TikTok Resin Art “DM to Order” Scam

Malwarebytes · Low sophistication
Last updated July 30, 2026

Scammers on TikTok are impersonating resin artists by reposting stolen videos and telling viewers to “DM to order.” After moving the conversation into direct messages (and sometimes off-platform), they request deposits or full payment and then disappear, or they try to extract personal/banking details from artists by pretending to want to buy or license work.

How the Scam Unfolds

Scammers on TikTok build fake resin artist personas by reposting stolen videos from real creators. These clips show satisfying resin pouring or finishing work, which builds trust and interest quickly. The account then invites viewers to DM to order, shifting the transaction away from public comments and into private messages where there is less accountability.

Once a buyer moves into DMs, and sometimes off-platform entirely, the scammer requests a deposit, full payment, or personal details. After receiving payment, the scammer typically disappears without delivering any product. In some cases the account has no genuine process footage at all, which is a strong sign the videos were never made by the person messaging the buyer.

A Second Angle: Targeting the Artists

This scam does not only target buyers. Real creators are also contacted directly by scammers posing as buyers, brands, or promoters who claim they want to buy, feature, or license the artist's work. The actual goal is to extract fees, banking information, or other sensitive data from the creator rather than to complete any legitimate transaction.

Why It Succeeds

These scams rely heavily on trust and urgency. Polished, satisfying video content creates an impression of legitimacy, and the push to move quickly into DMs or off-platform discourages buyers from pausing to verify who they are actually dealing with. Because social commerce on TikTok often lacks the accountability structures of established marketplaces, victims have fewer options to recover funds once payment is sent.

What to Watch For

  • Accounts with no original process footage or consistent work-in-progress posts
  • Pressure to transact only in direct messages and pay before any identity verification
  • Videos that appear stolen or reposted from other creators
  • Unexpected requests for banking details or fees tied to a buy, feature, or license offer

Building Resistance

The most reliable defense is verification before payment. Buyers should confirm a seller's originality and identity rather than relying solely on polished video content, and should only pay using a method that offers buyer protection, such as a credit card or PayPal. When a linked website is involved, checking for a genuine returns policy, a physical business address, and domain age can help separate legitimate sellers from scam sites using newly registered domains. Creators should treat unsolicited buy, feature, or license offers that request fees or banking information as a warning sign rather than an opportunity.

Key findings

  • Scammers impersonate resin artists by stealing and reposting legitimate creators’ videos.
  • A common lure is telling viewers to “DM to order,” shifting the transaction into private messages with less accountability.
  • After payment (deposit or full), the scammer may disappear and never deliver the product.
  • Creators can also be targeted directly with fake offers to buy/feature/license art to extract fees or banking information.

Who’s being targeted

  • Commonly targeted roles: All employees (consumer awareness), Marketing/Social Media teams, Procurement/Office management (anyone buying goods/services), Creators/brand partnership managers.
  • Affected industries: Online retail / social commerce, Independent artists and creators, Consumer goods / handmade products.
  • Attack channels: tiktok.
  • Impersonated: A legitimate resin artist/creator, A buyer, brand, or promoter interested in featuring/licensing art.

Red flags to watch for

  • Account has no original process footage or consistent work-in-progress posts
  • Pressure to transact only in DMs and pay before verifying identity
  • Videos appear stolen/reposted from other creators
  • Unexpected request for fees to get paid or be featured
  • Request for banking details early in the conversation
  • Vague identity and unverifiable business details
Try Mirage

Mirage safely runs attacks like this one against your own team, so you find out what happens before a real adversary does.

Get a demo

Frequently asked questions

How does the TikTok resin art scam work?

Scammers repost stolen videos from real resin artists and tell viewers to DM to order, then move the conversation into direct messages where they request a deposit or full payment before disappearing without delivering anything.

Are creators themselves targeted, not just buyers?

Yes. Scammers also contact artists directly claiming they want to buy, feature, or license their work, but the real goal is to extract fees, banking information, or other sensitive data.

What red flags suggest a resin art seller is fake?

Watch for accounts with no original process footage, pressure to pay before verifying identity, and videos that appear stolen or reposted from other creators.

How can buyers protect themselves when purchasing handmade items on social media?

Verify the seller's identity and originality before paying, avoid moving payment off-platform, and use a payment method with buyer protection such as a credit card or PayPal.

Read the video transcript

You see a gorgeous resin art TikTok, caption says: “DM to order.” Looks legit, right? That’s the trap. Scammers steal real artists’ resin videos, repost them, then push everything into DMs. Once you pay a deposit or full amount, they vanish, or ask for more personal and banking details. Aha moment: a real resin artist’s account shows messy process clips and a history of posts. Scam accounts look too clean, just polished reposts, no behind‑the‑scenes, and they insist, “Only pay in DMs” or off‑platform. Next time you see “DM to order” or a surprise offer to “feature or license” your art, pause. Your move: before you pay or share banking info, verify the account and any linked site independently, or walk away.

Similar attacks