Portfolio theft is the commonest fraud in remote commissioning. Four checks that take ten minutes, and a payment structure that makes it not worth attempting.
6 minute readThe commonest fraud in remote commissioning is not bad work. It is a person who takes someone else's portfolio, wins a job with it, collects a deposit, and disappears. It is cheap to attempt, it scales, and the people running it are practised — the messages are polite, the quote is reasonable, and nothing feels wrong until the money is gone.
Four checks. They take about ten minutes, and they defeat almost every version of this.
This is why in production exists as a state. A live link is checkable in a way a screenshot never is. Open it and look for evidence of the person: a credit line, an about page, a byline, a footer, a commit history, a colophon, an App Store developer name.
If nothing on the live thing connects to them, that is not proof of theft — plenty of good work is uncredited — but it means the claim rests on their word, and you should get corroboration elsewhere before money moves.
For work marked built, the images are the evidence, and images are easier to copy than a live site. Weight it accordingly: a page of nothing but built work from someone you have never spoken to deserves more checking, not less.
Thirty seconds each. Drop the images into Google Images or TinEye and see where else they appear. You are looking for the same visuals under a different name, on an agency site, or in a template marketplace. Stolen portfolios are usually stolen wholesale from one source, so if a piece traces back to someone else, check the rest.
A hit is not automatically damning — a maker's own work legitimately appears on their client's site, on their studio's site and on an awards page. What matters is whether the other appearances are consistent with the story they told you.
The most reliable test, and it costs one email:
On the Northbeam pricing page — what was the hardest thing to get right, and what did you try before the version that shipped?
Someone who made it answers with a specific constraint and a specific dead end. Someone who stole it answers about collaboration, passion and attention to detail, or gives a plausible-sounding account with nothing falsifiable in it. Ask a follow-up about the detail they gave. Fabrications get thinner under a second question; real memories get richer.
A five-minute video call does the same job faster. Someone using another person's work will usually avoid one, and the avoidance itself is the answer.
Look for a history that predates your conversation. A domain that has existed for years, a professional profile with a timeline, work discussed publicly, colleagues who reference them. An identity assembled last month is the single strongest warning sign there is.
Where the money goes matters too. An invoice from a name that does not match the person you have been speaking to, or a bank in a country with no connection to anything they have told you, deserves a direct question before you pay. There are innocent explanations. Ask for one.
Verification reduces the risk; payment structure removes most of what is left. The whole scam depends on getting a large deposit before producing anything.
Fraud runs on urgency, because urgency stops people checking. Watch for a discount that expires today, a claim that another client is about to take the slot, a push to settle before a call can be arranged, or a sudden change of payment details late in the process — including an email that looks like the one you were using, with one character different.
A real maker who is genuinely busy will tell you they are busy. They will not need you to decide inside an hour.
Report it to your payment provider immediately — card and PayPal disputes have time limits and both are far more effective within days than weeks. Keep every message. Tell the maker whose work was stolen, who almost certainly does not know and would very much like to. And send us the page at [email protected] with the links: work claimed by someone who did not make it is the one thing this site cannot tolerate, and we would rather hear about it late than not at all.
Almost everyone you write to here is exactly who they say they are, and treating a stranger as a suspect is a poor way to start a working relationship. The point of these checks is not suspicion — it is that doing them takes ten minutes and lets you stop worrying, so the rest of the conversation can be about the work.