What access should an agency have? Logins, 2FA, payouts and chat

Why does this matter so much?

Account control is the core fear for a lot of creators, and with good reason. In June 2026, a BBC investigation reported contracts giving managers full account access, a creator whose manager changed her password to lock her out, and another whose bank details were changed so payouts went to the manager (BBC findings, as reported by MyJoyOnline).

The fix isn't to never work with anyone. It's knowing exactly what's reasonable to share and what's not.

What should I never hand over?

• Ownership of the account. It's verified with your ID and it stays yours.
• Your bank or payout details switched to someone else's name.
• Your recovery email. Whoever controls it can reset everything.
• Your 2FA set up on a device you don't control.
• Your ID documents sent over chat "to keep on file."
• Your personal email or phone, beyond what you choose to share for contact.

What can be reasonable, as long as it's in writing?

• Working access to post, edit and chat, if you know who has it and what for.
• A chat team, if you know from day one and can read every conversation.
• Help with settings like pricing, geoblocking or promo, if you can see what changed.
• A share of earnings taken after the money reaches you, with a clear percentage and base.

If something isn't in the contract, ask for it in writing before you hand over any access.

Can an agency see your email or profile?

Short version: they can see whatever the access you give them shows. So decide that access on purpose.

• Your public profile: anyone can see it, agencies included. That's normal.
• Your account email: if someone logs in with your password, they can usually see it in your settings. That's why your recovery email should have its own password and 2FA on your phone: seeing it isn't the same as being able to use it.
• Your personal inbox: no agency needs to get into it to manage your account. If they ask for that password, the answer is no.
• Your ID and payout details: they live in the verification and payout settings. Ask in writing who on their team can see them, and why.

What should I check before giving any access?

1. Is the account in my name, verified with my ID?
2. Does the money land in my bank account first?
3. Is the recovery email mine, and do I have the password?
4. Can I see sales and read every chat from my own login?
5. Does the contract say how I leave, how many days' notice, and that I get my accounts back?

If any of these is a no, stop and ask before going further.

How do we do it at LuxOnly?

This is our policy, and you can check it against the contract:

• Accounts and bank in your name. We create and set them up for you, and the platform verifies your age (18+) with your ID.
• The money reaches your account first. The agency's share is split from there, according to your contract.
• Our chat team (all women) talks to your fans with your style and your limits, and you can read every conversation whenever you want.
• Your terms in writing: 35–50% of net, or a fixed salary of 800–2,000 USD a month. Nothing to pay upfront.
• Leaving: 45 days' notice, no penalty. We hand your accounts back and delete your content from our systems.

More detail in How we work with your account.

What's on a basic account security checklist?

• Turn on 2FA with an authenticator app on your own phone.
• Use a unique, strong password for your account and your recovery email.
• Check active sessions now and then and log out anything you don't recognize.
• Be suspicious of "urgent" emails about your account. Go to the site yourself instead of clicking links, and never share login codes.
• When you leave an agency, change every password and reset 2FA the same day.

What if I've already been locked out?

1. Secure your email first. Change its password and turn on 2FA. If the recovery email isn't yours, that's the first thing to fix.
2. Contact platform support from the email tied to your verified account. Explain that you're the verified owner and that you've lost access.
3. Save everything: the contract, messages, payment records and screenshots.
4. Ask the agency in writing to hand back access, and keep a copy.
5. If there are threats or money being held, talk to a lawyer in your country and report it to the police.

For the full exit process, read how to leave an agency and keep your account.

Frequently asked questions