A fake brand deal scam sends you a personalised sponsorship offer, negotiates your rates, then points you to a “collab platform” that asks you to sign in with Google to verify your channel. That sign-in page is fake, and it hands your password and one-time code to the attacker. Confirm every offer through the brand’s own website, and never sign in from a pitch.
ESET researchers documented the pattern on 7 October 2026 (welivesecurity.com, October 2026), and Help Net Security reported it a day later (helpnetsecurity.com, October 2026). The emails reached YouTube creators in Peru, Japan and English-speaking markets.
Below: how it runs, the red flags, a five-minute check, recovery, and a safer way to publish your contact details.
Key Takeaways
- The target is your Google account. The “verify channel ownership” step is a fake Google sign-in.
- The brands named in the emails are impersonated. Hollyland and AndaSeat have both publicly warned creators about these offers.
- Verify outside the email. Find the brand’s contact details yourself and confirm the offer and the sender.
- Passkeys are the strongest guard. Google says they can’t be copied or accidentally given away.
- Publish a business inbox, protect the owner account. Brands need a way to reach you, never your channel login.
How does the fake brand deal scam work?
It’s a fake sponsorship negotiation. A personalised email references your videos, and once you reply with rates, you’re sent to a polished collaboration platform that pulls your public channel data. It then asks you to sign in with Google to prove you own the channel, on a login page that sends whatever you type to the attacker.
ESET traced one campaign from the first email to the login request (welivesecurity.com, October 2026):
- The email. A journalist in Peru got a “Paid collaboration opportunity” from “Brandi,” supposedly of Hollyland’s creator partnerships team. It referenced her videos, but the sender’s domain had nothing to do with Hollyland.
- The negotiation. She replied with her rates. Nothing had asked for a password yet.
- The platform. “Brandi” sent her to
joinmatchy[.]comto verify her stats, agreement and payment. The site shows campaign metrics, brand logos, an income calculator and contract tools. - The sign-in. A “Sign in with Google” prompt, framed as verifying ownership, opens an imposter login page that captures the password and one-time code.
- The takeover. The attacker now holds Gmail, Drive and the channel (helpnetsecurity.com, October 2026). In one case ESET cites, they replaced the victim’s phone number and recovery email with their own and added their own backup codes, to block recovery.
Which fake platforms and brand names has it used?
The scam is modular: the same fake platform returns under new names and domains, wearing a different brand each time. ESET tracked two platform names, and Help Net Security added two more from other reports. None of the brands named in these emails sent them.
Domains are written with [.] on purpose. Don’t visit them.
| Platform | Domains | Reported by |
|---|---|---|
| MATCHY | joinmatchy[.]com, matchyjoin[.]com | ESET |
| SCOUTY | joinscouty[.]com | ESET |
| TUBIVE | mytubive[.]com | Help Net Security, citing other reports |
| Creoventura | creoventura[.]com | Help Net Security, citing AndaSeat’s warning |
ESET’s main case impersonated Hollyland, which warned creators itself, and near-identical variants used the names of Nike and Spotify. The names and domains changed repeatedly between June and August (welivesecurity.com, October 2026).
Help Net Security notes reports naming Maono too, and quotes AndaSeat: “Creoventura is NOT affiliated with AndaSeat in any way.” Creoventura’s site had listed AndaSeat, Hollyland and Maono as brands it works with (helpnetsecurity.com, October 2026).
The research describes YouTube creators. Our inference, not a finding: Instagram and TikTok creators who list a business email should expect similar lures.
What are the red flags in a sponsorship scam email?
The clearest red flag is a sender domain that doesn’t match the brand. Next comes any step that asks you to sign in, authorise an app or “verify” your channel on a site you didn’t find yourself. Real sponsorships run on email, a contract and an invoice, none of which needs your password.
| Red flag | What a real brand deal looks like |
|---|---|
| Sender domain unrelated to the brand | The brand’s own domain, or an agency the brand confirms |
| A “collab platform” you’ve never used | Terms agreed by email and contract, or on a tool you chose |
| ”Sign in with Google to verify channel ownership” | The brand reviews your public channel, media kit or stats you send |
| Social icons that open generic homepages | Links to the company’s real, active profiles |
| Testimonials from people with no online footprint | Named contacts you can find on LinkedIn or the brand’s site |
| Pressure to sign up before you can ask questions | Time to read the brief, contract and content usage rights |
Rows four and five come from Help Net Security’s teardown of the Creoventura site, whose domain was registered in August 2026 for one year with ownership hidden (helpnetsecurity.com, October 2026). The last row is from an FTC alert for influencers (consumer.ftc.gov, April 2024).
A genuine offer reads like a well-built brand pitch: specific, from a company address, and never asking for your login.
How do you check a brand deal is real in five minutes?
