ScamsChapter 3
Case files
Scam patterns told as case files, from the first message to what it costs you. None of them is a real person or a real event, and each one ends with what to do.
- Entry
- X3
- Category
- Scams
- Checked
- Reading
- 9 min
- Sections
- 9
Evidence
This chapter is not advice for your situation.
In 30 seconds
- A case file follows one scam from the first message to what it costs and how to get out.
- No case here is a real person or a single real event. Each one is a pattern, rebuilt so nobody can be recognised.
- Most of the harm comes through keys, payment routes and tools, more than from one villain.
- A password, a login code or remote control of your device is never part of the game.
- If you already sent, stop, keep the proof and tell someone you trust.
You will learn
- The six questions every case file answers.
- The verification fee, from the first message to the account vanishing.
- Why a promise never makes it safe to give someone a key to your accounts.
- Why a payment route that isn’t yours can take a balance down with it.
- What to think about before you post a warning about anyone.
A case file is a story with the names taken out. I tell each one from the side of the person who gets the message, because that’s the only place you can still refuse it. Read them once, calmly, and you’ll recognise the real thing the day it shows up.
Vivian
How to read a case file
Every case file answers the same six questions: what it looks like, who it targets, why it works, what it costs, what to do, and where to report it. Use them on any offer, even one that isn’t in this chapter.
No case here describes a real person or a single real event. Each one is a pattern, rebuilt from its parts. Vivian’s field notesFirst-hand experience, not a study. Press describes the scene as flooded with scammers who use stolen photos. ReportedStated by a serious secondary source read in full.Financial Domination Has a Scamming Problem (opens in a new tab) Accessed 3 November 2026. The authors of a published study flag fraud, identity fraud included, as a risk that’s still there. VerifiedChecked against the original source.Findommes, Cybermediated Sex Work, and Rinsing (McCracken and Brooks-Gordon, Sexuality Research and Social Policy 18(4), 837-854, DOI 10.1007/s13178-021-00609-3) (opens in a new tab) Accessed 3 November 2026. One victim quoted in the press said the emotional hurt outweighed the financial loss. ReportedStated by a serious secondary source read in full.Financial Domination Has a Scamming Problem (opens in a new tab) Accessed 3 November 2026.
Case 1: the verification fee
How it starts. A new account writes to you first, with flattering words and a set of images that look expensive. In 2DFD the images may be stolen or generated art, so quality tells you nothing about who runs the account. Vivian’s field notesFirst-hand experience, not a study. Press reports fake accounts that reply to subs who post about findom and ask them to send a direct message. ReportedStated by a serious secondary source read in full.The Curse of the Fake Financial Dominatrix (opens in a new tab) Accessed 3 November 2026.
How it works (invented example)
Contact
The account writes first and moves fast.
The hook
“I only take serious subs.”
The fee
“Pay a verification fee to prove you’re real.”
The vanish
The account blocks you, or asks for a second fee.
Who it targets. New subs, and anyone who’s just posted that they want a dom. The scam is easy for anyone to start. ReportedStated by a serious secondary source read in full.Financial Domination Has a Scamming Problem (opens in a new tab) Accessed 3 November 2026.
Why it works. A fee to prove you’re real proves nothing, because nobody can check what it was for. It plays on wanting to be accepted and on the fear of missing your chance. Vivian’s field notesFirst-hand experience, not a study. Some real dommes also ask for payment first, to keep time-wasters away. ReportedStated by a serious secondary source read in full.Financial Domination Has a Scamming Problem (opens in a new tab) Accessed 3 November 2026. The warning sign is a payment whose only purpose is to prove you’re serious, in a form that’s hard to reverse.
What it costs. The first fee, then a second ask under another name: insurance, an unlock fee, refund processing. Gift cards and crypto are hard to reverse once the funds are used. A card issuer, a bank or a gift-card company can sometimes block or reverse a payment that’s reported fast, so contact them right away. Vivian’s field notesFirst-hand experience, not a study.
