collecting the money into a provider-held balance, so it is strong evidence rather than cash in a vault — the detail is in milestone payments and escrow for clients. As evidence it still defeats the payment-screenshot trick, because you are reading your own project instead of a picture somebody sent you. The message record is what a dispute is decided on, and a conversation moved to a private chat simply does not exist for that purpose — the sequence of funding, delivery and release is on how it works. The dispute process gives you somewhere to go that is not a lawyer. And the report route is the one thing that reaches past your own project: a reported posting or account goes to a moderator who can suspend it, which is how the same person is stopped from doing this to the next freelancer. Note what is not on that list — there is no client rating or hire history here for a bad client to carry, so reporting is the mechanism, not reputation.

So the correct response to “let us handle this directly” is not suspicion of the person; it is a statement of how you work. “I keep all my projects and payments on the platform — it is how my records and my protection work. Happy to continue here.” A real client will shrug and carry on, because they lose nothing. Only one kind of client argues.

The first hour after you realise

If you are here, act in this order. The sequence matters because evidence disappears — accounts get deleted, messages get withdrawn, profiles vanish — and the first ten minutes are when it is still there.

1. Stop working immediately. Not after finishing the current piece. Every additional hour is a loss you are choosing, and there is no version of this where continuing improves the outcome.
2. Send nothing else. No more files, no more money, no documents, no credentials. If you have shared account access, revoke it now.
3. Preserve the evidence before anything else. Screenshot the whole conversation, the profile, the posting and any payment claims, with dates visible. Save copies of what you delivered. Do this first, because a scammer's next move is usually to delete the account.
4. If money left your account, tell your bank now. Reversal, where it is possible at all, depends on speed. Do not wait until you have finished investigating.
5. Report it through the platform. The report form asks you to pick a reason and describe what happened in your own words — it takes text, not file attachments, so write the account name, the dates and what was requested, and keep your screenshots where you can produce them if support asks. The help centre is the route in, and you can contact support from there.
6. Write down what happened while it is fresh: dates, what was said, what you sent. You will need it if there is any follow-up, and memory degrades fast under embarrassment.

Report it properly, so the next freelancer is not next

A surprising number of people work out that something was a scam, feel foolish, and quietly move on without reporting it. That reaction is understandable and it is the reason the same accounts keep operating.

Report it with specifics rather than a complaint. State the account, the dates and what was requested, and quote the actual words where you can — the details box takes about a thousand characters, so you have room for the facts but not for the whole story, and a report with specifics in it can be acted on while “this person is a scammer” cannot. Include the pattern you recognised, because that is what lets the same behaviour be spotted on other accounts. And report the near misses too, the ones where you noticed in time and lost nothing: those are often the most useful, because the account is still active and still approaching other people.

If money was actually taken, a bank complaint and a report to the national cybercrime channels are separate from the platform report and worth making. Keep the reference numbers with your notes.

Recovering, and the one habit that prevents a repeat

Being targeted is not evidence that you are naive. These patterns work on experienced people, because they are engineered to arrive at the moment you most want the work — a thin month, a slow week, a budget that would fix something. Sensible people get caught by well-designed pressure, and the useful response is a process change rather than a resolution to be more careful, because carefulness fades and process does not.

The habit is one sentence: nothing of value leaves my hands before the milestone is funded — before, that is, the commitment for it exists on the record with a date on it. No files, no working code, no final drafts, no access — nothing. Not as distrust, but as your standard way of working, applied identically to everyone so you never have to make a judgement call about a particular person under pressure. Put it in your scope of work alongside the rest of what a project should name, as set out in the freelance contract and scope of work checklist, and state it plainly at kick-off. Clients who have worked with freelancers before will recognise it as professionalism.

Two supporting habits make it durable. Invoice properly and keep the paper trail, because a clean record of what was agreed and what was delivered is both a deterrent and your evidence if anything goes wrong — the format is in freelance invoicing and payment terms in India. And give yourself the right to a delay: “let me look at this properly and come back to you tomorrow” costs you nothing on a real project and defeats nearly every scam, because urgency is the one ingredient none of them can do without.

The takeaway: every one of these attacks the same moment — the handoff, before either side is secured — so you do not need to recognise seven scams, only pressure to move first outside any structure that protects you. A client never needs money from you, never needs your passwords or OTPs, and never needs work of real value before a milestone is funded. Verify in five minutes, treat a payment screenshot as a picture rather than a fact, and keep the conversation and the money on the platform because that is where the milestone commitment, the message record and the dispute route live. If it has already happened: stop, preserve the evidence first, call your bank if money moved, then report it with specifics.