In this article
A fake vendor-onboarding scam asks a new supplier, contractor, or recruit to pay an upfront fee — for registration, background checks, training materials, equipment, or a "compliance deposit" — before any real relationship, contract, or payment has actually begun. The structure inverts how legitimate onboarding works: a real company pays the people and vendors it brings on, or at most asks for standard, independently verifiable costs; it doesn't ask a prospective vendor to send money first in exchange for the promise of future work.
This scam shows up constantly on the other side of deals this blog usually covers — not a seller losing money on a closing, but a freelancer, contractor, or small supplier losing money trying to become someone's vendor in the first place. It's effective precisely because it mimics real onboarding friction: plenty of legitimate processes do involve paperwork, verification steps, and sometimes genuine third-party costs, which gives a fake version cover to hide in.
What does the scam actually look like in practice?
The pattern usually starts with an unusually easy win: a company reaches out (or responds suspiciously fast to an application) offering a contract, a supply agreement, or a long-term engagement that looks better than market terms would suggest. Partway through onboarding — after enough real-feeling conversation to build trust — the company introduces a cost the new vendor needs to cover before work or payment can start: a "vendor registration fee," a background-check fee paid to a specific named processor, a required training course sold by an affiliated company, or equipment the new vendor must purchase upfront and will supposedly be reimbursed for later.
The fee is framed as routine, sometimes even as something "everyone has to pay," and is usually a small enough fraction of the promised contract value that it doesn't trigger the skepticism a larger ask would. Once paid, the company either disappears, strings the relationship along with further small fees, or simply stops responding once no more money is forthcoming. The contract that was supposedly being onboarded into was never real.
Based on standard advance-fee fraud patterns in vendor and contractor onboarding.
What kinds of upfront costs are actually legitimate, and which aren't?
| Cost type | Legitimate? |
|---|---|
| A company-run background check, billed and paid directly by the company to its own chosen vendor | Common and legitimate |
| A fee the new vendor pays directly to a third-party background-check or training provider the company specifies | A frequent vector for the scam — the "third party" is often the company itself or a confederate |
| Standard tools or equipment the vendor already owns or buys independently, at market price, from any supplier | Normal and not a red flag |
| Equipment the vendor must buy specifically from the hiring company, at an above-market price, before work begins | A common variant, especially in driving, shipping, and remote-work scams |
| A refundable security deposit, held under a clear, written, time-bound refund policy | Can be legitimate in specific industries, but worth the same verification as any other large payment |
| A "membership," "certification," or "registration" fee paid before any contract is signed | Almost always the scam itself, dressed as a credential |
The common thread across the legitimate column is that the company is paying its own costs, or the vendor is spending money they'd spend anyway, on something they keep regardless of whether the relationship continues. The scam column consistently routes money toward the company (or an affiliate of it) in exchange for nothing the vendor can verify or keep.
What verification steps catch this before any money moves?
Search for the company's name alongside words like "scam," "review," or "complaint" — a company running this pattern repeatedly tends to generate a visible trail of complaints, even under a name it changes periodically. Separately, verify the company is a real, registered business the same way you would verify a client before accepting a payment from them: a legitimate business registration search, confirmation it has an actual operating history, and ideally a call to its published main line rather than only the number given to you in the onboarding conversation.
Ask directly whether the fee is refundable, in writing, and whether the company can point you to even one current vendor willing to confirm they paid a similar fee and are now being paid under a real contract. A legitimate company with an established, if unusual, fee structure will have existing vendors who can confirm it works; a company running this scam will either refuse to connect you or produce someone who, on closer inspection, turns out to be another victim or a confederate.
What does a practical verification pass look like, step by step?
- Search for the company independentlyLook up its legal name alongside "scam," "complaint," or "review," and separately confirm it's a real, registered business through a public registry.
- Ask for a signed agreement before any paymentA real contract — even a short one — that specifies the work, the pay, and the terms should exist before any fee changes hands, not after.
- Ask whether the fee is refundable and get that in writingA company confident in the relationship has no reason to resist putting a refund condition in writing.
- Request to speak to an existing vendorAsk for one current vendor or contractor who has gone through the same onboarding and is now being paid under a real contract — and actually contact them.
- Pay the smallest amount possible, if you proceed at allIf everything checks out but some uncertainty remains, see whether the company will accept a smaller initial engagement before any larger fee or commitment is required.
How does this scam show up differently for freelancers versus physical-goods vendors?
For freelancers and remote contractors, the scam most often appears as a "certification" or "verification" fee tied to a job-board-sourced opportunity, sometimes paired with a too-good salary or day rate for the stated work. For a small supplier or manufacturer being recruited as a vendor to a larger buyer, it more often appears as a required deposit toward "first order processing," a mandatory third-party compliance audit paid upfront, or a request to ship a sample order before any payment terms are confirmed in writing — effectively the same fee-before-relationship pattern, dressed in B2B language instead of gig-economy language.
In both cases, the giveaway is the same: a cost that exists specifically because you're being onboarded, payable to the company or someone closely tied to it, with no independent way to confirm it's standard practice. A legitimate industry-wide certification (an actual professional license, a real third-party safety audit required by regulation) is verifiable against an outside standard that exists independent of this one company; a fabricated onboarding fee is not.
Why do people fall for this even when they've heard of the pattern generally?
