YouTube channel hacked, what to do

Your YouTube channel is hacked when someone else is posting as you. It is also hacked when you can no longer sign in to the Google Account that owns it. YouTube says every channel is tied to at least one Google Account. A hacked channel means that account is compromised too.

Recover the Google Account before you edit the channel. YouTube puts the account first, then the cleanup, then security for every person who can manage the channel. The longer checklist is YouTube channel hacked. From that recovery page, YouTube also offers a hacked channel assistant in English, Spanish, and Portuguese.

Signs the channel is no longer yours

YouTube lists these on the recovery page:

• The profile picture, descriptions, email settings, AdSense for YouTube link, or sent messages changed without you.
• Videos appeared that you did not upload. A strike or penalty email may follow.
• You cannot sign in. The password or the recovery details may no longer be yours.

A manager’s own Google Account is a common way in. YouTube says each manager has to secure their own login.

YouTube may set suspicious uploads to private and sign you out. Their private video page says they email you when they do that. Look through those private videos before you make any of them public again.

If you can still sign in

Change the Google password before you touch the channel. That password is also the Gmail password. On a computer, change it like this:

1. Open your Google Account. You might need to sign in.
2. At the top left, click Security & sign-in.
3. Under How you sign in to Google, click Password. You might need to sign in again.
4. Enter a new password, then select Change Password.

Use a password this account has never used.

A password change signs you out of most sessions. Google keeps some sessions. Those are devices you use to prove it is you, some third-party apps you already allowed, and home devices you linked. Review what is left:

1. Open your Google Account.
2. Open Your devices, then Manage devices.
3. If a device is not yours, select Don’t recognize a device? and follow the steps.

Then open Recent security events, under Security & sign-in, and select Review security events. If a line is not you, select No, it wasn’t me. Both checks are on Google’s hacked account page.

Turn on 2-Step Verification next. Google’s steps on a computer:

1. Open your Google Account.
2. Tap Security & sign-in.
3. Under How you sign in to Google, select Turn on 2-Step Verification.
4. Follow the steps on the screen.

YouTube’s channel security page asks for a passkey as the second step. A passkey is a fingerprint, a face scan, or the device screen lock. A hardware security key is the other strong option. Google Authenticator works offline. Text and voice codes are on the list. Google calls them less secure, because of phone-number attacks.

A new 2-Step Verification phone number can take up to 7 days before Google trusts it. On a work or school account, these steps may be blocked. Google says to ask the administrator.

Google will not call you to check a code. Enter the password and any codes only at accounts.google.com. That rule is on their recovery tips.

If you cannot sign in

Go to Google’s account recovery page. YouTube’s recovery article points there. Answer the questions with what you remember.

Google says to avoid skipping questions. A best guess is allowed. A wrong guess does not throw you out. Use a device you often sign in on, your usual browser, and a place you usually sign in, such as home. If they ask for an old password, give the most recent one you recall.

If the reset email does not arrive, check spam and every address you may have used. You can add [email protected] to your address book and request the mail again.

Set a new password as soon as you are in. Then clean the channel.

If the channel was never changed, and you only lost the password, use Locked out of your Google or Apple account. This page is for the case where someone else has the login or the channel.

Clean up the channel

YouTube’s cleanup page has two routes. Owners and managers can use the cleanup tool in YouTube Studio. Anyone else cleans the channel by hand. Open the tool from that help page, on a computer. Start review appears only after YouTube has flagged unusual activity.

In the tool:

1. Click Start review.
2. Check the box next to changes you made. Leave the other person’s changes unchecked. If every line is yours, click I made all changes.
3. Click Next, and read How we’ll fix this.
4. Click Next. Review who has access. Change a role or remove someone if you need to.
5. Finish the extra steps, then click Submit.

YouTube says the fixes should land within a few hours. An email arrives with a tracking link. You can edit the review until the date in that email, usually 30 days. You can change a line you marked as yours. A line you marked as unauthorized stays that way.

Then finish the cleanup in Studio:

• On the dashboard, look for new Community Guidelines strikes. Contact YouTube if you find one, so they can investigate.
• Check the channel name, handle, profile picture, and banner.
• Review the latest comments posted as the channel.
• Check playlists, custom thumbnails, and channels you subscribe to.
• Review AdSense and Content Manager if you use them.

Videos you did not upload

YouTube’s cleanup page splits this in two.

Delete the video when it has no Community Guidelines strike, no copyright strike, and no copyright claim. On a computer, delete it like this:

1. Sign in to YouTube Studio.
2. From the left menu, select Content.
3. Hover over the video. Select Options, then Delete forever.
4. Check the box that says the deletion is permanent.
5. Select DELETE FOREVER.

YouTube starts removal right away. The video leaves search. You cannot get that file back from YouTube. Use this only for uploads you did not make.

