Is That Data Licensing Email Legitimate? Red Flags and Scam Checks

Emails offering to license company data for AI training come from a buyer's own staff, a referrer the buyer pays or an intermediary, and the scams among them impersonate those senders, ask for a fee, or ask for data, access or payment changes before a signed contract. Three checks separate the genuine from the fake: reach the program from its own domain, name the legal entity that signs and pays, and send nothing before signed terms.

Checking the sender is the first step in AI training data licensing for any company that holds data. In this page, "fake data buyer" means a fake buyer, not fake test data.

DataPacts Editorial Team checked every figure on this page against its primary source between 2026-11-09 and 2026-11-10; the page on how we source, date and check every figure sets out the rules.

Who Sends Data Licensing Emails, and Who Pays Them

Data licensing emails come from four kinds of sender, and three of them are legitimate even when the email is unsolicited.

• Buyer staff: employees of a program such as Handshake AI, Mercor or micro1, writing from the program's own domain.
• Paid referrers: people who earn when a referred company signs or delivers. micro1 states USD 50,000 for deals up to USD 700,000 and 7.5 % above, Handshake states USD 10,000 per referred company, and Mercor states a base of USD 15,000 to 75,000 per listing (all checked 2026-11-09).
• Intermediaries: brokers and aggregators that sell data for companies; they are not buyers. OpenTrain states that companies pay nothing and that buyers may pay OpenTrain a referral reward (checked 2026-11-09).
• Impersonators: senders who use a known name on a domain or profile its owner does not control, and who ask the company for money, data or access.

Only the fourth kind is a scam, but the first three have incentives that differ from the company's, so the same checks apply to every sender.

Five Scam Patterns in Data Licensing Approaches

Five patterns separate a scam from a legitimate approach, and each has a check that costs nothing. No court or regulator record of a scam impersonating a named AI data buyer is known to DataPacts as of 2026-11-10, so the patterns come from general fraud records and from the buyers' own rules.

Table of the five patterns, what each email asks for, the legitimate counterpart and the free check, as of 2026-11-10.

Impersonation of a Known AI Data Buyer

An impersonator uses a known buyer's name on a domain, profile or signature the buyer does not control, and in the United States posing as a business is a violation of the FTC Impersonation Rule. The rule is 16 CFR Part 461 (89 FR 15017, published 2024-03-01, in force since 2024-04-01), and section 461.3 makes it unfair or deceptive to materially and falsely pose as a business or its officer.

The buyers also set their own limits. micro1's Referral Program Terms (last updated 2026-10-14, checked 2026-11-09) forbid referrers to pose as micro1 staff or to use @expert.micro1.ai addresses, and a referred company registers through the referrer's unique link, with no manual or retroactive attribution. A sender who claims to be micro1 staff acts outside the buyer's published rules.

Upfront Fees for a Valuation, Listing or Compliance Check

A request to pay before the company is paid is the clearest red flag, because the programs that publish their terms state that the company pays nothing. Each statement below is the stating party's own claim, checked 2026-11-09:

• Centific states "There are no upfront costs, setup fees, or deductions from your payment."
• Endless (an aggregator and intermediary) states "No commission on your side, nothing deducted later".
• OpenTrain (a broker and intermediary) states that companies pay nothing and that buyers may pay OpenTrain a referral reward.
• Polyshares states "There is no fee and no commission."
• Regulr (a broker and intermediary) states that it is free to the data owner and that the buyer pays Regulr a fee when a license closes.

The FBI's IC3 reports 7,097 advance-fee fraud complaints and USD 102,074,512 in reported losses for 2024, a general fraud figure, not a data licensing one.

Account Connections and Data Requested Before a Contract

Legitimate programs differ on account access, so the check is not whether a sender asks to connect a system but whether the domain, the scope and the signed terms come first. Mercor states the steps Scope, Connect, Process and Payout, Centific states a written estimate followed by a read-only connection to in-scope systems, and Troveo states "No OAuth access or install required" (all checked 2026-11-09). Handshake states "All data is scoped, de-identified, and confidential" and names an NDA in its process.

An email that asks for credentials or full access without naming a program step has no legitimate counterpart. Access belongs inside a signed AI data licensing agreement and follows scope and terms.

Changed Payment Instructions at the Wire Stage

Business email compromise targets the payment step: a message that changes bank details for a payout or a fee is checked by phone to a number the company already holds, never by replying. The FBI's IC3 reports 21,442 business email compromise complaints and USD 2,770,151,146 in reported losses in its 2024 report, and USD 3,046,598,558 in reported losses in its 2025 report, general fraud totals, not data licensing losses.

The legitimate sequence is documented. Mercor states that it pays by wire on delivery of the anonymized dataset, "typically within 2-4 weeks of the signed agreement", and micro1's master terms state that it invoices only after acceptance, while its program page states payment within 30 days of acceptance in one place and of invoicing in another (both checked 2026-11-09). A new account number that arrives outside that sequence is a reason to call.

Deadline Pressure and Headline Figures

A one-day deadline or a seven-figure headline is not proof of a scam, but it is a reason to slow down, because some legitimate incentives reward speed. Mercor states a USD 10,000 "fast signing" booster, paid to "referrer_and_company" within a one-day window, on 24 of 25 listings (checked 2026-11-09), so a referrer can have a reason to press for a signature unrelated to the offer.

