Your agency locked you out of your OnlyFans account: what to do, in order

The short answer: start with the email address on the account, not with the account. Whoever controls that mailbox controls every reset. If the agency also controls the mailbox, go straight to OnlyFans support with proof of identity and the payout bank details, because those are the two things an agency cannot fake.

The order that works

1. Secure the email address first. If you can still sign into the mailbox on the account, change its password now and turn on two-factor there. Every OnlyFans reset goes through that inbox, so it is the real front door.
2. Then reset the OnlyFans password from that mailbox, and set up two-factor with a device only you hold.
3. Check the payout details immediately. Bank account, name on the account, payout country. This is the change that costs real money and the one people look at last.
4. Revoke sessions and connected tools. Anything signed in elsewhere, including any management tool the agency used.
5. If the mailbox is not yours, stop and go to OnlyFans support. Do not keep trying resets, repeated failures make an account look compromised from both sides.
6. Send the agency the written demand below, the same day, whatever else is happening.

What OnlyFans support needs from you

Recovery is decided on identity and money, so bring both:

• Government photo identification in the name on the account
• A selfie matching it, if asked, which is the check an agency cannot pass
• The bank account that has received payouts, and the approximate date of the last one
• The original email address used at sign-up, even if you no longer control it
• Approximate creation date and the last few payout amounts

Write the request as a factual timeline, not as an accusation: the account is yours, access was delegated to a company, the arrangement has ended, and you need access restored. Support decides on evidence of identity, not on who is right.

The written demand to the agency

Send it even if you expect nothing. It sets a date, and it makes a later dispute simple.

Subject: Immediate restoration of access, [YOUR NAME]

I am the account holder of the OnlyFans account [HANDLE OR ACCOUNT
EMAIL]. Access to that account, or to the email address attached to it,
is currently held by you and not by me.

I am requesting, today:

1. Restoration of my access to the account and to the email address on
   it, with confirmation of which credentials were changed and when.

2. Removal of every access on your side, including any management tool,
   any shared password store, and every session on a device that is not
   mine.

3. Confirmation that the payout bank details on the account have not
   been altered, and if they have, what they were changed to and on
   whose instruction.

4. A final statement of account: gross for the period, the platform fee,
   the base your commission was calculated on, the rate, and the balance
   owed to me.

The account, the content and the earnings are mine. Continuing to hold
access after this notice is a decision you are making in writing.

Please reply by [DATE, three days].

[YOUR NAME]
[DATE]

What to do the same day, regardless

• Write the timeline down while it is fresh: when access was granted, to whom, what was agreed, when it stopped. Dates, not adjectives.
• Screenshot everything that is still visible to you: payout history, messages with the agency, the agreement itself.
• Do not post about it publicly yet. Nothing speeds recovery, and it can complicate support's decision.
• Check your bank for the next scheduled payout date, so you notice fast if it does not arrive.

How this becomes impossible in the first place

An agency does not need your password to do its work. A management tool reaches your inbox and your content vault and nothing that changes the account. What the password reaches is the payout bank details, the email address and the two-factor setup, which is exactly the set of things that a lockout is made of.

Before you sign anywhere again, the question to ask in this exact form, because it is harder to dodge: who types the password? The longer version is on who should hold your login, and the twelve questions that surface the rest are on the call sheet.

Common questions