The "There's Something Wrong With My Commission" Scam

Photo by Nina Hill on Pexels

If you offer commissions online, you’ve probably had someone message you out of nowhere about a piece they “bought” from you. Sometimes it’s real, but sometimes it’s a scam built entirely around getting you to open a file you shouldn’t. Here’s how it usually goes.

The Hook

It starts with a complaint. Someone reaches out saying they purchased a commission or a piece of your work and there’s a problem with it. Maybe the file is corrupted, maybe it’s not what they paid for, maybe it just “looks wrong.” The message is usually calm and reasonable, not angry, because angry messages make people suspicious. This one just wants a resolution.

The hook here isn’t money up front, it’s the offer to fix a problem. Artists want to keep clients happy and protect their reputation, so a complaint about work gets attention fast, faster than almost any other kind of message. That’s the trick. You’re not being lured with a big payout, you’re being lured with the fear of a bad review or an unhappy customer.

The Build-Up

Once you respond, the scammer keeps the story going. They’ll say they can show you exactly what’s wrong, and they attach a file, usually something that looks like an image. It might be named something like “commission_issue.png” or “reference_error.jpg,” things that sound completely ordinary for the conversation you’re having.

The trick is in the file extension. What you see as a thumbnail or file icon can be faked entirely. Windows and most chat apps will display whatever icon and description the file claims to have, and that preview can be spoofed to look exactly like a normal image. The only thing that can’t be faked as easily is the actual extension shown in a file properties window, which is why it matters to actually check it before opening anything.

One extension that’s shown up in these scams is .scr, an old file type originally meant for Windows screensavers. Almost nobody uses screensavers anymore, so almost nobody recognizes this extension when they see it. That’s exactly why it works. A .scr file isn’t an image at all, it’s an executable, meaning double-clicking it runs a program instead of opening a picture. Scammers can pack anything into that file, and it will run the moment you open what you thought was a JPEG.

The Steal

The “steal” happens the second you open the file. Whatever program is packed inside runs quietly in the background, and depending on what it is, it can log your keystrokes, dig through saved passwords, grab session cookies from your browser, or give someone remote access to your machine entirely.

From there, the actual theft can take almost any form. Stolen banking logins, hijacked social media or Discord accounts, or your own files held for ransom. The commission complaint was never real, it was just the story used to get you to open one file.

The best protection here is simple and doesn’t require any special software. Get in the habit of checking file extensions before opening anything sent to you, especially from people you don’t already have an established relationship with. If a file extension looks unfamiliar or doesn’t match what you’d expect for an image (like .scr, .exe, .bat, or .js), don’t open it, no matter how convincing or urgent the message around it sounds. Real clients with real problems can describe the issue in words, or send a screenshot through a platform that renders images properly instead of as a downloadable attachment.

Commission complaints happen. Most of them are legitimate. But if one shows up out of nowhere attached to a file you weren’t expecting, slow down and check what you’re actually being asked to open.