Do the checking outside the email. Look up the brand’s official site yourself, find its partnerships contact, and ask whether the offer and the person who sent it are genuine. If anything asks you to sign in before a contract exists, stop there.
| Minute | Check | Pass if |
|---|---|---|
| 1 | Read the sender address after the @ | It matches the brand’s domain, found by your own search |
| 2 | Find a partnerships contact on the brand’s site, not via the email | A contact route exists independently of the email |
| 3 | Ask that contact: “Did this person on your team send this?” | The brand confirms the person and the offer |
| 4 | Check the domain of any platform the email links to | It belongs to the brand or a tool you already use |
| 5 | Search the platform or agency name plus “scam” | Nothing but the company’s own pages |
The FTC puts it plainly: “Contact the company directly to confirm the offer. But use information you know is real” (consumer.ftc.gov, April 2024).
What should you do if you already signed in?
Move fast and work only from Google’s own pages, never the suspicious site. If you can still sign in, review security events, devices, recovery details and linked apps, then change your password. If you’re locked out, use Google’s account recovery page, then clean up the channel.
- Review the account. Open Security & sign-in, review recent security events and check your devices (support.google.com, October 2026).
- Restore recovery details. Check your phone number, recovery email and backup codes, the settings changed in ESET’s case. Then turn on 2-Step Verification.
- Remove unknown linked apps. On Google’s linked apps page, “Stop using Sign in with Google” removes an app’s link (support.google.com, October 2026).
- Fix the channel. YouTube says to recover the Google Account first, then revert unwanted changes immediately to avoid Community Guidelines or copyright strikes (support.google.com, October 2026). Owners and managers can use the YouTube Studio cleanup tool.
- Get help early. Eligible creators, such as YouTube Partner Program members, can contact Creator Support, or reach @TeamYouTube on X. Support covers incidents from the past nine months.
- Warn your contacts. ESET notes a hijacked account can be used to message your followers and collaborators.
How do you keep your public inbox away from your channel login?
Split the address you publish from the account that owns your channel. Brands get a business inbox with no role on the channel, while the owner account stays private, protected with a passkey, and never signs in from a pitch. Anyone who helps run the channel gets their own access.
Publish a dedicated business inbox. If it’s phished, you lose an inbox and keep the channel. Use the same address everywhere brands look, including the links on your YouTube About page.
Put a passkey on the owner account. YouTube lists clicking a link in a “fake sponsorship or brand deal email” as a way malware gets in, and says passkeys provide the strongest protection against phishing (support.google.com, October 2026). Google adds that passkeys can’t be shared, copied, written down or accidentally given to someone else (support.google.com, October 2026).
Consider Advanced Protection. It requires a passkey or security key to sign in, limits third-party app access and tightens account recovery (support.google.com, October 2026).
Use channel permissions for your team. They let people manage your channel without access to your Google Account, which YouTube calls safer than sharing your password (support.google.com, October 2026).
Your bio page is often where brands find you, so make the contact route deliberate. A More.You page can carry the business inbox in a text block, a FAQ block on how you take brand inquiries, and a booking block for discovery calls. Add your creator media kit and the brands you’ve actually worked with, and you have a public record to hold any offer against.
Scammers count on a scattered contact route and an owner login one click away. Create your More.You page and give real partners one clear way in, read by people and by AI agents alike.
FAQ
Do real brands ask you to sign in with Google to verify your channel?
A real sponsorship doesn’t need your Google login. If a tool asks anyway, ESET’s advice is to check the page sits on accounts.google.com and read the permissions list. A site that only needs to verify your channel has no reason to manage it.
What is a YouTube channel hijack?
It’s when someone takes control of the Google account behind your channel. YouTube says a hacked channel means at least one associated Google Account is compromised, so recovery starts with the account, then the channel.
Do sponsorship scam emails target Instagram and TikTok creators?
ESET’s research describes YouTube creators, so any spread beyond YouTube is our inference. The FTC has separately warned influencers about fake “brand ambassador managers” who reach out on social media and ask for bank details.
Can a passkey stop brand deal phishing?
It closes the main hole, because a passkey can’t be copied or handed over the way a typed password can. If you still sign in with a password and code, that route stays open. Advanced Protection goes further and requires a passkey or security key.
Sources
- ESET, “Inside a brand deal scam targeting YouTube creators,” 7 October 2026 (welivesecurity.com, October 2026)
- Help Net Security, “YouTubers targeted with fake sponsorships and ‘channel verification’ phishing,” 8 October 2026 (helpnetsecurity.com, October 2026)
- YouTube Help, Secure your YouTube channel (support.google.com, October 2026)
- YouTube Help, Recover a hacked YouTube channel (support.google.com, October 2026)
- YouTube Help, Clean up a hacked YouTube channel (support.google.com, October 2026)
- YouTube Help, channel permissions (support.google.com, October 2026)
- Google Account Help, Secure a hacked or compromised Google Account (support.google.com, October 2026)
- Google Account Help, linked apps (support.google.com, October 2026)
- Google Account Help, 2-Step Verification (support.google.com, October 2026)
- Google Account Help, passkeys (support.google.com, October 2026)
- Google Account Help, Advanced Protection Program (support.google.com, October 2026)
- FTC, “Influencers: Spot a job scam,” 2024 (consumer.ftc.gov, April 2024)
- More.You product brief, section 2 (text, FAQ, booking and link blocks)
