TL;DR
- Fan payments are taken by a payment provider OnlyFans approves. The privacy policy says OnlyFans does not receive your full card number, expiry, or security code. It gets a token, card type, and the first six and last four digits.
- A creator does not get that card data or, on the policy’s own categories, your email. What they can see is the privacy page.
- If you think someone else got in: change the password, turn on two-step authentication, and read login sessions in Account Settings. Then email support@onlyfans.com.
- The account-access help text does not give a phone number. Treat “OnlyFans support” phone lines from ads as not OnlyFans.
- No payment page makes a platform safe from scams, leaks, or a creator you chose to message. OnlyFans can also suspend accounts and withhold earnings under the terms.
| Risk | What OnlyFans publishes |
|---|
| Card theft by a creator |
Creators are not given the full card number. You still should not type the card into a chat. |
| Account takeover |
Change the password immediately, enable two-step authentication, review login sessions. Email support@onlyfans.com. |
| A fake app or a fake cashier |
There is no official iPhone or Android app for the main product. Pay only on onlyfans.com. See is there an app. |
| A charge you do not recognise |
Match the amount to a subscription or tip before you dispute it. The merchant name varies by bank. See bank statement name. |
Two-step authentication is the control they name
The help article on a suspected intrusion does not walk through every settings click. It does name the control: two-step authentication, plus the login-session list on Account Settings. Turn that on before you need the article. OnlyFans will not ask you for the password or the two-step code by email in any instruction we could cite; the support path in that article is you writing to support@onlyfans.com.
What “safe” does not cover
Identity checks for creators, and extra onboarding for fans in some places, are about age and who is being paid. They are not a promise that content stays inside the paywall if someone records a screen. They are also not a promise that a payout always clears. Holds, chargebacks, and account reviews are in the terms. The money path is the payout schedule. A dispute’s effect on a creator is the chargeback policy.
This is not a security audit of OnlyFans, and not a promise about any individual account. Read the
disclaimer.
Where these figures come from
- OnlyFans privacy policy, financial-data note: full card number, expiry, and security code stay with the payment provider; OnlyFans receives a token plus the first six and last four digits.
- Help Center, “What do I do if I think someone else has accessed my account?” (wording dated 25 November 2025): password, two-step authentication, login sessions, support@onlyfans.com.
- Terms of Use: approved payment providers; OnlyFans may suspend accounts and withhold earnings in the cases the contract lists.
More explainers