Screening a client: fraud signals and credit risk

"Is this gig legit?" is two questions wearing one coat, and they have almost nothing in common. One asks whether the person contacting you is running a crime. The other asks whether a real company with a real office and a real VAT number will pay you within a period that keeps you solvent. The first is rare, loud, and mostly detectable in ten minutes. The second is ordinary, quiet, and responsible for far more freelance losses.

The proportions matter. In IPSE's late payment research, 35% of self-employed people said a client had not paid them on time in the previous twelve months, and 31% said they had completed work and never been paid at all. That second figure is not a fraud statistic. Most of it is real businesses with cash-flow problems, disputes, turnover in accounts payable, and the ordinary entropy of getting money out of an organization. Treating that population as a security problem produces the wrong defenses: you scrutinize clients who are exactly who they say they are, then extend them unsecured credit anyway. Fraud is beaten by pattern recognition and by never moving money you do not own. Credit risk is beaten by verification where possible and deposit structure where it isn't.

The fraud patterns that reach freelancers, and what they have in common

Almost all of them require you to move money, hand over an identity document, or work before any payment obligation exists. The shape outlasts the stories, which change every eighteen months.

Overpayment and the fake check

Someone hires you, overpays, apologizes for the error, and asks you to return the difference. Or sends a check for equipment you are to buy from their "recommended supplier." It works because of a timing gap in banking law, which the FTC states plainly: "By law, banks have to make deposited funds available quickly. Even if you see the funds in your account, that doesn't mean it's a good check." Discovery runs on a different clock: "Fake checks can take weeks to be discovered and untangled. By that time, the scammer has any money you sent, and you're stuck paying the money back to the bank." You are not being asked to accept a risk. You are being asked to lend real money against a document that has not cleared, fast enough that you cannot find out.

The defense is one rule with no exceptions worth making: money does not go out against an inbound payment until that payment is irreversibly settled, and "shows in my balance" is not settled. Refunds go back by the rail the money arrived on.

Moving the conversation and the payment off the platform

If you were found on a marketplace, a request to pay directly is not a favor and not a fee dodge on your behalf. Upwork is explicit about what you give up: once you are paid off-platform, "we will no longer be able to offer any support, including payment protection, dispute resolution services, etc." It costs the account too, because "Violating the non-circumvention clause of the Terms of Service will result in account suspension". A client proposing it is either indifferent to your losing the account or counting on it, because a suspended freelancer has no dispute channel. The legitimate version happens after a completed contract, through the platform's own conversion process, on a signed agreement. Someone raising it before any work has been done is telling you which version this is.

Unpaid "test" work

Trials are not automatically a scam, and treating every one as fraud will cost you real work. The test is whether the output is usable. A short exercise on invented data, delivered as a walkthrough of your reasoning, proves what a client needs and is worth nothing to them commercially. A "test" that is the first module of the actual project, on the actual brief, with the actual assets, is the project, split into a free part and a paid part that may never arrive. Price it as a one- or two-day paid pilot instead; clients who intended to pay tend to agree.

Identity and document phishing

Onboarding is legitimate: a US client genuinely needs a W-9 or a W-8BEN before it can pay you. What is not legitimate is the version that arrives before any contract, asks for a passport scan or a bank login through a link you were sent, and is framed as urgent. The FTC's job-scam guidance gives the cleanest filter available: "Honest employers, including the federal government, will never ask you to pay to get a job." Extend it: nor to prove you are a person, nor to release money already owed.

The mirror-image risk deserves a line, because freelancers sit on the receiving end of it as often as the sending end. Action Fraud defines mandate fraud as someone "purporting to be an organisation you make regular payments to" in order to redirect a payment, and Europol's invoice-fraud guidance names the countermeasure exactly: "Do not use the contact details on the letter/fax/email requesting the change. Use those from previous correspondence instead." If a client emails to say your bank details have changed, they are talking to a criminal. Voice confirmation on a number you already had is the whole defense. Fake invoices run the other way too: in a May 2026 alert, the FTC warned small businesses about bills for domain registration, SEO and tech support nobody ordered, dressed as "past due" to manufacture urgency.

Checking that the company exists is free in all three jurisdictions

None of that tells you whether the entirely genuine company that just briefed you can pay a €12,000 invoice. For that you go to the register, and in all three markets the basic search is free.

