OnlyFans, a social media platform best known for explicit content, has boomed during the pandemic. But from receiving terrorism videos to racial abuse and rape threats, a BBC investigation based on the experiences of dozens of women reveals concerns about how the British-run site is structured, managed, and moderated.

Warning: Story contains adult themes and language

Tina Bean had been living in her car for two months when she started selling nude photos of herself on OnlyFans.

The 22-year-old had been kicked out of home after a "big fight" and spent most of last summer sleeping in car parks in the heat of Phoenix, Arizona.

Everybody else she knew was making "a hell of a lot of money" on the site. "So, I was like, I might as well just jump on it."

She is one of the million content creators on OnlyFans who share photos and videos with subscribers for a monthly fee. In return, the site takes 20% of their earnings.

Creators can post a range of content from beauty to fitness videos, but it's widely known for pornography.

Soon Tina was making $2,000 (£1,450) a month and able to rent her own flat.

But in January, a hacker seized control of her account, blackmailed her for $150 and uploaded streams of IS terror videos.

The footage, seen and verified by BBC News, depicts people being held hostage in warehouses, or running in fear, before being shot in the head.

"They seemed terrifying," she says. "I kept deleting them and changing my password but kept getting locked out of my account."

The perpetrator then spammed more than 40 of her fans, calling them the N-word, before stealing all of her photos and posting them on a porn site.

Tina says after a tortuous cycle of repeatedly being hacked over a month, she reported this to OnlyFans and temporarily disabled her account. She has now lost nearly all of her subscribers and earns just $100 a week - if she's lucky.

In a statement, OnlyFans said the account did not have two-factor authentication, which made it vulnerable. The company said Tina did not report the racial slur and it was not detected by the site's moderation system because it was pluralised.

It added that this system has now been upgraded and "in light of this particular incident", protocols have been updated to ensure that any hacked account's content is fully reviewed before access is restored.

OnlyFans became a cultural phenomenon during the pandemic, as lockdowns pushed people online to make and spend money.

Founded by Essex businessman Tim Stokely in 2016, it has become one of the UK's fastest-growing tech platforms, with more than 120 million users worldwide.

Celebrity endorsements and articles about ordinary women making life-changing amounts of money from selling nudes has boosted its profile, and last year the site handled payments worth £1.7bn.

The social media platform allows creators to put content behind a paywall and charge a monthly subscription fee - which ranges from $4.99 to $49.99 - for access. Creators can top up their earnings by sharing exclusive pay-per-view posts and receiving tips.

OnlyFans thrives on high engagement, and one of its big appeals is that creators and fans can build relationships through livestreams, personalised messages, and direct requests for custom-made photos and videos.

Much of the content is explicit - earning it a reputation as the "paywall of porn" - and users must be 18 or over to sign up.

But behind the glamour of how it is presented, the reality for some has been very different. Tina's experience highlights what creators and digital experts describe as systemic problems with how OnlyFans is structured, managed, and moderated.

The BBC has interviewed dozens of creators in the UK and US, seen copies of complaints and correspondence with OnlyFans, and found:

• Terror videos, rape threats and racial abuse have been posted on the site in the past year in violation of its terms of service, as well as explicit photos of a student uploaded without her consent
• Data protection experts have raised concerns about the security of the website's server after creators were hacked, or affected by glitches resulting in nude photos of others appearing on their accounts
• OnlyFans' policy of granting automatic refunds to fans who are blocked can perpetuate and incentivise abuse, according to creators
• The site has now adjusted its processes around closing creators' accounts after the BBC questioned why one had her page shut down without explanation, which resulted in it being restored

OnlyFans explicitly states on its website that it is "not responsible" for moderating content or detecting breaches of the law or its policies, which includes bans on harassment and sharing illegal or non-consensual images.

But it told the BBC that, while it was not legally obliged to proactively review content on the platform, it goes "above and beyond" what current regulations require by using community reporting and artificial intelligence software to help keep users safe.

The company says it evaluates over 300,000 media files a day and has more than 500 agents involved in compliance and moderation. It said that all flagged content is reviewed on a case-by-case basis.

Digital experts have told the BBC that artificial intelligence can be unreliable for porn, and OnlyFans needs more human moderators as explicit content is more susceptible to issues of abuse or copyright.

"The difference with OnlyFans is the way it's set up," says Matt Navarra, a social media consultant. "Because of the type of content, and the risk it potentially presents to more vulnerable users, the stakes are higher, and therefore the level of responsibility is greater as well."