Red flags
The tells
- Payment comes before any conversation, and it’s called proof of something.
- The fee is asked in gift cards or crypto, instead of through a platform that keeps a record.
- There’s a timer: now, or the offer is gone forever.
- Simple personal questions get no answer in the account’s own words.
Counter. Send nothing before a real conversation. A real dom can wait an hour. The full list is in Spot a fake dom.
Where to report. On the platform where you met the account, with the messages and receipts attached. The longer way back is in If you already sent.
If you already sent
Stop sending, even to “unlock a refund”.
Keep the messages and the payment receipts.
Contact your bank, card issuer or the gift-card company right away, and ask whether the payment can be blocked.
Report the account on the platform where you met.
Tell someone you trust what happened.
Case 2: the access request
How it starts. A dom asks for the login to a second social account, then for the code that arrives on your phone. Sometimes it’s a remote-desktop session. It’s framed as proof of loyalty or as the price of keeping the bond. Vivian’s field notesFirst-hand experience, not a study.
Why it works. It comes at an emotional moment, wrapped in reassurance. A spoken promise protects nothing, and a login code lets someone else take over the account on the spot. Vivian’s field notesFirst-hand experience, not a study. Public guidance tells people not to hand control of a computer or phone to a stranger. VerifiedChecked against the original source.IC3 Issues Alert on Tech Support Fraud (opens in a new tab) Accessed 3 November 2026. A remote-access vendor says the same about anyone you don’t know or trust. VerifiedChecked against the original source.TeamViewer and scamming (opens in a new tab) Accessed 3 November 2026. In 2DFD nobody knows who’s behind the character, so in that sense every dom is a stranger. Vivian’s field notesFirst-hand experience, not a study.
What it costs. The account, the private messages in it, and your name on whatever comes next. Shared logins take away the private space a sub needs to say no or to leave. Vivian’s field notesFirst-hand experience, not a study.
Spot the flags (invented example)
Tap every message that shows a red flag. There are three.
Example conversation. Invented for this exercise.
What to do. Refuse, offer nothing from your accounts, and state your own limit once. If the answer is more pressure, that’s your answer. Where to report. On the platform where you met the account, and to the account’s provider if you shared any code.
Case 3: the tool that says one thing and does another
How it starts. A page promises a one-click helper. Everything stays local, nothing is charged unless you switch on a special mode, updates are automatic. A page is a promise. What the tool really does is in the code. Vivian’s field notesFirst-hand experience, not a study.
Why it works. Most people read the page and skip the permissions. Chrome shows a permission warning at install. It also disables an extension after an update that adds a warning-level permission, until you accept it. VerifiedChecked against the original source.Permission warnings (Chrome for Developers, extensions documentation) (opens in a new tab) Accessed 3 November 2026. Read the permission list first. Check a tool before you install it shows how, and Fake tools shows the patterns.
A worked example, the other way round. A first reading of a tool can suggest the worst, and a full reading can show a smaller risk. A tool whose updater can replace any file, sitting next to login tokens on the same computer, could take everything with one update. That’s a different verdict from “malware”. Vivian’s field notesFirst-hand experience, not a study.
What it costs. Whatever the tool is allowed to reach: accounts and payments. Vivian’s field notesFirst-hand experience, not a study. What to do. Don’t install anything you can’t explain in one sentence. Where to report. To the store that distributes it.
Case 4: the payment route that isn’t yours
How it starts. A dom collects through a payment service. Some personas describe what they do falsely to a payment service, which breaks its terms and is why balances freeze. Or the platform that carries her wishlist loses its payment partner and shuts down. Either way, the money sits on a route someone else owns. Vivian’s field notesFirst-hand experience, not a study.
Why it matters to you. A payment service can close an account it finds was described falsely and hold the balance, and your payment goes with it. Terms differ from one service to the next, and they change. Anonymity ends where the money lands, because a payout is tied to a real identity. Vivian’s field notesFirst-hand experience, not a study.
