How to Check Whether a Brand Collaboration Email Is Real

To check whether a brand collaboration email is real, pause before opening files or following links. Compare the sender’s full address with the brand’s official domain, verify the named person through an independent channel, inspect the commercial request for inconsistencies and refuse any request for passwords, remote access, gift cards, cryptocurrency or advance payment. A convincing logo or familiar brand name is not proof.

Real outreach can come from a brand, agency, talent platform or freelance campaign manager, so an unfamiliar domain is not automatically fraudulent. The safe approach is to verify the relationship without using the contact details supplied in a suspicious message.

Start with the complete sender address

Expand the sender details instead of reading only the display name. Scammers can make a message appear to come from “Brand Partnerships” while sending from an unrelated address or a misspelled domain.

Check:

• the characters before and after the @ symbol;
• extra words, hyphens or substituted letters in the domain;
• whether the reply-to address differs from the visible sender;
• whether the domain has a credible website and established business identity;
• whether an agency domain can be connected independently to the campaign or brand.

A free email address can be legitimate for a small company, but it deserves additional checking. Equally, a professional-looking domain can be registered by a scammer. Treat the address as one signal, not a final verdict.

Check authentication without over-trusting it

Email authentication can help show whether a sending system was authorised to use a domain. Gmail’s current phishing guidance recommends checking whether the sender name and address match, whether the message is authenticated and whether hovered link destinations match their descriptions.

In Gmail on a computer, open the sender details beneath the name. Depending on the message, you may see “mailed by” or “signed by” information. More technical users can inspect message headers for SPF, DKIM and DMARC results.

Authentication is not a guarantee that the business proposition is genuine. A scammer can authenticate a domain they control, and forwarded mail can complicate results. Use it alongside independent identity and campaign verification.

Verify the person outside the email thread

Do not use the phone number, booking link or support address in a suspicious message as your only check. Find the organisation through a source you already trust:

1. Type the official brand website address yourself or locate its verified public profile.
2. Find the partnership, marketing or general contact details published there.
3. Ask whether the named person, agency and campaign are genuine.
4. If an agency is involved, contact the agency through its independently located website too.
5. Keep the confirmation with the campaign record.

The US Federal Trade Commission advises people who receive a possibly legitimate but unexpected message to contact the organisation using a phone number, email address or website known to be real. Its current phishing guidance also warns against clicking links or downloading attachments in unexpected messages while checking them.

If you need to locate an appropriate contact, use the process in how to find brand contacts for sponsorships rather than replying blindly.

Read the offer for commercial inconsistencies

A fake proposal often uses excitement and urgency to prevent scrutiny. Watch for a combination of warning signs:

• high payment for vague or minimal work;
• generic praise that does not identify any real content;
• a demand to act immediately or keep the deal secret;
• poorly matched products, markets or campaign dates;
• conflicting names, currencies or companies within the thread;
• a contract entity that does not match the sender or stated brand;
• requests to move instantly to an encrypted chat without a business reason;
• refusal to answer basic questions about deliverables and usage;
• a payment process involving gift cards, cryptocurrency or sending money back.

The FTC’s business impersonator guidance describes messages that appear to come from a familiar business but seek money or personal information. No honest sponsor needs a creator to buy gift cards or wire money to unlock a collaboration payment.

Do not run “campaign software” from an attachment

A brand may legitimately share a brief, contract, images or product information. The danger is an unexpected executable file, password-protected archive or download that asks you to install software, disable security controls or sign into an unfamiliar page.

Before opening anything:

• verify the sender and campaign independently;
• ask for a standard PDF or established document-sharing link;
• check the true file extension;
• do not enable macros or bypass a browser or operating-system warning;
• use current device and security software;
• avoid entering credentials after following an unexpected link.

If a legitimate company requires a specialist platform, reach it from the company’s independently verified website or app listing. Do not trust a download simply because the email describes it as a media kit, campaign viewer or payment portal.

Protect financial and identity information

Creators may eventually need to provide a legal name, address, invoice, bank details or tax form. That does not mean those details belong in the first reply.

Confirm the contracting entity and secure onboarding method first. Ask why each item is required and who stores it. A legitimate payer may use a recognised procurement portal, but you should still reach it through a verified route and check the domain before entering information.

Never provide:

• an email or social-media password;
• a two-factor authentication code;
• backup recovery codes;
• remote access to your computer or phone;
• a card payment to “release” sponsor funds;
• money returned from an overpayment before the original payment is irrevocably cleared.

Check the contract entity and payment path

Once the contact is verified, review the proposal as a commercial agreement. The brand name used in the content may differ from the agency or legal entity paying the invoice, but the relationship should be explainable in writing.

Confirm:

• the legal contracting and billing entities;
• the campaign contact and finance contact;
• deliverables, dates and approval process;
• the exact fee and currency;
• payment milestones and due date;
• usage rights and exclusivity;
• cancellation terms;
• the secure method for invoicing and payment information.

Use the creator sponsorship contract checklist after the authenticity check. A real sender can still offer poor terms, while a polished contract can still be part of a scam.

A safe verification reply

Thanks for reaching out. Before opening campaign files or sharing onboarding details, I verify new partnerships through independently published company contacts. Could you confirm the legal company or agency name, your role, the campaign name and the brand contact who can verify the engagement? Once confirmed, I can review the brief and proposed deliverables.

You do not need to accuse the sender. A genuine professional should understand a reasonable verification process. If the sender becomes aggressive, refuses basic identification or increases the urgency, stop engaging.

If you already clicked or shared information

Act promptly. Disconnect from the suspicious interaction, change affected passwords using the real service website, enable multi-factor authentication and review active sessions and recovery details. Contact your bank or payment provider immediately if financial information or money is involved.

Report the message through your email provider. The FTC directs US consumers to report phishing attempts at ReportFraud.ftc.gov. Creators outside the US should use the relevant national cybercrime or fraud-reporting service as well.

Brand collaboration email verification checklist

• The complete sender and reply-to addresses have been inspected.
• The domain spelling matches the verified organisation.
• Email authentication is checked where available.
• The person, agency and campaign are confirmed independently.
• No suspicious link or attachment was used during verification.
• The offer has clear deliverables, dates, entity and payment terms.
• No password, authentication code or remote access is requested.
• No advance payment, gift card, crypto transfer or refund is required.
• Sensitive onboarding details use a verified secure route.
• The final agreement has been reviewed for wider brand-deal red flags.

Try Olurai

Olurai helps creators organise relevant sponsor opportunities and outreach. Try Olurai and build a more consistent sponsorship workflow.