YouTube Sponsorship Email Scam: How to Check an Offer

An email lands in your channel's business inbox. A well known brand, or an agency acting for one, wants to sponsor a video. The offer sounds fair, the logo looks right, and there is a brief to download or a portal to sign in to. You want the deal, but something feels slightly off. That instinct is worth listening to. This guide shows how to check a sponsorship email before you act, the signs that point to a channel takeover attempt, and what to do in the first hour if you have already opened the file or signed in.

Last checked: 20 October 2026.

#Is This YouTube Sponsorship Email a Scam?

Treat any sponsorship email as suspicious until you have checked it if it asks you to download software, open an archive that needs a password, or sign in to Google through a link to read the brief. Those steps are how attackers take channels. A real brand can explain the deal in plain text and can still be there after you check the company through its own website. YouTube's safety tips for creators say it will never ask for your password, and that before replying to a brand deal it is best to verify it by calling the company or contacting the person you usually work with.

#How the Fake Sponsorship Trap Works

Google's Threat Analysis Group published a detailed account of one campaign in a 2021 report on attacks against YouTube creators. The attackers lured creators with fake collaboration offers, typically a demo of anti-virus software, a VPN, a music player, a photo editor or an online game. When the creator ran the supposed software, malware stole the browser's session cookies. With those cookies the attackers could take over the channel, then sell it or use it to stream cryptocurrency scams.

The same report notes why this matters even if you use two-step verification. Session cookie theft takes over a session that is already signed in, so the attacker does not need to pass the sign-in step again. Google's report suggests the technique became more popular as more people turned on multi-factor protection. Wording and brand names change from one wave to the next, but the shape stays similar: a flattering offer, a reason to rush, and a file or sign-in step that you should not need.

#Brand Deal Verification Checklist

Work through these checks before you reply, download or sign in. If any answer is unclear, pause the deal until it is clear.

Then confirm the deal through a route you found yourself. Look up the brand's official site, find a partnerships or press contact, and ask whether the person who emailed you works for them. YouTube suggests calling the company or contacting the person you usually work with. If an agency is involved, check that the agency exists outside the email and that the brand knows it.

#Red Flags in the Email Itself

• The file is an archive with a password written in the email. YouTube's safety page lists passwords to open encrypted files among the requests you should not answer.
• The offer needs you to install a programme, a premium editing tool or a template pack before you can see the terms.
• A link opens a page that looks like a Google sign-in. YouTube says to never enter your Google password on any website except myaccount.google.com.
• The sender asks for channel access, Manager rights or marketing access to run the campaign.
• The message claims to come from YouTube itself but the address is not from youtube.com or google.com, which YouTube says are the only domains its real emails use.
• The deal must be signed today, or the brand will move to another creator.

Gmail's guide on how to avoid and report phishing emails explains how to report a message as phishing from the More menu next to Reply. If the email came to another provider, use that provider's report option.

#I Already Clicked: The First Hour

If you opened the file or signed in, assume the device and the session may be compromised. Do the following from a different device that you trust, such as a phone that never opened the file.

YouTube's page on how to recover a hacked YouTube channel says a hacked channel means at least one Google Account linked to it is compromised, so the first step is always to recover and secure that Google Account. It then asks you to undo unwanted changes on the channel quickly, to avoid penalties such as Community Guidelines or copyright strikes, and to tighten security for everyone who has access.

1. Change the Google Account password from a clean device.
2. Review two-step verification and recovery phone and email details, and remove anything you do not recognise.
3. Check YouTube channel permissions and remove people you do not know.
4. Delete connected apps you do not need from your Google Account settings.
5. Look for changed channel details, new uploads, deleted videos or live streams you did not start.
6. Scan or reset the computer that opened the file before signing in on it again.

If the channel is already showing scam live streams or the name has changed, our guide on hacked channels that start streaming crypto scams covers that stage, and the wider YouTube channel recovery steps explain the Google Account route in more detail.

#Protect the Channel Before the Next Offer

A few settings make them less dangerous. YouTube recommends turning on two-step verification and choosing a passkey as the second step for stronger protection against phishing, and turning on Enhanced Safe Browsing to scan downloads. Give editors and managers access through channel permissions rather than sharing a password, and remove access when someone leaves the team.

It also helps to separate roles. Use one email address for public business enquiries and a different, private address for the Google Account that owns the channel. Read offers on a device that does not hold your main signed-in sessions if you can. If a deal is real, the brand will accept a short delay while you check it. If you manage brand partnerships for several creators, our note on what a hacked creator account means for brand deals covers how to talk to sponsors if something goes wrong.

#What Google and YouTube Decide

Recovery of a compromised channel depends on Google's account recovery process and YouTube's review. Nobody outside Google can restore access for you or speed up that review, and some accounts are harder to recover than others, especially when recovery details were changed. Stolen sponsorship money is a separate matter for your bank and the police.

#When a Case Review Makes Sense

If you spotted a fake offer before clicking, you do not need outside help. A review can help when the channel has already been taken, when the Google Account recovery form keeps failing, or when the channel is a business with staff and brand partners who need clear steps. SocialSafe by AwareXone, AwareXone's account recovery service, works only through Google's and YouTube's official routes and never asks for your password or codes. See our YouTube channel help page for how a review works, and our Trust Center for how we handle cases.

#Frequently Asked Questions