A brand deal email arrives: a company loves your videos and will pay you well for one short review. For many creators this is the dream — and scammers know it. Fake sponsor scams are now one of the most common ways YouTube, Instagram and TikTok accounts get stolen. The "deal" is bait; the real goal is your account.
How the scam usually works
There are three common versions:
- The malware file: the "sponsor" sends a contract, brief or promo video to download. The file contains malware that steals your browser login session or passwords — and within hours your channel is posting scam livestreams.
- The upfront fee: the "sponsor" asks you to pay a registration fee, buy the product first at a special price, or pay for "promotion" before they pay you. Real sponsors pay you — they never ask you to pay them.
- The fake payment: they send a screenshot of a payment, then say they overpaid by mistake and ask you to refund the difference. The original payment never existed.
Red flags — check every offer against this list
- The deal arrives out of nowhere, for a small or new channel, with surprisingly big money.
- The sender uses a free email address (Gmail, Outlook) instead of the brand's real company domain.
- The email pushes urgency: "reply within 24 hours or the offer expires".
- You are asked to download or install anything — a brief, a contract, a video, a "product". This is the biggest red flag of all.
- You are asked to pay anything: a fee, a deposit, gift cards, cryptocurrency.
- The "proof of payment" is a screenshot, not a real transaction you can verify in your bank or payment app.
- The brand's real website and social accounts say nothing about this campaign.
- The link goes to a lookalike domain (for example, a brand name with an extra letter or a different ending).
- You are asked for your password, 2FA code, or recovery codes. A real sponsor never asks for these — ever.
- The message is full of odd wording or formatting. Poor writing alone proves nothing, but combined with the flags above it is a strong warning.
How to check a real offer
- Verify the sender's domain: open the brand's official website yourself (type the address, do not click the email link) and check its contact page. Real companies list a real business email there.
- Contact the brand directly: message the brand through its official website or verified social account and ask whether the offer is real. A real brand will confirm; a scammer cannot fake the brand's own reply.
- Check the campaign: search for the brand and the product. A real campaign usually appears on the brand's own channels.
- Never download sponsor files: ask for a web link, or a document you can read in the browser. If they insist on a download, walk away.
- Check the link before you click: paste the URL into our link safety checker — it is a basic check, not a guarantee, but it catches many fake domains.
- Search the brand name plus the word "scam": other creators often report the same fake offer.
If you already downloaded the file
- Disconnect from the internet and run a full antivirus scan on your device.
- From a clean device, change your Google, YouTube, Instagram and TikTok passwords — and any password you reused elsewhere.
- Turn on authenticator-app two-factor authentication everywhere.
- Sign out of all sessions (Google Account → Security → Your devices; Instagram → Where you're logged in; TikTok → Manage devices).
- If your channel or account was taken, follow our YouTube recovery guide or Instagram/TikTok recovery guide.
If you already paid or shared details
- Contact your bank immediately — a fast report gives the best chance of stopping the payment.
- Report the scam account and messages inside the platform where they contacted you.
- Report the crime to your local cybercrime authority and keep screenshots, email addresses and dates.
- Warn other creators — scammers send the same fake offer to hundreds of channels at once.
The rule that protects every creator: a real sponsor contacts you through verifiable channels, pays you (never the other way round), and never asks you to download files or share passwords or codes. If an offer breaks any part of that rule, treat it as a scam until the brand itself proves otherwise.
Track your progress: finished this guide?