Skip to content
Crewvale

The Crewvale Journal

Safety

Keeping your account secure When you work with an agency

Your email, your passwords and your payout details should stay yours, even when an agency runs your account. Here is how to set things up safely.

When you work with an agency, your email, your passwords, your sign-in codes and your payout details should stay under your control. Give the agency the least access it needs to do its job, through team or limited access where the platform offers it, and never before you have a signed agreement. Then you can take your account back at any time.

In short

  • Keep the email address on your accounts in your name, with a password only you know.
  • Use a different long password for every account, stored in a password manager.
  • Turn on two-step verification, with codes going to your phone or app only.
  • Prefer team or limited access to sharing your password, where the platform offers it.
  • Keep payouts going to an account in your name, and never let anyone else change them.
  • Change passwords and sign out other devices whenever someone leaves.

Should you give an agency your password?

Not before you have a signed agreement you are comfortable with. Even then, ask whether the agency can work through team or limited access instead of your password.

A password gives someone everything you can do on the account. Limited access gives them only the parts their job needs. If the platform doesn’t offer limited access and you decide to share a password, agree in writing who uses it, what for and how it is handed back.

Check the terms of each platform before you share a login. OnlyFans’ terms say that if someone else helps you run your account, your own legal responsibility doesn’t change.

How do you make passwords strong enough?

Use a different password for every account. Then one leaked password can’t open the others.

Make each one long. The US Cybersecurity and Infrastructure Security Agency (CISA) recommends at least 16 characters. The UK National Cyber Security Centre (NCSC) suggests three random words, which are long and easy to remember.

Use a password manager. Both CISA and the NCSC recommend one to create and remember your passwords, rather than writing them down or reusing them.

Why does two-step verification matter?

Two-step verification asks for a second check, such as a code, when someone signs in. The NCSC says it helps keep criminals out of your accounts even if they know your password.

Turn it on for every account that offers it. CISA gives the same advice. Start with your email, your platform accounts, your bank and your social media.

Codes can come by text message, from an authenticator app or from a security key. An authenticator app makes a new code every 30 seconds, according to CISA.

Who gets the codes matters as much as the codes themselves. If the codes go to an agency’s phone, the agency can sign in without you. Keep them on your own phone or app.

Why is your email the most important account?

Your email can reset the password on almost everything else. The NCSC warns that criminals can use your email to get into many of your personal accounts.

So:

  • use an email address in your own name for your platform accounts, not one the agency created;
  • give it its own password and two-step verification;
  • set a recovery phone number and recovery email that are yours. Your email provider’s account help advises a recovery phone that belongs only to you;
  • don’t give an agency your email password. If it needs to send you things, it can write to you.

Can an agency work without your password?

Sometimes. Some platforms let you give other people limited access to parts of your account, so you don’t share your password at all.

Fansly has “Management Sessions”: you create a link with the permissions you choose, and payouts and closing the account are always excluded. You can remove a session from the Management page of your creator dashboard. On Fanvue, a manager account can’t reach payouts, change your email or password, or delete your account, and you invite it from Settings, Management. OnlyFans’ terms describe no team access, so on OnlyFans any access an agency has goes through your own login. Keep two-factor authentication on, and change your password when you stop working together.

Where limited access exists:

  • give each person their own access, not one shared login;
  • give only what their job needs;
  • keep payouts and account settings with you;
  • remove the access the day their work for you ends.

How do you keep payouts safe?

Your payout details decide where your money goes. Keep them in your name, and change them only yourself.

  • Make sure the bank or payment account on the platform is yours.
  • Turn on any alerts the platform offers for payout or security changes.
  • If your payout details change without you, change your passwords straight away and contact the platform’s support.

Every agency on Crewvale says how you are paid: whether the platform pays you directly or the agency pays you. If the agency pays you, ask for a statement each time.

What about your phone and computer?

  • Install updates. The NCSC says updates contain vital fixes that protect your devices from criminals.
  • Lock your phone and computer with a PIN, password or fingerprint.
  • Check which devices are signed in to your accounts. Your email provider’s account help shows you how to see them and sign out the ones you don’t own.
  • Back up your content somewhere only you control. The NCSC recommends backing up your most important data.

How do you spot phishing?

CISA lists phishing among its four core steps: avoid it and report it.

Be careful with any message that asks for your password, a sign-in code or a payment, or that pushes you to act now. That includes messages that seem to come from the platform or from your agency.

Never share a sign-in code with anyone. If you aren’t sure a message is real, go to the platform yourself, not through a link in the message.

What should you do when you leave an agency?

On the day your agreement ends:

  • change your email password first, then each platform password;
  • move two-step verification to your own phone or app;
  • remove any team or manager access;
  • sign out every device and app you don’t recognise;
  • check email filters and forwarding rules.

Our guide to leaving an OnlyFans agency covers notice, account ownership and what to do if an agency won’t hand your account back.

What if you think your account has been taken over?

The NCSC’s steps for recovering a hacked account:

  • go to the provider’s help or support pages, because each service works differently;
  • change the password, and any other account that uses the same one;
  • check email filters and forwarding rules;
  • log all devices and apps out;
  • set up two-step verification.

If you lost money, tell your bank or payment service straight away.

How does this work on Crewvale?

Crewvale is a free marketplace where creators and cam models compare OnlyFans and webcam agencies on their published terms. Account ownership is one of the six terms every agency publishes. Check that it says your accounts, logins and email stay yours.

Every agency on Crewvale has agreed to contact creators only after they accept an introduction, and never to ask for account logins before a signed agreement. Never share passwords, logins or payment details in messages to an agency you haven’t checked.

You can hide from agencies in your own country and block any agency. If something looks wrong, report a concern. The Crewvale team reviews every report.

Read more about staying safe on Crewvale.

Sources

All read on 18 October 2026.

Last reviewed: 18 October 2026.