Recognizing and Avoiding Phishing Messages and Scams
Phishing refers to scammers’ fraudulent attempts to get sensitive information or money from you by posing as a source you trust. For example, bad actors may attempt to trick you by:
Sending emails that look like they’ve been sent from a legitimate company, like GRIN or a brand you’re collaborating with.
Sending scam messages or calls that impersonate GRIN representatives.
While collaborating with GRIN or brands through GRIN, you’ll receive official emails, messages, and other communications to keep you up to date with your campaigns and Live Site information. You can differentiate these from phishing attempts by keeping the following in mind:
All official emails from GRIN will only come from our @grin.co email addresses.
All emails from your collaborating brands will only come from our @grin.co email addresses or from the brand’s official email.
GRIN only uses the email address you list in your Live Site’s settings to contact you.
Any support or help messages will only be in response to requests you initiated.
GRIN will never ask for your personal or private information in an email or personal message. We will also never ask for money in an email. GRIN or collaborating brands will only ask you to fill out personal information, such as your contact information or shipping address, in applications you fill out directly within your Live Site, not in emails.
If you receive an email or message from someone that isn’t from an @grin.co address or from a brand you’re working with directly, this may be a bad actor posing as GRIN. If that’s the case, avoid responding, and do not share your personal information under any circumstances. We also recommend reporting the suspicious email or message for spam or suspicious behavior to the platform they’re contacting you on.
Check the domain, not the branding
A scam message can copy our logo, our colors, and the name of a real brand you would like to work with. None of that proves it came from us. What does tell you something is the bit after the @ in the sender address: ours is always grin.co, so an address that merely contains the word "grin", such as influencer@creatorgrin.online, is not ours. A wrong domain is proof that a message is fake. A right one is not proof that it is real, because a sender address can be forged, so the check that settles it is whether the same request is waiting for you inside your Live Site.
Links deserve the same look. A scam page often carries a technical sounding name to seem official, so the name tells you nothing: what matters is the domain the link opens.
Your network login is only ever typed on that network’s own site
Some scam campaigns ask you to connect TikTok, Instagram, or another network through a link, a login form, or an external portal, because what that collects is the account itself. GRIN never asks you to enter a network login anywhere except that network’s own site, reached from your Live Site. Our email may point you to your Live Site, and that is normal: what is not normal is a login form or a portal that belongs to neither the network nor GRIN.
The path for each platform is in Connecting Your TikTok Account and, for the other networks, in Managing Social Networks.
If you already entered a login
These steps limit the damage, and the sooner they happen the better:
Change the password on the platform where you typed it, on TikTok or Instagram for example, and not in GRIN.
Turn on two-factor authentication on that same platform, so that a stolen password is not enough on its own.
In that platform’s security or privacy settings, open the list of apps and services connected to your account and remove anything you do not recognize. GRIN belongs on that list if you have connected a network to your Live Site, so leave our entry in place.
Report the message to us, and we will confirm whether it came from GRIN.
If you’re not sure if the message is from GRIN or not, you can always contact us directly at support@grin.co to confirm.