Red flags
Signs that the route is shaky
- She asks you to describe your payment as something it isn’t.
- She pushes you to pay outside the platform’s visible route.
- She avoids plain words about money and about what a gift buys.
- She promises results a gift can’t buy.
Counter. Say what the payment is, in plain words. If a dom asks you to call it something else, stop. The wrong label can freeze her money and yours.
What it costs. A frozen balance and a trail tied to a real identity. Vivian’s field notesFirst-hand experience, not a study. Where to report. To the platform, if a dom asks you to mislabel a payment. A dom who needs a legitimate route should read Getting paid.
Case 5: three short patterns
| What they say or do | The counter |
|---|---|
| A friendly dom messages you privately and asks for “a small thing” the dom you serve mustn’t hear about | The secrecy is what makes it work. Keep one limit across everyone you pay, and tell the dom you serve. Vivian’s field notesFirst-hand experience, not a study. |
| Someone shows you a screenshot of a chat to make you doubt a dom | Anyone can edit the text of a web page and capture the result. Ask the dom directly, and don’t leave over a screenshot alone. Vivian’s field notesFirst-hand experience, not a study. |
| A stranger steers you to a private messaging app with an offer of cheap or free video | Stay on the platform where you met, ignore it and report it. Vivian’s field notesFirst-hand experience, not a study. |
Case 6: the click-to-post chain and the display account
How it starts. A chain of links drafts a post on your own account every time you click. The drafts escalate from a playful label to a confession to a payment announcement with a link. You’re the one who publishes the text, under your own identity. Vivian’s field notesFirst-hand experience, not a study.
A close cousin is the display account: a dom takes over a sub’s public account and turns it into a showcase of his sends. Handing over a social account means losing control of your own identity, whatever the game calls it. Vivian’s field notesFirst-hand experience, not a study.
Before you publish a draft that someone else wrote
Read the whole draft, all the way down.
Ask yourself whether you’d sign it with your own name a year from now.
Don’t publish from an account tied to your real identity.
Decline the next link in the chain. Saying no costs nothing.
Names, call-outs and proof
When you’ve been hurt, you may want to post a warning. A public warning can protect others, but weak evidence invites defamation claims, and the person you name may have nothing to do with it. Vivian’s field notesFirst-hand experience, not a study. There’s no foolproof way to screen out scammers. ReportedStated by a serious secondary source read in full.The Curse of the Fake Financial Dominatrix (opens in a new tab) Accessed 3 November 2026.
Myth
If I know the handle, I can say who’s behind the persona.
Fact
Linking a handle to a real person without that person’s own words is doxxingdoxTo expose someone’s real identity or address. It’s the main safety fear behind anonymity in the scene, so a request for a real name, or for a gift that needs a physical address, is a risk. It can hit the person behind a persona and the sub alike.. It also invites payback, like mass reports from accounts the other side controls. Vivian’s field notesFirst-hand experience, not a study.
A warning, or not
An account took a small amount from you and vanished. You have the messages. A friend is pushing you to post the account’s name and its images on a public thread tonight.
- The anger is fair, but the images may belong to a real person whose art or photos were stolen. You could name someone who had nothing to do with it. See Stolen art and persona theft.
- This protects others and keeps your evidence intact. Share the pattern privately with people you trust.
- You carry it alone and the platform can’t act. Tell at least one person you trust, and report it.
Six questions for any offer
| Ask | Why it matters |
|---|---|
| Can I trace the payment afterwards? | A route that keeps a record for both sides protects both. Gift cards and crypto are hard to reverse once the funds are used. |
| Did money come before conversation? | Some real doms do ask first. The warning sign is a payment called proof of something. |
| Is there a timer? | A timer is there to stop you thinking. Wait an hour, then a day. |
| Does it need a key to my life? | A password, a login code or remote access is never part of the game. |
| Would I sign this post with my own name? | If not, don’t publish it from your own account. |
| Does the tool do only what its page says? | Read the permissions before you install, and remove anything you can’t stop. |
Remember it
- A case file is a pattern. Use its six questions on any offer.