Two caveats. The register proves the entity exists in the form claimed; it says nothing about whether the person emailing you can bind it, which you check by calling the switchboard number on the register rather than the one in the signature block. And depth varies: a UK micro-entity's accounts are thin but they exist, while most US private companies publish nothing at all. If your client base is transatlantic, that asymmetry constrains any workflow tool built around North American conventions, which is one honest reason to look at a HoneyBook alternative that reaches past North America.

What an overdue filing actually tells you

The most useful UK signal is the one people skip because it sounds administrative. Every UK company must file a confirmation statement at least once a year, within 14 days of the end of its 12-month review period, even if nothing has changed. It costs £50 online and takes minutes, and missing it carries a penalty and, per the same guidance, "your company may be struck off." An overdue confirmation statement is therefore not evidence of insolvency. It is evidence that nobody is currently doing the company's administration, which in a small company is the person who would otherwise be doing your payment run.

The escalation is public and runs on a clock. Where the registrar believes a company is not carrying on business, gov.uk's strike-off guidance says a notice goes into the Gazette announcing the intention to strike it off, and the company may be struck off "not less than 2 months" later, under section 1000 of the Companies Act 2006. On dissolution "any assets of a dissolved company will pass back to the Crown" as bona vacantia, and the bank account freezes. A first Gazette notice on a client you have just quoted is a two-month window in which their bank account may cease to exist. That is not a reason to be rude. It is a reason to be paid in advance.

The logic reads across every jurisdiction in the table. Filing discipline is a proxy for administrative capacity, and administrative capacity is what pays invoices.

Deposits price the risk you could not verify

Verification runs out fast. A US LLC formed last year, a German GmbH whose last accounts are eighteen months old, a new subsidiary of a company you have heard of: the register confirms existence in all three cases and says nothing about capacity to pay. This is where most advice tells you to trust your gut, which is not a control. The control is tranche size, and it is arithmetic.

Take a €12,000 project running eight weeks. Invoiced once on completion, peak exposure is the whole €12,000, and you learn how that ends only at the end. Split it 40% on signature, 30% at the midpoint, 30% on delivery: the €4,800 lands before you open a file, the €3,600 midpoint clears before you start the second half, and peak unpaid exposure becomes the final €3,600 plus whatever has accrued past the last cleared milestone. Same fee, same client, same probability of default, exposure down 70%.

Push further and the pattern is obvious: five equal tranches of €2,400 puts peak exposure at €2,400. Roughly, peak exposure ≈ fee ÷ number of tranches, but only if you stop when a tranche goes unpaid. A milestone schedule you keep working through is a payment plan for the client and a fiction for you. The suspension right has to be in the contract, saying work pauses on any invoice unpaid past its due date and the timeline extends accordingly. The contract generator runs in the browser with no signup and takes custom clauses; the AI Risk Reader is for what the client's own paper does to that provision when they send back their version instead.

Deposits do not shorten payment terms. Under Directive 2011/7/EU the EU default is 30 days from receipt of the invoice, and anything past 60 days needs express agreement that is not grossly unfair to you. Deposits cap the size of a loss; terms and enforcement decide how long you wait and what you can recover. Once it has already gone wrong, the escalation ladder is a different problem with different tools.

The rule: set the tranche, not the trust level

Here is the threshold, and it does not require you to judge anyone's character. Decide the largest amount you could write off without changing anything about your month. Not the amount that would hurt, the amount that would be boring. Call it your absorbable loss.

If the entity verifies cleanly, filings current and no adverse notices, a 25% deposit on net 30 is proportionate, and single tranches up to about one month of your fixed costs are a reasonable bet.

If it verifies but something is stale, whether an overdue confirmation statement, unfiled accounts, a Gazette notice or a formation date inside the last quarter, set the tranche count so that fee ÷ tranches is at or below your absorbable loss. On a €12,000 project with a €2,000 absorbable loss that is six tranches, and you say so without apology, because the register is public and they know what is on it.

If it does not verify at all, or the person cannot be tied to the entity, the answer is payment in advance or escrow. No deposit percentage makes an unidentifiable counterparty acceptable, because the recovery step every other structure depends on does not exist.

None of this decides whether the project is worth doing at the price. Solvency screening tells you whether you will be paid; the five qualification questions tell you whether being paid will have been worth it. A creditworthy client can still be an unprofitable one.

Worklyn's invoicing builds the deposit and milestone invoices straight out of the signed contract, so the tranche schedule you agreed is the one that actually goes out rather than the one you meant to.