If a strike or a claim is already on the video, the cleanup page says to contact YouTube and start an investigation. The recovery page still says every video has to follow the Community Guidelines. A channel can be terminated over videos you never made. When a strike is already there, use the contact path on the cleanup article.

Do the same for videos YouTube already set to private. Their private-video page says those still have to follow the guidelines.

Put the name and the pictures back

Restore the name, handle, profile picture, and banner quickly. The cleanup page gives the reason. A changed name can get the channel suspended for trademark infringement.

On a computer, the channel profile page uses one menu for the name and the handle:

1. Sign in to YouTube Studio.
2. From the left menu, select Customization, then Profile.
3. Enter the channel name, or edit the handle.
4. Click PUBLISH.

You can change the name twice in 14 days. The handle has the same limit. Changing the name removes the verification badge. If the name will not save, delete the channel name translations first. The new name can take a few days to show everywhere.

Profile picture and banner use that same Profile screen. YouTube’s branding page says to click CHANGE, pick the image, click DONE, then PUBLISH.

Remove people you do not know

YouTube says not to share the owner password or other sign-in details. The only access should be accounts you authorized in channel permissions.

On a computer, remove a person:

1. Sign in to YouTube Studio.
2. On the left, click Settings.
3. Click Permissions.
4. Under Role, open the down arrow next to the person and click Remove access.

Only the owner and managers can see names and emails on that list. An owner can delete the channel and manage permissions. A manager can manage permissions and delete content. A manager cannot delete the channel. An editor can upload. An editor cannot remove people or delete published videos. If you cannot open Permissions, you need an owner or a manager whose Google Account is already secure.

If the channel sits on a Brand Account, switch to channel permissions before you add or remove people. That instruction is on the same permissions page.

Ask every other owner and manager to secure their own Google Account. One leftover manager puts the channel back where you started.

Check Gmail on that Google Account

The channel and the inbox travel together. Google’s hacked-account page tells you to remove filters, forwarding, and mail delegation you did not set up. Someone who can read the mail can take the channel back.

Turn off forwarding on a computer, from Gmail’s forwarding page:

1. Open Gmail.
2. At the top right, click Settings, then See all settings.
3. Click the Forwarding and POP/IMAP tab, or the Forwarding tab.
4. In Forwarding, click Disable forwarding.
5. At the bottom, click Save Changes.

A filter can still forward mail after that. Delete filters you did not create:

1. Open Gmail.
2. At the top right, click Settings, then See all settings.
3. Click Filters and Blocked Addresses.
4. Click Delete next to the filter, then click OK.

The rest of the inbox work is Personal email account hacked. Also change the password anywhere you reused this Google password. Google lists sites that email this address, and sites where you sign in with it.

Add a recovery phone and a recovery email you still control. YouTube’s cleanup page points at recovery options. Those are how you get back in next time.

If the channel was terminated

Recover the Google Account first. YouTube says the appeal email arrives in that inbox. An appeal can be refused when account recovery is still incomplete. The form on that page is the hacked-channel appeal.

YouTube’s termination page also has a path inside YouTube Studio:

1. Open YouTube Studio. You may need to sign in again.
2. Under the termination info, click Begin Review.
3. Read the reason, then click Next.
4. Select Start Appeal, then click Next.
5. Enter a contact email, explain the appeal, and click Submit.

If that flow will not open, the termination page links its own form. You have up to 1 year from the termination date, and two appeals in that year. YouTube emails the result. The hacking-support limit further down is 9 months. These are two different clocks.

YouTube also bars a new channel after a termination. You may not use, own, or create another channel to get around it. That includes channels you already have.

When you still need a person

If you are in the YouTube Partner Program, and the Google Account is recovered, YouTube says you can contact Creator Support. When you cannot reach them, the recovery article points to @TeamYouTube on X. The TeamYouTube page says a hacked channel should go to Creator Support, so start there when you qualify.

If you do post, include the channel URL or the video URL, plus a screenshot. Leave out your email, phone number, and card number. TeamYouTube watches the account from Monday 9 AM PT through Friday 5 PM PT. They answer in English, French, Japanese, Korean, Portuguese, and Spanish.

Support for a hacking incident covers the past 9 months. YouTube ties that to how long they keep the data. After that, they may not be able to recover the channel.

YouTube says they cannot always prove the other person is gone. You can still check the parts you control. You can sign in. 2-Step Verification is on. Permissions lists only people you chose. The channel is not publishing videos you did not upload.

When that is true, open YouTube channel hacked and do the prepare list. If the inbox was part of the same break-in, do Personal email account hacked before you close the laptop.

Related playbooks

• YouTube channel hacked. Your channel is posting videos you did not make, or the Google Account that owns it is no longer yours.
• Personal email account hacked. Someone else is in your email, which means they can reset the password on almost everything else you own.
• Locked out of your Google or Apple account. Nobody attacked you. You simply cannot get back into the account that holds your photos, your email, and your two-factor codes.