Fiverr

Is Fiverr safe?

For a buyer, Fiverr is reasonably safe as long as the money stays inside an order. Fiverr takes payment up front and releases it to the freelancer only after delivery, so the classic "paid and got nothing" scam is hard to pull off on the platform. For freelancers, the risks are phishing, fake buyers and files that carry malware. The weaker part is Fiverr's own handling of data: in April 2026, researchers found that files people had shared in orders, including tax forms and driver's licences, were sitting on public links that Google had indexed.

We score Fiverr 50/100, close to ZipRecruiter (53) and ahead of LinkedIn (48), but below Upwork, which offers stronger login protection and has no regulator order on file.

What happened with Fiverr's exposed files?

Fiverr stores files that buyers and freelancers exchange on Cloudinary, a media hosting service. An anonymous researcher posted on Hacker News in April 2026 that these files used public links that never expired, and that a Google search of Fiverr's Cloudinary domain turned up tax returns, ID documents, invoices and contracts. Cybernews confirmed that many such documents were indexed, and its researcher called it "a major security lapse", according to PYMNTS. Cloudinary supports signed links that expire; Fiverr's file sharing did not use them.

Fiverr rejected the description. "To be clear, this is not a cyber incident," it said, adding that the files were shared by users "in the normal course of marketplace activity" and that removal requests are handled promptly. Whatever the label, the lesson for users is the same: anything you upload to a Fiverr chat may not stay private, so do not send ID scans, passwords or API keys there.

It is not Fiverr's first problem. Its 2025 annual report says "we have experienced such cybersecurity incidents in the past", without dates. On the other side of the ledger, Fiverr says it is certified to ISO 27001 and PCI DSS, hires an outside firm for yearly penetration tests, and runs a bug bounty with Bugcrowd. Its two-factorTwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary login sends codes by email, SMS, WhatsApp or to a logged-in device, but does not support authenticator apps or security keys, and you can switch the codes off.

How scams work on Fiverr

Fraud runs in both directions. Freelancers get messages that pose as Fiverr, often with a misspelled name such as "Fivver" or "Feverr" or a link on an odd domain, asking for login or payment details. Fake buyers ask for "free samples", push to pay outside Fiverr, or send attachments that turn out to be malware. Buyers, in turn, can meet freelancers who resell stolen or AI-generated work, or who try to move the deal off the platform.

Fiverr's main defences are structural. Its rules allow contact through other channels only after an order is placed, and payment outside Fiverr is banned. New freelancers must verify a phone number, business details for the EU's Digital Services Act and a government ID with a selfie before their gigs go into the catalogue; some pay a one-time fee for this. We found no figure from Fiverr on how many fraudulent accounts it removes.

Age is a gap. Fiverr's terms require users to be 18, and allow 13 to 17 year olds only through an account owned by a parent. The App Store rates the app 9+.

What Fiverr does with your data

Apple's privacy label for the app has no "Data Used to Track You" section. It lists purchases, financial information, search history, contact details, identifiers and user content as linked to your identity, with Fiverr's own advertising and marketing among the purposes. Google Play's data safety section goes further: it says app interactions are shared with other companies for analytics, advertising and personalisation, and that device identifiers are collected for advertising.

Fiverr says it uses freelancers' ID documents only to verify accounts, recover hijacked accounts and confirm age, and keeps them only as long as needed for those purposes. We could not read the full privacy policy, because Fiverr's site blocks automated access, so our privacy score rests on the store disclosures and Fiverr's help pages.

The California escrow order

In June 2018, California's Department of Business Oversight ordered Fiverr to stop acting as an escrow agent without a state licence, because it held buyers' money until orders were complete. Fiverr first contested the order, then in April 2019 agreed to its finality and waived its right to a hearing. No fine was imposed. Its 2025 annual report says it is not a party to any material legal proceedings.

How to use Fiverr safely

1. Pay and get paid only through a Fiverr order; refuse PayPal, crypto or bank transfers arranged in chat.
2. Do not upload ID scans, tax forms, passwords or API keys to Fiverr messages.
3. Treat any message about your account that comes from a misspelled sender or contains a link as phishing.
4. Turn on 2FATwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary, and protect the email account linked to Fiverr with an authenticator app.
5. Open buyers' files only after scanning them, and never run executable attachments.
6. Read the freelancer's reviews and delivery history before ordering, and use milestones for large jobs.

How we scored it

Regulatory record (62) is Fiverr's highest factor, held down by California's escrow order. Security (45) is the weakest, because of the 2026 file exposure, past incidents admitted in its annual report and a 2FATwo-factor authenticationSigning in with a second proof of identity on top of your password, such as a code from an app, a security key or a passkey.More in the glossary setup without authenticator apps. Privacy (50) and scams and harmful content (50) sit in the middle: the store labels show no third-party tracking on iPhone, and the payment hold and ID checks limit fraud, but phishing and off-platform scams remain common.