If you're reading this because your channel just started livestreaming a crypto scam, your videos disappeared, your channel name changed to something with "Elon" or "Tesla" in it, or you simply can't log in anymore -- stop scrolling and start here. This is a step-by-step order of operations, not a general explainer. Do these in sequence.
Step 1: Figure out what kind of access you've lost
There are two very different situations, and they need different responses:
- You can still log in to Google/YouTube, but something is wrong (a strange live stream running, videos you didn't upload, a changed channel name or banner). This means an attacker has access through your account but you haven't lost the account itself yet. Move fast.
- You can't log in at all -- wrong password, or your recovery email/phone was changed. This means the attacker has locked you out. You'll need Google's account recovery flow, which takes longer.
Either way, the first move is the same: assume the attacker got in through a third-party app with OAuth access to your Google account, not through guessing your password. This is by far the most common way YouTube channels get taken over -- a creator accepts what looks like a sponsorship deal, downloads a "media kit" or "collab" app, or signs into a fake "TubeBuddy Pro" or analytics tool with their Google account, and that app quietly has permission to manage their channel. It's a well-documented pattern across the creator economy, and it's why checking connected apps is step one, not step five.
Step 2: If you can still log in -- revoke every connected app immediately
Go to myaccount.google.com/permissions (also reachable via Google Account → Security → "Third-party apps with account access"). This page lists every app and service that has ever been granted access to your Google account, and exactly what they can do -- some will say "Can manage your YouTube account," "Can view and manage videos," or similar.
- Anything you don't immediately recognize: revoke it.
- Anything you recognize but haven't used in months: revoke it.
- Anything with YouTube, Gmail, or Drive access that you're not actively using right now: revoke it.
This single step cuts off the attacker's access even if they still have a valid session token, in most cases -- revoking the app's OAuth grant invalidates the tokens it was issued.
Step 3: Change your password and turn on 2-Step Verification
Go to myaccount.google.com/security:
- Change your password, even if you don't think it was compromised. Use a long, unique passphrase, not a reused one.
- Click 2-Step Verification and set it up if it isn't already on. Choose an authenticator app (Google Authenticator, Authy, or similar) rather than SMS -- SMS-based codes can be intercepted via SIM-swapping, which is a real and rising attack vector for creators with any public profile.
- Generate and save your backup codes somewhere offline (not in the same inbox an attacker might also have touched).
Step 4: Check who else has access, from other devices
Still on myaccount.google.com/security, look at "Your devices" (or go directly to myaccount.google.com/device-activity). This shows every device currently signed into your Google account. If you see a device, browser, or location you don't recognize, click it and sign it out. If your account was compromised, there's a reasonable chance the attacker's session is sitting right there in this list.
Step 5: If you're locked out entirely, use Google's recovery flow
If your password or recovery info was changed and you can't get in at all, go to g.co/recover or the standard "Forgot password" flow and follow Google's account recovery process. Have ready:
- The approximate date you created the account
- Any previous passwords you remember using
- Access to any recovery email or phone still under your control
This can take anywhere from minutes to a few days depending on how much verification Google needs. Don't create a new channel and start re-uploading content in the meantime -- it makes the eventual recovery and any copyright/ownership disputes messier, and YouTube support will generally ask if you've completed the standard recovery flow first.
Step 6: Audit what the attacker actually did
Once you're back in, go through your channel methodically:
- Videos: check for anything uploaded, made public, or unlisted that you didn't do. Attackers commonly upload scam livestreams (fake crypto giveaways using stolen footage) because they're fast to set up and get taken down slower than a normal upload.
- Channel details: name, description, links, and profile picture -- attackers sometimes rebrand a channel entirely to impersonate a company or public figure.
- Comments and community posts: scan for spam or scam links posted under your name.
- Monetization/AdSense: if you're monetized, check that your payment details and linked AdSense account haven't been touched.
- Description links: check every channel and video description for links you don't recognize -- attackers sometimes leave a persistent backdoor link (like a "verify your channel" phishing page) rather than an obvious defacement.
Step 7: Update your recovery info and make a habit of checking it
Go to myaccount.google.com/recovery and confirm your backup email and recovery phone number are current and belong to you. Outdated recovery info is one of the leading reasons creators lose an account permanently after a hack -- if Google can't verify you're the real owner, recovery can fail entirely.
If your channel is on your personal Google account rather than a Brand Account, consider moving it. A Brand Account separates channel ownership from your personal Gmail/Drive/Photos, so a channel-level compromise doesn't automatically expose the rest of your Google account, and vice versa.
Doing this monthly, not just after an incident
Most of the steps above -- connected apps, 2FA status, recent device activity, description links -- are worth checking on a regular basis, not just after something goes wrong, since by the time you notice something's wrong the attacker has often already been in for a while. If you want a quick way to see where your specific channel stands on these without clicking through five different Google settings pages by hand, Securoly runs a full audit of your channel's public setup and (if you connect your account) your permissions and session activity -- free, no paywall on the findings -- and flags exactly which of the checks above need attention.
Whatever tool you use to check, the order above is the part that matters: cut off access first, secure the account second, audit the damage third. Do it in that order and you'll close the door before you start cleaning up the room.