Everything here is general guidance, not professional advice. We research carefully and can still be wrong or out of date, so treat it as suggestions to check rather than instructions to follow, and accept that you act on it at your own risk. Full terms.

Disaster Lab
PlaybooksYouTube channel hacked
Accessserious20 minutes to prepare

YouTube channel hacked

Your channel is posting videos you did not make, or the Google Account that owns it is no longer yours.

01DetectConfirm the signal
02ContainStop more damage
03RecoverRestore control
04VerifyProve it works

What do you need right now?

Your preparation

0 of 0 safeguards ready
0%
Continue the prevention checklist

What this means

YouTube says every channel is tied to at least one Google Account. A hacked channel means that account is compromised too. Fixing the channel before the Google Account is a waste of the afternoon. The other person can change it straight back.

The usual aim is a livestream or a video that pushes a crypto scam, a giveaway, or a download, using your name and your subscribers. YouTube also says to delete videos you did not upload immediately. Content on the channel still has to follow the Community Guidelines, and a hacked channel can be terminated over videos you never made.

This is not the same incident as Social media account hacked, and it is not the same as Locked out of your Google or Apple account when you simply lost the password. Here someone else is in the account.

Warning signs

YouTube lists these as signs the Google Account behind the channel may be compromised:

  • Profile picture, descriptions, email settings, the AdSense for YouTube link, or sent messages changed without you.
  • Videos appeared that you did not upload, sometimes with an email about a strike or a penalty.
  • You cannot sign in, or the password and recovery phone are no longer yours.

Also treat it as this incident if a manager on the channel says their own Google Account was taken. YouTube says that is a common way in.

Recover now

First 15 minutes

  1. Secure the Google Account that owns the channel. If you can still sign in, change the password to one you have never used on this account, then turn on 2-Step Verification. YouTube’s recovery page says to do this before you clean up the channel.
  2. If you cannot sign in, use Google’s account recovery. You will be asked questions to show it is your account. Answer with what you remember. When you get in, set a new password you have not used here before. The same page says every owner and manager should do this on their own Google Account.
  3. Do not pay anyone who offers to “restore the channel” or unlock a livestream. That pitch is a second scam. YouTube’s path is the Google Account, then the channel.
  4. Ask other managers to stop using the channel until their Google Accounts are secured. A shared password is not a permission model YouTube wants. Access should be through channel permissions only.

Today

  1. Delete videos, posts, and livestreams you did not upload. YouTube says to do this immediately so the channel is not stuck with strikes for someone else’s content.
  2. Use YouTube’s hacked-channel help to clean up, including the hacked channel assistant linked from their recovery article. Owners and admins may also see a recovery tool in YouTube Studio that lists unusual changes. If you are not an owner or admin, you will not have that tool. Remove people you do not recognise from channel permissions.
  3. Check the channel name, handle, profile photo, banner, and descriptions, and put back what was yours.
  4. If the channel was terminated after the hack, recover the Google Account first. YouTube says the appeal email arrives there, and an appeal can be refused if account recovery is incomplete.
  5. If you are in the YouTube Partner Program and the Google Account is already recovered, YouTube says you can contact Creator Support. If you cannot, they point people to @TeamYouTube on X. They also say support for a hacking incident is limited to the past 9 months, because of how long they keep the data. Older than that, they may not be able to recover the channel.
  6. Check Gmail on that Google Account for filters and forwarding you did not create. The wider checklist is in Personal email account hacked.

Verify recovery

  • You can sign in to the Google Account, and 2-Step Verification is on.
  • Channel permissions list only people you mean to allow, at the role you mean to allow.
  • The channel is not publishing videos or live streams you did not start.
  • YouTube says it is not always possible for them to prove the other person is gone. The check you can actually do is the one above: the Google Account is secure, and the permission list is yours.

After recovery

Write down the channel ID (the part after /channel/ in the URL), the @handle, and the date you lost access. You need those if you still have to file a hijacking report. Keep the termination appeal email if you got one.

If a manager’s account was the way in, remove shared passwords. YouTube says the only access should be accounts you authorised in channel permissions.

Prepare now

Access

  • The Google Account that owns the channel has 2-Step Verification. A security key or an authenticator app works if you do not want SMS. YouTube’s recovery page says both are valid.
  • The recovery phone and recovery email on that Google Account are current. YouTube tells you to review them, because they are how you get back in and how Google warns you.
  • Channel permissions list each person and the lowest role they need. Nobody signs in by sharing the owner password.
  • The channel uses an email you do not also use for random sites. YouTube recommends a different address so one breach does not hand over the channel and everything else.

If the channel makes money

  • AdSense payments go to a bank account you recognise, and more than one person can see a change to that payout.
  • A second owner exists, with their own secured Google Account, so one locked login is not the end of the channel.

Practice

  • You have opened channel permissions once and removed a test user, or confirmed you know where the list is.
  • You know the channel ID and @handle without signing in. They are written down somewhere other than the Google Account.

Common mistakes

  • Editing the channel while the Google Account is still open to the other person. They change it back, and you waste the window YouTube gives you to delete the bad videos.
  • Leaving a manager’s hacked account on the permission list. YouTube calls this out as a normal hijack path.
  • Paying a livestream “support agent.” YouTube’s documented route is account recovery, then the channel, then Creator Support if you qualify.
  • Waiting to delete the videos. YouTube says those videos can bring Community Guidelines trouble, including termination, even though you did not upload them.
  • Sharing the owner password to “save time.” YouTube says not to. Use channel permissions.

Sources

Last reviewed October 31, 2026Guidance changes. Confirm provider-specific actions in the linked official sources.