'I'm going to hunt you down'

OnlyFans creators sell a fantasy - just like the millions of videos freely available on porn sites. Yet in the media, it has developed a reputation as being home to the naughty girl next door, who is more accessible than professional adult entertainers.

Tips for customised content can be lucrative, and one 20-year-old student, Charlie, said she has received requests ranging from $50 for a video of her eating a pizza, to $200 for one of her masturbating with sex toys.

"It's not about someone that's just looking for a quick video, like on Pornhub," says Victoria-May, a mother-of-two from Northampton. "It's about relationship building."

Two years ago, the 31-year-old quit her job as a trainee accountant to sell homemade pornography on the site. She says she has now made more than £1m.

But this hasn't come without difficulties, and she says setting boundaries with some of her "fans", who pay $30 a month to view her triple-X-rated photos and videos, has led to a deluge of abuse, rape and death threats.

She says that last summer, a male subscriber threatened violence after she declined to have sex with him - and sent messages to her OnlyFans account, including:

"I know where you live.

"I'm going to hunt you down.

"I'm going to kill your children.

"I'm going to rape you.

"I'm going to make your husband watch me as I hurt you, then I'm going to kill you.

"I hope all of your family get Covid and die."

When Victoria-May reported these threats, OnlyFans said "rude messages" did not violate its guidelines and the subscribers' account would not be removed. But as the company takes 20% of earnings, she feels it has a duty to take action.

The site then took six months to respond to more than 20 successive complaints - which were seen by the BBC - including reports of racial abuse directed at participants in her videos.

OnlyFans said it handled Victoria-May's complaints "in a timely manner" and that any fan reported and found to have been abusive is immediately removed from the platform. It added that it only began to review and investigate suspicious keywords in direct messages from April this year.

'Obsessive behaviour'

Stalking, bullying and harassment is against OnlyFans' guidelines and the site says breaches of this policy may lead to accounts being suspended or terminated.

For creators who do receive abuse, the site allows them to mute or block that fan. However, the platform automatically gives anyone who has been blocked - regardless of the reason - a refund of their active subscription.

Many creators who spoke to the BBC felt this policy was misused by fans and some said it can incentivise them to be rude or provocative, as their monthly subscriptions come to a close. Others added this made them feel penalised for being mistreated.

"The refunds issued to abusive consumers should be re-evaluated," says SkylaRayne, 26, a creator from New York. "We are the ones putting the food on their tables. So, when I'm being harassed and insulted, I'd expect [OnlyFans] to allow me to block someone without them getting a refund. That's just bare minimum."

But creators say that blocked fans are able to create new accounts and sign-up to their pages again.

This was the experience of Bell, a 23-year-old model from Manchester, who says she was harassed by a fan last year who was requesting extreme content in return for tips.

"It got very intense, so I decided to cut it off after six months," she recalls. "And they reacted quite badly to that - it was obsessive, obsessive behaviour.

"They were stalking me over multiple accounts, watching me through my friends' stories on Instagram, they had quite a lot of me, so I was worried that they could use this against me."

Bell reported the fan to OnlyFans three times and she says the site later advised blocking him. But he continued to sign-up to her page using multiple new accounts.

She told the BBC her experience could have been better if OnlyFans had a live chat function, which would have enabled her concerns to be responded to immediately.

The company says Bell was not willing to provide evidence of any specific abuse. It said that on all the occasions the site was contacted by her, it replied promptly with advice and later blocked the IP address of the alleged abusive fan.

OnlyFans added that, as a subscription-based platform where fans pay for access and content, it was "uniquely geared to dissuade and deter abusive behaviour from users" because, unlike anonymous social media, it could swiftly identify and remove them.

Leaks, hackings and glitches

For most creators, the appeal of the site is that photos and videos are locked behind a paywall.

Pirating content is illegal, and against OnlyFans' terms of service. But nearly all of the creators spoken to said their images had been leaked and traded by men in other social media and messaging forums.

Some told the BBC their photos had been maliciously sent to family members, or that they had been blackmailed into sharing nudes for free or told they would be made public.

"People are naively lulled into a false sense of security from the paywall, that what's behind it stays behind it," says Honza Cervenka, a lawyer in the UK specialising in image-based sexual abuse at McAllister Olivarius.

"Legally, content creators give OnlyFans a licence for their content but they keep the copyright," he says. "That leaves the primary responsibility to remedy a leak on content creators, which can be a hard, long and costly legal process."