Handshake states "Earn $100K to $4M+" and, on the same page, an estimator result of "up to $100,000" (both checked 2026-11-09), and both stay visible here as separate claims. The FTC's consumer guidance "How To Avoid a Scam" names four signs of a scam.

Seven Checks Before You Reply to a Data Licensing Email

Seven checks answer whether an email is legitimate, and none requires replying to the sender first. The company data partnership programs that publish their terms are the reference for each check.

1. Find the program page independently, not through the link in the email.
2. Compare the sender's domain with the program's domain in the table below.
3. Ask which legal entity signs the agreement and pays.
4. Ask whether the sender is paid for the introduction, by whom and how much.
5. Compare the steps requested with the program's published process.
6. Send no records, credentials or account access before signed terms.
7. Confirm any bank details by phone to a number already held.

Table of the program pages to compare a sender against, with the legal entity where a primary source states it, as of 2026-11-10.

A program missing from the table is not a scam; it is reached from its own site. The program pages checked do not publish registry numbers, so the entity in the signed contract is the one to confirm, read next to the program terms compared with their check dates.

When the Sender Is a Paid Referrer

A paid referrer is not a scammer, but the referrer is paid by the buyer when the company signs or delivers, so its advice is not independent. In the United States, 16 CFR 255.5(a) requires that a material connection between an endorser and a seller, including payment, "must be disclosed clearly and conspicuously", and micro1's Referral Program Terms repeat a disclosure duty in section 5.4(a).

The payment triggers differ by program. micro1 states that a referral is earned only after the referred company's data is "transferred and approved by micro1", Handshake states that its USD 10,000 bonus is paid when the deal closes, Turing states up to USD 50,000 paid only if the referred company signs and its record sells, and Patronus AI states 15 % of the license fee, paid after the owner has been paid (all checked 2026-11-09).

The fourth check above puts that question to a referrer. The referral programs of AI data buyers compared page lists every program with its terms and dates.

A Legitimate Email Is Not Yet a Good Offer: Benefits, Risks, Downsides and Alternatives

Once the sender checks out, the question changes from whether the email is real to whether the terms are worth taking, and declining is a valid answer.

Benefits of replying

• A written estimate or terms to compare, where a program publishes a process.
• A scoped, de-identified and confidential transfer, where the program states it (Handshake, checked 2026-11-09).

Risks

• Deemed acceptance: micro1's master terms give 30 business days to reject a delivery, after which it is deemed accepted (checked 2026-11-09).
• Headline figures that differ from the estimator on the same page, as at Handshake.

Downsides

• Review of rights, consent and contract terms takes time before any reply is useful.
• A reply confirms that the address is active.

Alternatives

• Not replying.
• Not licensing the data at all.
• Asking several programs for their terms and comparing them.

A genuine offer is then judged on price, payment trigger and acceptance terms, which the page on evaluating an offer for your data covers.

Reporting a Suspected Data Licensing Scam

A suspected scam is reported to the FBI's Internet Crime Complaint Center and to the business being impersonated, after the email and headers are saved. The IC3 received 1,008,597 complaints in its 2025 report, and the FTC enforces the Impersonation Rule (16 CFR Part 461).

• Keep the email with its full headers, and any attachments unopened.
• Report it to the FBI's IC3 at ic3.gov.
• Tell the impersonated buyer through its own published contact.

Where Scam Checks Sit in the Process to Sell or License Company Data

Scam checks come before the first reply and return at every step where data, access or money moves. The full sequence to sell or license company data to AI companies places them as follows.

1. Should you sell or license your data: decide whether to engage at all.
2. Choosing a buyer for your data: reach each buyer from its own domain.
3. Selling direct or through a broker: confirm what an intermediary is paid and by whom.
4. NDAs before sharing data: sign before any sample moves.
5. Security during an AI data sale: limit what access is granted.
6. When and how AI data buyers pay: confirm payment details by phone.

Buyer Profiles With Their Own Legitimacy Checks

Profiles of Handshake, Mercor and micro1, three programs with published company data terms, carry their own checks on legal entity, domain and terms.

• Handshake AI data buyer profile
• Mercor data buyer profile
• micro1 data buyer profile
• Who buys AI training data covers every buyer.

Complaints and disputes about buyers are tracked under data buyer incidents.

Scams Aimed at AI Training Workers Instead of Companies

Job and task scams aimed at people who train AI models are a different problem, with different checks. They are covered under is AI training work legit.

Frequently Asked Questions

Do AI companies really pay companies for their data?

Yes; Reddit disclosed USD 203.0 million in aggregate data licensing contracts in its 2024 S-1, and several programs publish terms for company data. Reddit's filing of 2024-02-22 does not name the counterparties. micro1, for example, states referral fees only after data is transferred and approved (checked 2026-11-09).

Should we pay a fee to license our data?

No program whose terms DataPacts has checked asks the company for a fee, and several state that the company pays nothing. Centific, Endless, OpenTrain, Polyshares and Regulr state this as of 2026-11-09.

How is DataPacts paid, and should we check DataPacts too?

Yes, apply the same checks to DataPacts: it is not a broker, takes no cut of any sale and has joined no referral program. DataPacts charges the company nothing for an enquiry or introduction. If it joins a referral program, that is disclosed under how DataPacts is funded.