- A fee to prove you’re real proves nothing.
- A password, a login code or remote access is never part of the game.
- A payment route you don’t own can vanish with the balance.
- Read a draft before you publish it, and report before you accuse.
What you did.
Check it
Every claim with its evidence level and its sources.
Evidence levels
- Verified
- Checked against the original source.
- Reported
- Stated by a serious secondary source read in full.
- Community
- Widely said in the scene; no document proves it.
- Vivian’s field notes
- First-hand experience, not a study.
- Unverified
- Plausible, not proven yet.
Each one is a pattern, rebuilt from its parts.
Vivian’s field notesFirst-hand experience, not a study.
Press describes the scene as flooded with scammers who use stolen photos.
ReportedStated by a serious secondary source read in full.Financial Domination Has a Scamming Problem (opens in a new tab) Accessed 3 November 2026.Financial Domination Has a Scamming Problem (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
The authors of a published study flag fraud, identity fraud included, as a risk that’s still there.
VerifiedChecked against the original source.Findommes, Cybermediated Sex Work, and Rinsing (McCracken and Brooks-Gordon, Sexuality Research and Social Policy 18(4), 837-854, DOI 10.1007/s13178-021-00609-3) (opens in a new tab) Accessed 3 November 2026.Findommes, Cybermediated Sex Work, and Rinsing (McCracken and Brooks-Gordon, Sexuality Research and Social Policy 18(4), 837-854, DOI 10.1007/s13178-021-00609-3) (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
One victim quoted in the press said the emotional hurt outweighed the financial loss.
ReportedStated by a serious secondary source read in full.Financial Domination Has a Scamming Problem (opens in a new tab) Accessed 3 November 2026.Financial Domination Has a Scamming Problem (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
In 2DFD the images may be stolen or generated art, so quality tells you nothing about who runs the account.
Vivian’s field notesFirst-hand experience, not a study.
Press reports fake accounts that reply to subs who post about findom and ask them to send a direct message.
ReportedStated by a serious secondary source read in full.The Curse of the Fake Financial Dominatrix (opens in a new tab) Accessed 3 November 2026.The Curse of the Fake Financial Dominatrix (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
The scam is easy for anyone to start.
ReportedStated by a serious secondary source read in full.Financial Domination Has a Scamming Problem (opens in a new tab) Accessed 3 November 2026.Financial Domination Has a Scamming Problem (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
It plays on wanting to be accepted and on the fear of missing your chance.
Vivian’s field notesFirst-hand experience, not a study.
Some real dommes also ask for payment first, to keep time-wasters away.
ReportedStated by a serious secondary source read in full.Financial Domination Has a Scamming Problem (opens in a new tab) Accessed 3 November 2026.Financial Domination Has a Scamming Problem (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
The first fee, then a second ask under another name: insurance, an unlock fee, refund processing.
Vivian’s field notesFirst-hand experience, not a study.
Gift cards and crypto are hard to reverse once the funds are used.
Vivian’s field notesFirst-hand experience, not a study.
A card issuer, a bank or a gift-card company can sometimes block or reverse a payment that’s reported fast, so contact them right away.
Vivian’s field notesFirst-hand experience, not a study.
Show all 43 claims
It’s framed as proof of loyalty or as the price of keeping the bond.
Vivian’s field notesFirst-hand experience, not a study.
It comes at an emotional moment, wrapped in reassurance.
Vivian’s field notesFirst-hand experience, not a study.
A spoken promise protects nothing, and a login code lets someone else take over the account on the spot.
Vivian’s field notesFirst-hand experience, not a study.
Public guidance tells people not to hand control of a computer or phone to a stranger.
VerifiedChecked against the original source.IC3 Issues Alert on Tech Support Fraud (opens in a new tab) Accessed 3 November 2026.IC3 Issues Alert on Tech Support Fraud (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
A remote-access vendor says the same about anyone you don’t know or trust.