Risks of being on OnlyFans can also include data protection breaches and hackings, according to creators who shared screenshots about the security of the site.

BBC News found that at different times some creators have faced "glitches" that have resulted in other peoples' photos appearing on their accounts.

Kandii Kitten, 26, was one of those affected, and said an image of a man holding his penis had been posted on her page when she had attempted to upload a nude photo.

Another creator, Katja Miyatovich, was hacked while using the platform in May, despite having two-factor authentication security enabled to prevent this.

As she was logged-in when it was happening, the 27-year-old from Canada was able to quickly regain access. She shared the email alerting her to the unidentified access to her account with BBC News.

"That is extremely disturbing and definitely a personal data breach," says Rowenna Fielding, a data protection consultant. "Without a doubt that [hacking] should have been investigated and reported to the Information Commissioner's Office."

Tim Turner, who also specialises in data protection, agrees and said that because Katja was hacked despite having two-factor authentication, and these glitches were not a one-off fault, it raises questions about the security of OnlyFans' server.

He added that OnlyFans should consider making two-factor authentication mandatory for creators on the platform given the intimate nature of the content.

In response, OnlyFans says Katja's account may have been accessed by someone with access to her linked Twitter account and phone number, and says it advised her to utilise the authenticator app instead of SMS verification.

It also said it runs a significant takedown team to help creators remove leaked content, with a 75% success rate, and now works with third-party providers to proactively locate, identify and remove stolen content.

The site added it was "very aware of its obligations under data protection laws" and as with all online platforms, there are sometimes system issues and incidents, which may or may not be data breaches. It said it investigates and reports them as appropriate.

'My pictures were sold without consent'

Madison, a 22-year-old student from Texas, discovered that her former roommate had been selling topless photos of her on OnlyFans for nearly four months last year without her knowledge.

As images on the site are hidden behind a paywall, she had only found out after her images were cross-promoted on Twitter to drive traffic to the account.

What had started as a night of playing around and taking what she describes as "sexy pictures" with her friends in their dorm, ended with her being exploited and the Polaroids falsely advertised as lesbian content.

Her "gut sank" at the realisation as she scanned through the pictures on OnlyFans, which were seen by the BBC. "I like girls who like girls," one post read, while another encouraged $5 tips.

"When I think about what she did, it stays with you, that you got used, that she violated me," she said.

OnlyFans' guidelines ban creators from sharing intimate photos without permission and requires any users making content featuring other people to have written proof of their consent, or says they must also be registered creators.

But the BBC understands proof of consent is only requested if an account is flagged or reported, which relies on people being aware that their images are on the site.

"OnlyFans overnight became one of the biggest cowboys in the wild wild West of the [unregulated] porn industry," says Kate Isaacs, who campaigns against image-based sexual abuse, known as revenge porn.

"But unfortunately the lack of moderation on the site and ensuring its technology is robust enough to protect people who choose to put their content on there is just seriously lagging behind."

Digital consultants say OnlyFans could deploy more sophisticated, automated technology whereby creators are required to submit recorded proof of consent at the point of upload to proactively prevent this because of the added difficulties the paywall presents for community moderation.

Madison's photos were deleted by her ex-roommate after she reported the incident, last May, to state police, who confirmed an investigation is underway. She is now considering taking legal action against the creator.

Despite having breached the company's policies, BBC News found the alleged perpetrator is still using OnlyFans under a different pseudonym.

OnlyFans said it uses proprietary software as well as manual reviews within its content moderation system to monitor and manage compliance with its terms and conditions.

OnlyFans' position in the porn world became more prominent after payment providers Mastercard and Visa ended their relationship with PornHub following allegations of unlawful content last year. Many of its performers relocated to OnlyFans.

Brian Honigman, a marketing consultant and adjunct professor at New York University, said OnlyFans should over-commit to moderation to safeguard its user base.

"And at the end of the day, this does protect your long-term ability to generate revenue and be a profitable business," he says.

"The subscription model is great, and the paywall is great when used correctly, but it's important that platforms like OnlyFans make sure they're being used in a way that leads to positive impacts."

Many of the creators who spoke to BBC News still use OnlyFans and say, financially at least, it has transformed their lives. But they have spoken out in the hope it would lead to them receiving better support.

As one said: "They need to protect the people that made them that platform in the first place."

Creators' names have been used and Madison's name has been changed.