YouTube scams
Last updated September 18, 2026
The short answer
YouTube scams split by audience. Creators are phished with fake copyright strikes and fake sponsorship deals carrying malware. Viewers are targeted by hijacked channels running deepfaked crypto giveaway livestreams. YouTube never sends copyright notices as an attachment.
A YouTube channel is a business asset, and the scams reflect that. The creator-side attack is precise: a copyright strike is the one message a creator cannot ignore, and a sponsorship offer is the one attachment they will open. A stolen channel is then repurposed within hours into a crypto giveaway livestream aimed at its subscribers — which is why so many of those streams appear to come from established accounts with long histories.
How YouTube scams work
- 1
Copyright strike phishing
An email claims a strike has been issued and a channel will be terminated, with a link to appeal. The page is a fake Google login, often paired with a live relay that captures the two-factor code.
- 2
Fake sponsorship deals
A brand deal arrives with a contract and a "product demo" file. The file is an info-stealer that extracts browser session cookies — which grants channel access without any password or two-factor step.
- 3
Hijacked channels running giveaway streams
A stolen channel is renamed and streams a deepfaked or re-uploaded video announcing a crypto doubling giveaway, trading on the channel's existing subscriber base.
- 4
Fake YouTube Premium and comment bots
Phishing for Google credentials through Premium billing notices, and comment-section bots impersonating the creator to direct viewers to WhatsApp.
Warning signs
- A copyright notice arrives with an attachment or a link to appeal off-platform
- A sponsorship deal requires you to download and run a file
- A login page is not on accounts.google.com
- A livestream promises to double crypto you send
- A comment claiming to be the creator directs you to WhatsApp
- A channel's name does not match its video history
- You are asked to act within hours to save the channel
Examples
The sponsorship that took the cookies
A creator receives a well-written sponsorship offer with a contract and a password-protected archive containing a "demo build". The archive is an info-stealer that extracts session cookies. The channel is taken over without the password or two-factor being touched, renamed within two hours, and streaming a crypto giveaway to 400,000 subscribers by evening.
The giveaway with a familiar face
A livestream on a renamed, previously legitimate channel shows a deepfaked technology executive announcing a doubling giveaway, with an address on screen and fabricated chat. The stream runs for three hours and collects payments from viewers who recognised the channel.
What to do
- Check copyright strikes only in YouTube Studio. Real notices appear there and never arrive as an attachment.
- Never download or run files from a sponsorship approach. Ask for a link to a public product page instead.
- Use a hardware security key on the Google account behind your channel.
- After any compromise, sign out of all sessions — cookie theft survives a password change.
- Never send crypto to a giveaway, no matter whose face is on the screen.
Report it to YouTube
Report impersonation and recover a compromised channel through support.google.com/youtube. Real copyright notices appear only in YouTube Studio.
Getting your money back
Recover the Google account first at g.co/recover, then sign out of all sessions — session-cookie theft is the usual mechanism and it survives a password change, so invalidating sessions is what actually ends the compromise. Contact YouTube creator support, which has a channel-recovery process and can reverse a renaming. Run a malware scan and change passwords from a clean device. For viewers who sent crypto to a giveaway, file at ic3.gov with transaction hashes, though recovery is unlikely.
Frequently asked questions
How do I tell a real copyright strike from a phishing email?
Do not tell them apart — check YouTube Studio instead. Every real strike appears there. Genuine notices never arrive as an attachment, never require you to log in through an emailed link, and never demand action within hours.
How do channels get stolen if two-factor is on?
Through session-cookie theft. Malware from a fake sponsorship file extracts the browser cookies that keep you logged in, and those bypass the password and the two-factor prompt entirely. That is also why recovery requires signing out of all sessions, not just changing the password.
Why do crypto giveaway streams appear on channels that look legitimate?
Because they were legitimate. A stolen channel is renamed and repurposed within hours, trading on the subscriber base and watch history it already had. A channel name that does not match its older videos is the visible sign of exactly this.
Other companies scammers impersonate
Scams reuse their scripts across brands. If you were contacted about YouTube, these are the guides worth reading next.