Got a brand deal email for your YouTube channel? Check the sender, file and sign-in step first, and what to do if you already clicked.
Treat a YouTube sponsorship email as a scam if it pushes you to download a file, open a password protected archive or sign in through a link to see the deal. Verify the company through its own website or contacts, never enter your Google password outside Google, and secure your account first if you clicked.
SummaryAn email lands in your channel's business inbox. A well known brand, or an agency acting for one, wants to sponsor a video. The offer sounds fair, the logo looks right, and there is a brief to download or a portal to sign in to. You want the deal, but something feels slightly off. That instinct is worth listening to. This guide shows how to check a sponsorship email before you act, the signs that point to a channel takeover attempt, and what to do in the first hour if you have already opened the file or signed in.
Last checked: 20 October 2026.
Treat any sponsorship email as suspicious until you have checked it if it asks you to download software, open an archive that needs a password, or sign in to Google through a link to read the brief. Those steps are how attackers take channels. A real brand can explain the deal in plain text and can still be there after you check the company through its own website. YouTube's safety tips for creators say it will never ask for your password, and that before replying to a brand deal it is best to verify it by calling the company or contacting the person you usually work with.
Google's Threat Analysis Group published a detailed account of one campaign in a 2021 report on attacks against YouTube creators. The attackers lured creators with fake collaboration offers, typically a demo of anti-virus software, a VPN, a music player, a photo editor or an online game. When the creator ran the supposed software, malware stole the browser's session cookies. With those cookies the attackers could take over the channel, then sell it or use it to stream cryptocurrency scams.
The same report notes why this matters even if you use two-step verification. Session cookie theft takes over a session that is already signed in, so the attacker does not need to pass the sign-in step again. Google's report suggests the technique became more popular as more people turned on multi-factor protection. Wording and brand names change from one wave to the next, but the shape stays similar: a flattering offer, a reason to rush, and a file or sign-in step that you should not need.
Work through these checks before you reply, download or sign in. If any answer is unclear, pause the deal until it is clear.
| Check | What a careful offer looks like | What should stop you |
|---|---|---|
| Sender address | Matches the brand's or agency's own domain, which you can find on their real website | A free webmail address, a lookalike domain, or a name that does not match the address |
| How they found you | Mentions specific videos and why your audience fits | Generic praise that could fit any channel |
| Brief or contract | Plain text, a normal document, or a link on the brand's own domain | An executable file, a password protected archive, or a tool you must install to view it |
| Sign-in step | None needed to read the offer | A page asking you to sign in with Google, or a form asking for account details |
| Payment talk | Clear terms you can check with the company | Pressure to decide today, or a request to pay something first |
| Channel access | Never needed to discuss a sponsorship | Requests for Manager access, your password or a code |
Then confirm the deal through a route you found yourself. Look up the brand's official site, find a partnerships or press contact, and ask whether the person who emailed you works for them. YouTube suggests calling the company or contacting the person you usually work with. If an agency is involved, check that the agency exists outside the email and that the brand knows it.
Gmail's guide on how to avoid and report phishing emails explains how to report a message as phishing from the More menu next to Reply. If the email came to another provider, use that provider's report option.
If you opened the file or signed in, assume the device and the session may be compromised. Do the following from a different device that you trust, such as a phone that never opened the file.
| What happened | What it may mean | What to do on a clean device |
|---|---|---|
| You ran a file from the email | Malware may have copied passwords and signed-in sessions from that computer | Change your Google password, sign out other sessions, and stop using that computer for accounts until it is checked or reset |
| You signed in on a page from the email | Your password and possibly a code may have been captured | Change the password, review two-step verification settings and recovery details, and check recent security activity |
| You gave someone channel access | They may be able to change or delete content | Remove unknown users from channel permissions and check what changed |
| Your channel name, videos or email settings changed | The account may already be taken over | Follow YouTube's hacked channel steps without delay |
| You paid money or shared card details | This is fraud as well as an account issue | Contact your bank straight away |
YouTube's page on how to recover a hacked YouTube channel says a hacked channel means at least one Google Account linked to it is compromised, so the first step is always to recover and secure that Google Account. It then asks you to undo unwanted changes on the channel quickly, to avoid penalties such as Community Guidelines or copyright strikes, and to tighten security for everyone who has access.
If the channel is already showing scam live streams or the name has changed, our guide on hacked channels that start streaming crypto scams covers that stage, and the wider YouTube channel recovery steps explain the Google Account route in more detail.
A few settings make them less dangerous. YouTube recommends turning on two-step verification and choosing a passkey as the second step for stronger protection against phishing, and turning on Enhanced Safe Browsing to scan downloads. Give editors and managers access through channel permissions rather than sharing a password, and remove access when someone leaves the team.
It also helps to separate roles. Use one email address for public business enquiries and a different, private address for the Google Account that owns the channel. Read offers on a device that does not hold your main signed-in sessions if you can. If a deal is real, the brand will accept a short delay while you check it. If you manage brand partnerships for several creators, our note on what a hacked creator account means for brand deals covers how to talk to sponsors if something goes wrong.
Recovery of a compromised channel depends on Google's account recovery process and YouTube's review. Nobody outside Google can restore access for you or speed up that review, and some accounts are harder to recover than others, especially when recovery details were changed. Stolen sponsorship money is a separate matter for your bank and the police.
If you spotted a fake offer before clicking, you do not need outside help. A review can help when the channel has already been taken, when the Google Account recovery form keeps failing, or when the channel is a business with staff and brand partners who need clear steps. AwareXone, AwareXone's account recovery service, works only through Google's and YouTube's official routes and never asks for your password or codes. See our YouTube channel help page for how a review works, and our Trust Center for how we handle cases.
More free guides on the same kind of problem.