Awareness of the scam in the abstract doesn't always transfer to recognizing it in the moment, because each individual version is tailored to look like a specific industry's normal friction rather than a generic warning sign. A driver recruited for a delivery contract who's asked to buy a company-branded vest and scanner "deducted from your first week's pay" experiences that very differently from an abstract warning about "upfront fees" — it feels like standard onboarding for that specific job, because similar-sounding legitimate requirements do exist in adjacent, real companies.
The reliable test cuts through the industry-specific framing: does the money flow from the company to its own costs, or from the new vendor to the company (or an affiliate) before any paid work or binding contract exists? That question works the same way whether the dressing is a tech certification, a trucking equipment deposit, or a manufacturing compliance audit, because the underlying direction of the money — and what it buys the person paying it — doesn't actually change across industries.
How does this play out when the onboarding looks unusually professional?
Call her Grace, a small-batch packaging manufacturer who was approached by a buyer claiming to represent a mid-size retail chain looking for a new supplier. The outreach was polished: a real-looking company website, a signed letter of intent, and a contact who answered emails promptly and knew the industry well enough to discuss specifications in detail. Partway through onboarding, the buyer explained that the retail chain required all new suppliers to complete a paid third-party compliance audit — a standard-sounding requirement in manufacturing — and sent Grace a link to the auditing firm's own professional-looking site, along with an invoice for $4,200.
Grace paid it, expecting a purchase order for the first run to follow once the audit cleared. The audit "report" arrived a week later, flagging a minor issue that required a second, smaller paid re-inspection. By the time Grace grew suspicious enough to call the retail chain's actual corporate office directly — found through an independent search, not through any contact the buyer had given her — the chain had no record of the sourcing relationship at all, and no such supplier-audit requirement existed in its real onboarding process. The compliance firm's website came down within days of her complaint.
The detail worth noticing is that nothing about the outreach, the letter of intent, or the specification conversations was fabricated carelessly — the entire apparatus existed specifically to make the one real ask, the audit fee, feel like an unremarkable part of a legitimate process. The single check that would have caught it — calling the retail chain's actual corporate office before paying anything — took less time than assembling the specification documents Grace had already prepared for free.
Does it matter whether the fee is small relative to the promised contract?
A small fee relative to the promised contract value is, if anything, a reason for more caution rather than less, because it's specifically sized to pass an intuitive gut check — "this is nothing compared to what I'll make" — rather than to survive real scrutiny. A $300 "registration fee" against a promised $40,000 annual contract sounds trivial next to the upside; the same $300 fee against no contract at all, which is what actually exists until a binding agreement is signed, is simply $300 sent to a stranger.
The useful reframe is to evaluate the fee entirely on its own, stripped of the promised future payoff: would you send this amount of money to this company, today, for exactly what the fee itself buys — a registration, a certificate, an audit — if the larger contract didn't exist at all? If the honest answer is no, the promised contract isn't actually changing the economics of that decision; it's only changing how it feels.
What should you do if you've already paid a fee like this?
Stop any further payment immediately, regardless of what explanation is offered for why "just one more" fee is needed — escalating small fees is one of the most common follow-on patterns once a first payment succeeds. Report the company to your bank or payment provider if the payment can still be disputed or flagged, file a report with the relevant consumer-protection agency (in the US, the Federal Trade Commission accepts these reports and tracks the companies and patterns involved), and search again for the company's name to see whether others have reported the same pattern — your report, and your search, both help the next person who encounters the same offer.
The fee you've already paid may not be recoverable, but treating the loss as the end of the relationship rather than a sunk cost that justifies paying more is the one thing within your control once the pattern has already run.
How does this scam intersect with how you actually get paid once real work does begin?
Vetting the onboarding is only half the problem; the other half is making sure that once a relationship is genuinely real, the payment side of it doesn't reopen the same vulnerability. A legitimate client who has passed every check above can still, weeks into a real engagement, have their email compromised by someone who then sends you new "updated" payment instructions — a different but related failure mode covered in the business-email-compromise pieces on this blog. The onboarding-fee scam and the mid-engagement payment-redirect scam share a common root: both exploit a moment where you're asked to trust a request because of the relationship surrounding it, rather than verifying the request on its own terms.
The practical takeaway is to carry the same habit of independent verification past the onboarding stage and into how you invoice and get paid once work is genuinely underway — confirming payment details through a channel the other side doesn't control, the same way you'd confirm a company's legitimacy before sending it a fee. A vendor relationship that survives careful vetting at the start is worth protecting with the same care once money is actually supposed to start flowing in your direction.
Is there a version of this that targets established vendors, not just new ones?
Yes — a close relative targets vendors who already have a real, ongoing relationship with a client, using a fabricated "new compliance requirement," "updated vendor portal fee," or "re-certification" to extract a payment from someone who would otherwise never fall for a cold-outreach version of the scam, precisely because the relationship itself is genuine. The email or call often appears to come from inside the client's own organization, sometimes from a compromised real account, asking the vendor to pay a small fee to a specified account to "remain compliant" or "avoid a lapse" in the relationship.
Because the underlying relationship is real, this variant bypasses most of the checks above — the company is genuinely registered, genuinely has a history with you, and genuinely has existing vendors who'd vouch for it under normal circumstances. The one check that still works is the same one that catches payment-redirect fraud generally: confirm any new fee request, however routine it's framed as, through a contact at the client you already know and trust, reached independently — not by replying to the message that raised the request in the first place.
