Fake Music Copyright Email Took Over Your YouTube?

You opened what looked like a music copyright objection email. The link asked you to confirm a claim. After that your phone reset, Google blocked you, and strangers ran crypto livestreams on your channel. Friends ask if the streams are real. You need the first hour order of operations.

On 5 November 2026, Star News Korea reported comedian Chung Ju-ri describing a fake SM Entertainment copyright objection email that led to a phone reset, a Google Account lockout, and crypto livestreams on her channel. This guide focuses on that email to Google takeover path. For spotting copyright lures generally, see Fake copyright violation message. For channel recovery after crypto streams, see YouTube channel hacked crypto livestream. One wrong step can cost you the account, so know what you are doing before you start.

Last checked: 6 November 2026.

#Quick Answer

If a fake music copyright objection email led to a phone reset and crypto livestreams on your YouTube channel, treat the Google Account as compromised first. Change the password on a clean device, end sessions, restore phone control, then follow YouTube hacked channel steps. See the crypto livestream research article for channel cleanup after you regain login.

#First Hour Recovery Tree

#Why Fake Copyright Objection Emails Work

Creators expect real music claims. A message that names a label and asks you to file an objection feels urgent. Attackers use that urgency to push a login or device reset page. Official YouTube copyright tools live inside Studio and Google systems, not on a random wipe prompt.

Malaysian creators who receive English notices from unknown agencies should type YouTube Help or accounts.google.com themselves. Do not tap the mail button that demands a phone reset.

#Secure the Google Account

1. On a trusted device, open accounts.google.com and change the password.
2. Review recent security activity and end sessions you do not recognise.
3. Confirm recovery email and phone are yours.
4. Turn on two factor authentication with an authenticator app if you can.
5. Only then return to YouTube Studio.

Google's secure a hacked or compromised Google Account page is the spine of those steps. Check device activity for unknown sessions. YouTube's recover a hacked YouTube channel page comes next once Google login works again.

Save the phishing email with full headers. That evidence helps if you file a police report or a platform abuse report later.

#Channel Managers and Livestreams

After login, check channel permissions for unknown managers or apps. Stop live streams you did not start. Tell viewers on another platform that the crypto streams are not yours. Full livestream cleanup steps live in the crypto livestream research article, so this piece does not repeat that playbook. For broader hack recovery see YouTube channel hacked recovery.

If the attacker changed the channel name or banner during the streams, screenshot the live state before you edit. Those images help later when you explain the incident to partners.

Brand sponsors watching the crypto streams need a short factual note: the channel was compromised through a fake copyright email, you are securing Google, and any wallet links are not yours.

#What Only Google and YouTube Can Decide

Google decides account recovery outcomes. YouTube decides channel access and stream removals. Your part is to secure login, revoke access and document the phishing email.

Ask your mobile carrier how to re-register a SIM if the phone reset removed your number from Google recovery. Carrier shops in Malaysia can move slowly on weekends, so start early.

Export Google Takeout only after you control the account again. Do not approve Takeout prompts that arrive as unexpected emails during the takeover.

Tell collaborators to ignore chat invites that claim to be YouTube Support. Support does not start in random Discord servers.

Compare the phishing domain against the real label's site by typing the brand name into a search engine yourself.

If crypto livestreams already collected comments with wallet addresses, screenshot them for investigators before deleting.

Family members who share Google Family Link setups need a separate recovery plan when a child's device was reset.

Do not install screen sharing tools offered by strangers who claim they can reverse a Google lockout.

After you recover, review YouTube Studio permission invites weekly for a month.

Write down the exact on-screen wording before you screenshot so later appeals match what the platform showed on the day you acted.

Tell close contacts through another channel that your account may send odd links until the situation is stable.

Prefer official help URLs you type yourself rather than buttons inside unexpected emails or DMs.

Keep a simple timeline with Malaysia time stamps for every password change, appeal and public warning.

If a platform offers only a limited number of reviews, use them carefully and attach only evidence you can defend.

After access returns, review connected apps and remove anything you do not recognise before you resume normal posting.

Teams should nominate one owner for the case so staff do not file conflicting appeals from different logins.

Platform wording varies by app version and country, so quote your own notice rather than a screenshot from a friend.

If you work with an agency, give them read-only status updates instead of shared passwords while the case is open.

Avoid public arguments with attackers or impersonators; collect evidence quietly and report through official tools.

When a feature returns, test it with a harmless post before you resume paid campaigns or partner content.

Store recovery codes from two factor setup in a secure place you control, never in a public chat channel.

Attackers favour music copyright themes because creators already fear demonetisation and strikes. A calm rule is that any email demanding an immediate phone wipe or a password entry outside accounts.google.com is hostile until proven otherwise.

After you regain Studio, review live streams, premieres and community posts from the takeover window and remove anything that still funnels viewers to wallets. Partners who paused deals need a short factual note with dates, not a dramatic thread.

If Google still shows unfamiliar devices the next morning, end those sessions again before you upload new videos.

After Studio is yours again, disable livestream privileges for new managers until you finish a full permission audit.

Creators who film with borrowed phones should erase guest Google sessions on those devices before the next shoot.

If SM Entertainment or another label truly has a claim, it will appear inside YouTube's own claim tools once you can sign in, not as a wipe prompt in mail.

When Google offers a security checkup, complete it on the clean device before you reconnect editing apps.

#When It Is Safer to Get Expert Help

Getting help is safer when the phone is still wiped, when two factor is held by the attacker, or when monetisation is live during the streams. Wrong recovery links can deepen the lockout.

If you are unsure about any step, or the channel matters to your income, having an experienced team check it is the safer choice. AwareXone does this work. See our YouTube page.

#When a Case Review Makes Sense

A case review helps when Google lockout and YouTube crypto streams sit together. We are a Malaysia-based team, independent of Google and YouTube, and we use only the official routes. We do not ask for your password or codes, and we cannot promise a result. See our trust page.

#Frequently Asked Questions