Staying safe on Open Lance
The scams that actually target marketplaces like this one, how to recognise them, why moving work or payment off-platform removes every protection you have, and how to report someone. Written from what genuinely happens rather than generic advice.
Most people on Open Lance are exactly who they say they are. A small number are not, and they use a small number of techniques over and over. Recognising them takes about ten minutes of reading, which is a good trade against the cost of not recognising them.
The one rule that matters most
Keep the work and the money on the platform.
Almost every serious loss on any marketplace traces back to a conversation that moved to a private channel and a payment that moved outside escrow. It is worth being precise about what you give up, because the pitch for going off-platform is always "we will both save the fee".
Off-platform there is no escrow, so nobody is holding the money and nobody is obliged to release it. There is no dispute process and no mediation. There is no record we can examine, because we never saw it. There are no reviews and no reputation, so the work does nothing for your future. And it breaches the terms both of you agreed to, which puts your account at risk.
The fee is what buys the guarantee. Without the fee, there is no guarantee. Anyone pressing you to skip it is asking you to hand over the only protection you have — and that is true whether they intend to defraud you or not, because good intentions do not recover money when a project goes wrong.
The scams that actually happen
"Let us talk on WhatsApp instead." Sometimes innocent, often the first move. The reason to move you is that the platform cannot see a private channel: no evidence, no record, no protection. Keep it in Open Lance messages until there is a funded contract, and even then keep anything that matters in writing on the platform.
Payment before the work is funded. A freelancer is asked to start "while the funding goes through". The funding never goes through. If it is not funded, do not start. There is no exception to this that ends well.
Overpayment and refund. A client sends more than agreed, then asks for the difference back through some other channel. The original payment is later reversed, and you have sent real money against a payment that evaporated. This works because the reversal arrives weeks after the refund. Never refund anything outside the platform.
The advance fee. You are asked to pay something to unlock a job, a bonus, a verification, or a payout. Open Lance never asks for a payment to release money you have earned. Nobody legitimate does.
Credential phishing. A message or email that looks like Open Lance asks you to sign in, and the link goes somewhere that is not Open Lance. Check the address bar. Nobody at Open Lance will ever ask for your password, a two-factor code or a backup code, in a ticket, in a message, or on a call. Anyone who does is attacking you.
Scope that grows quietly. Not fraud exactly, but the most common way people lose money honestly. Work drifts past what was agreed, one small request at a time, and nobody wants to be difficult about it. Fund additional work as additional milestones. "While you are in there, could you also..." is the phrase to watch for.
The test task that is the actual job. A large unpaid sample, or several candidates each given a different section of one real project. A test should be small and it should not be shippable.
For freelancers specifically
Do not start before escrow is funded. Not for a small job, not for someone who seems trustworthy, not because they have a deadline. The funding takes a client two minutes; a client unwilling to spend two minutes is telling you something.
Be careful with files and links from people you have not contracted with. Attachments in an unsolicited message are a delivery mechanism for malware.
Treat a client who will not use the platform's own tools as a warning. Someone who wants messages elsewhere, payment elsewhere and files elsewhere is removing every trace of the engagement.
And do not let anyone else use your account. Selling or renting an account, or "working under" someone else's, ends the account and puts your earnings at risk.
For clients specifically
Look at the profile before the proposal. Verification level, completed work, reviews. A well-written proposal from an account with no history is a well-written proposal from an unknown.
Be suspicious of a price far below everything else. Occasionally it is somebody building a reputation. More often it is someone who will disappear, or who is not the person who wrote the proposal.
Use milestones for anything substantial. Fund a first stage, look at real output, then commit further. Milestones are exactly the mechanism for not betting the whole project on a first impression.
Never share credentials to your systems in plain text in a message. If a freelancer needs access, use a proper secrets tool and give the narrowest access that works.
Reporting someone
If something is wrong, report it. Reports are read.
There is a report action on profiles, jobs and Drop-Ins, and you can report from within a conversation. Say what happened and reference the specific job, contract or message. Concrete reports are actionable; vague ones are hard to do anything with.
You can also report through a support ticket, which is the better route if it is complicated or involves money.
What happens next. A person reviews it. Depending on what is found, the outcome ranges from a warning through to a restriction or removal. You will not usually be told the specific outcome for the other person, because that is their account and not yours — that is not indifference, it is the same privacy that applies to you.
If you are in an active contract with someone you have reported, do not simply abandon it. Say so in the report, and if money is involved raise a dispute so escrow is frozen while it is looked at.
If you have already been caught by something
Act quickly, in this order.
- Stop. Send nothing further, pay nothing further.
- Change your password, and enable two-factor if it is not already on.
- Open a support ticket with everything you have: names, references, amounts, dates, screenshots.
- If money left the platform, contact your bank as well. We cannot recover a payment we never held, but your bank sometimes can if you are fast.
- If money is still in escrow, raise a dispute. Escrow freezes immediately and nothing moves while it is reviewed.
There is no penalty for reporting that you were caught by something, and nobody will lecture you. These techniques work on careful people; that is why they persist.
Recognising a phishing message
Attacks by email are the most common way accounts are lost, and they are getting better rather than worse. A few things that reliably distinguish them:
Check the address bar, not the message. A message can look exactly like ours. The address of the page you end up on cannot be faked. Before typing a password, look at the domain.
Be suspicious of urgency. "Your account will be closed in 24 hours", "unusual activity, confirm now", "your payment failed, update immediately". Urgency is manufactured to stop you thinking. Nothing on Open Lance genuinely requires you to act within minutes.
Go to the site directly. If a message says something needs attention, do not click the link. Open the site yourself and look. If it is real, it is there.
Nobody will ever ask for a code. Not a two-factor code, not a backup code, not a password. Not by email, not in a ticket, not on a call. There is no exception and no circumstance where this is legitimate.
Protecting your account
Two-factor authentication, on both Open Lance and your email account. Your email is the master key to everything, and it is frequently the least protected thing people own. See Two-factor authentication.
A unique password. Password reuse is how a breach on an unrelated site becomes a problem here. A password manager solves this permanently.
Do not share your login. If you need somebody working on your behalf, use a bidder seat, which gives them their own credentials and keeps your money out of reach. See Bidders: letting someone bid on your behalf.
Watch your security emails. Notifications about new sign-ins and changed settings cannot be switched off, precisely so that an attacker cannot silence them. If one arrives that you did not cause, act immediately.
Why we care about off-platform work
It would be easy to read the rule about keeping work on the platform as being purely about fees. It is worth explaining the other half.
Every protection described in this help centre — escrow, mediation, auto-approval, dispute evidence, reviews, the ability to recover money when somebody disappears — operates on records the platform holds. Take the engagement outside and none of it applies, because none of it can.
The people who suffer most from off-platform arrangements are not the platform. They are the freelancer who delivered and was not paid, and the client who paid and received nothing. In both cases the answer to "can you help" is that we cannot, because there is nothing to look at.
Related
Did this answer your question?
Did this not answer it?
Open a ticket and a person will read it. You do not need an account.