VerifiedChecked against the original source.TeamViewer and scamming (opens in a new tab) Accessed 3 November 2026.TeamViewer and scamming (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
In 2DFD nobody knows who’s behind the character, so in that sense every dom is a stranger.
Vivian’s field notesFirst-hand experience, not a study.
The account, the private messages in it, and your name on whatever comes next.
Vivian’s field notesFirst-hand experience, not a study.
Shared logins take away the private space a sub needs to say no or to leave.
Vivian’s field notesFirst-hand experience, not a study.
In my experience the request almost always comes at a weak moment: late at night, after a fight, after a slip. The timing is part of the method. A real dom never needs your password, and an honest question can be answered in words, so you owe nothing from your accounts.
Vivian’s field notesFirst-hand experience, not a study.
Everything stays local, nothing is charged unless you switch on a special mode, updates are automatic.
Vivian’s field notesFirst-hand experience, not a study.
What the tool really does is in the code.
Vivian’s field notesFirst-hand experience, not a study.
It also disables an extension after an update that adds a warning-level permission, until you accept it.
VerifiedChecked against the original source.Permission warnings (Chrome for Developers, extensions documentation) (opens in a new tab) Accessed 3 November 2026.Permission warnings (Chrome for Developers, extensions documentation) (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
A tool whose updater can replace any file, sitting next to login tokens on the same computer, could take everything with one update.
Vivian’s field notesFirst-hand experience, not a study.
That’s a different verdict from “malware”.
Vivian’s field notesFirst-hand experience, not a study.
A false alarm costs trust as much as a missed one. Read the whole source, the updater and every network call included, before you use the word malware.
Vivian’s field notesFirst-hand experience, not a study.
Whatever the tool is allowed to reach: accounts and payments.
Vivian’s field notesFirst-hand experience, not a study.
Either way, the money sits on a route someone else owns.
Vivian’s field notesFirst-hand experience, not a study.
A payment service can close an account it finds was described falsely and hold the balance, and your payment goes with it.
Vivian’s field notesFirst-hand experience, not a study.
Terms differ from one service to the next, and they change.
Vivian’s field notesFirst-hand experience, not a study.
Anonymity ends where the money lands, because a payout is tied to a real identity.
Vivian’s field notesFirst-hand experience, not a study.
A frozen balance and a trail tied to a real identity.
Vivian’s field notesFirst-hand experience, not a study.
Keep one limit across everyone you pay, and tell the dom you serve.
Vivian’s field notesFirst-hand experience, not a study.
Ask the dom directly, and don’t leave over a screenshot alone.
Vivian’s field notesFirst-hand experience, not a study.
Stay on the platform where you met, ignore it and report it.
Vivian’s field notesFirst-hand experience, not a study.
The drafts escalate from a playful label to a confession to a payment announcement with a link.
Vivian’s field notesFirst-hand experience, not a study.
You’re the one who publishes the text, under your own identity.
Vivian’s field notesFirst-hand experience, not a study.
A close cousin is the display account: a dom takes over a sub’s public account and turns it into a showcase of his sends.
Vivian’s field notesFirst-hand experience, not a study.
Handing over a social account means losing control of your own identity, whatever the game calls it.
Vivian’s field notesFirst-hand experience, not a study.
A public warning can protect others, but weak evidence invites defamation claims, and the person you name may have nothing to do with it.
Vivian’s field notesFirst-hand experience, not a study.
There’s no foolproof way to screen out scammers.
ReportedStated by a serious secondary source read in full.The Curse of the Fake Financial Dominatrix (opens in a new tab) Accessed 3 November 2026.The Curse of the Fake Financial Dominatrix (opens in a new tab)Archive (opens in a new tab)Accessed 3 November 2026
It also invites payback, like mass reports from accounts the other side controls.
Vivian’s field notesFirst-hand experience, not a study.
Download
Free, confidential helplines exist in most countries.