Fake Freelance Client Scams: Payment and File-Sharing Red Flags

5 min read ScamSense Team Updated October 23, 2026

Freelancers have a problem employees don’t: the client is usually a stranger, the work is delivered remotely, and getting paid depends on trust. Fraudsters exploit that with fake clients who pay you with a bad cheque, steer you off a platform, or send “project files” that are really malware. This guide covers the two points where freelancers lose out: payments and files.

Quick answer: Keep the client and the payment on a platform with escrow or contract protection, never send money or “deposits” to get work, refuse overpayments and requests to forward the difference, and open client files only in a safe way (not an executable, not a macro-enabled document, not a link to install software). If a new client pushes you off-platform, to a chat app, or to speed, treat that as the warning.

This is not about fake job offers for employees; for that see Fake Job Scams.

Payment Red Flags

Overpayment and “send back the difference”

The client sends a cheque, bank transfer or payment-app payment for more than the agreed fee, says it was a mistake, and asks you to refund the surplus, or to pay a third-party “vendor” from it. Days later the original payment bounces or is reversed, and your refund is gone. Don’t send anything back until funds have fully and finally cleared, and be aware that a deposit showing in your account doesn’t always mean the money is yours to spend.

Pay-to-start

The “client” asks you to pay for software, a licence, training, a background check or equipment (sometimes promising reimbursement) before the job starts. Genuine clients pay you; they don’t ask you to fund the project.

Fake escrow and fake payment proof

The client says funds are held in escrow on a website they send you, and that you must pay a fee to release them. Or they send a screenshot of a payment. See Fake Payment Screenshots: proof is only your own account.

Off-platform payment pressure

Moving from the freelance platform to email, a chat app or a personal bank transfer removes your protection and gives them a reason to ask for unusual payment methods.

Payment in tokens or crypto

Be cautious about unfamiliar payment in tokens, especially to a wallet or “exchange” the client chooses, and about requests to receive and forward crypto.

File-Sharing Red Flags

A “brief” delivered as a program, installer, ISO or compressed archive (.exe, .msi, .scr, .iso, password-protected .zip) rather than a plain document
A document that asks you to “enable macros,” “enable editing” or sign in with your email to view it
A link to a file-sharing page that asks you to log in with your email password or to install a viewer
A coding “test project” with a repository you are told to run on your own machine, particularly if it asks you to install packages from unfamiliar sources or runs scripts on start
A demand to install screen-sharing or time-tracking software with remote control before any contract exists
A request for passwords, wallet seed phrases or access to your payment account

A safer approach is to open unfamiliar files in a sandbox or virtual machine, check them with a security scanner, or ask for a plain PDF or text brief. Run unknown code only in a disposable environment, never on the machine holding your client work, banking and wallet. If you opened a file and now doubt it, see What to Do If You Installed a Suspicious App and What to Do After Giving Remote Access.

Illustrative scenario — fictional, names and details are invented

Dana, a freelance designer, is contacted on a chat app by “a marketing manager” who wants a logo. The client sends a bank cheque for $4,000 instead of the agreed $1,200, apologises, and asks her to wire back $2,800 and pay a courier for “brand materials.”

Dana pauses. She tells the client she will release work and refund only after the funds have cleared through her bank, and suggests using an escrow-protected platform. The client pushes for speed, then goes quiet. The cheque, she later learns, would have bounced after she sent the refund.

What mattered: she didn’t treat a deposit as final money, and the client refused a protected payment route.

How to Protect Yourself

Vet the client. Check the company name, website domain age, staff profiles and whether the contact reached out to you in a way that matches their story. Reverse-search profile photos and check the platform’s verified-payment badge.
Use contracts and milestones. Agree scope, price, payment schedule and ownership in writing. Break work into milestones and deliver watermarked or low-resolution drafts until payment clears.
Prefer protected payment. Use platform escrow, a regulated invoicing service or card payments you can trace. Require a deposit paid by the client to you, not from you to anyone.
Refuse overpayments. If paid too much, ask the client to cancel and re-issue the correct amount through the original route. Don’t forward money.
Handle files safely. Ask for a plain document, scan attachments and links, avoid macros and installers, and run unknown code only in an isolated environment.
Keep communication traceable. Stay on the platform or on email you can archive, and keep copies of the brief, agreements and payment records.

If You Already Sent Money or Opened a File

For money, call your bank at once and ask about recalling the transfer, then report to your national cybercrime service (cybercrime.gov.in and 1930 in India, reportfraud.ftc.gov in the United States). For a file you opened, disconnect the device and follow the steps for installed apps and remote access. Report the client to the platform, keep the messages and files as evidence (see preserving evidence), and use the first-hour checklist. Ignore anyone offering to “recover” the money for a fee.

Key Takeaways

Keep work and payment on a protected platform; an off-platform push is a red flag.
Never refund an overpayment or pay to get work.
Treat installers, macros and unknown code in “project files” as dangerous.
A deposit showing in your account isn’t always final money.

Contacted by a new client you can’t verify?

Paste their message or a screenshot into ScamSense for a risk assessment before you reply or open files. It is an extra check, not a guarantee.

Start 3-Day Free Trial

Frequently Asked Questions

What is a client overpayment scam?

The client pays more than agreed, then asks you to refund the difference or pay a third party. The original payment later fails or is reversed, leaving you out of pocket.

Is it safe to accept payment outside the platform?

It removes the platform’s protection and is a common scam tactic. Keep payment on a protected platform or use a traceable, regulated route with a written contract.

How can I open client files safely?

Ask for a plain document, scan files and links, avoid macros, installers and archives you didn’t expect, and run unknown code only in an isolated environment.

A client wants me to pay for software before I start. Is this normal?

It is a red flag. Legitimate clients provide tools or pay you. Don’t pay to get work, even if they promise reimbursement.

Does a payment appearing in my account mean it is final?

Not always. Cheques, some transfers and card payments can bounce or be reversed. Wait for funds to clear fully before spending or refunding anything.

Note: This guide is general information, not legal or financial advice. Procedures, deadlines and refund rights differ by country, bank and payment method. Always use contact details from your bank’s official app, website or the back of your card. ScamSense helps you assess suspicious content but cannot guarantee that any message, link or caller is safe or unsafe.