If your YouTube channel was hacked, win back the Google Account behind it before touching the channel: YouTube's recovery guide says a hijacked channel always means at least one linked Google Account was compromised, and nothing you fix on the channel holds while the attacker can still sign in. Then reverse what they changed, with the cleanup tool in YouTube Studio if you are an owner or manager, remove anyone you did not invite, and contact Creator Support if strikes or a termination followed.
The steps below follow the order in YouTube's guide to recovering a hacked channel: recover and secure the account, revert unwanted changes quickly so they do not trigger Community Guidelines or copyright strikes, then reduce the risk for everyone who works on the channel. Hardening an account before anything happens is covered in our SIM swap and account security guide for creators.
Signs it is a takeover, not a glitch
YouTube's recovery page lists two kinds of evidence. The first is changes you did not make: a new profile picture or description, altered email settings, a different AdSense for YouTube association, or messages sent from your account. The second is uploads that are not yours, sometimes announced only by an email about a penalty or strike on content you have never seen.
Google's help page for hacked Google Accounts adds the account-level signs: an unfamiliar recovery phone number, recovery email, alternate email or account name. Any one of those means the problem sits in the Google Account, not in YouTube.
YouTube names malware and phishing among the ways in, the latter often disguised as a service you already use. For creators, that bait can be a fake sponsorship that asks you to open a file or sign in through a link, which our guide to spotting fake brand deal emails takes apart. And treat any “recovery expert” who asks for codes as an attacker: Google's account recovery tips say Google never asks for your password or verification codes by email, phone call or message.
Recovery timeline checklist
First hour: get the Google Account back
- Use a computer or phone, browser and location you normally sign in from, as Google's recovery tips advise.
- If you can still sign in, change the password straight away to one you have never used on that account, then run Google's Security Checkup.
- If you cannot sign in, open Google's account recovery page and answer every question you can. Guess rather than skip; the tips page says wrong guesses do not end the process. Enter the most recent password you remember.
- Watch your inbox and spam folder for an email titled “Your Google support inquiry”.
- Once you are in, open Security & sign-in, choose Review security events, and select “No, it wasn't me” on anything you do not recognize.
- Under Your devices, choose Manage devices, and for anything you do not recognize follow Google's “Don't recognize a device?” steps.
- Put back your recovery phone, recovery email, alternate email and account name if any of them changed.
- Ask every owner and manager on the channel to secure their own Google Account the same way, because YouTube asks all of them to.
First day: clean up the channel
- If you are an owner or manager, open the cleanup tool in YouTube Studio, which appears when YouTube has detected unusual activity, and click Start review.
- Tick the changes you made yourself, read the plan under “How we'll fix this”, review who has access, and submit.
- Keep the confirmation email. YouTube's cleanup guide says changes should be made within a few hours and that you can edit your review until the date in that email, usually 30 days after submitting, but you cannot undo a change you marked unauthorized.
- Without access to the tool, clean up by hand using the audit table below, starting with uploads, unknown users and your channel name, handle, picture and banner.
- Before you delete any video you did not upload, check whether it carries a strike or claim, as explained further down.
- In Gmail, remove any labels, filters or forwarding rules you did not create, since rules like these can keep warning emails out of sight.
- Scan the computer you use for YouTube with trusted anti-virus software. Google also suggests a factory reset and reinstall as a stronger option, after backing up your files.
After the restore
- Check the Studio Dashboard for new Community Guidelines strikes, and contact YouTube to open an investigation if any appear.
- Set up 2-Step Verification with a passkey, add recovery options and turn on Enhanced Safe Browsing, as the cleanup guide recommends.
- Give the channel an email address you use nowhere else, which YouTube suggests so one leaked login cannot open every account you own.
- Recheck Settings, Permissions after a week to confirm nobody new has appeared.
- If cards, tax records or ID documents were saved in the Google Account, contact your bank or local authorities, as Google's hacked-account page advises.
What the attacker changed: an audit table
The cleanup tool covers the common changes, but owners without it, and anyone who wants a second pass, can work down this table. Most rows come from the manual cleanup steps in YouTube's cleanup guide; one is our own addition.
| Area | What to look for | Where to fix it | Source |
|---|---|---|---|
| Google Account security | A recovery phone, recovery email or account name you never set, or devices you do not own | Google Account, Security & sign-in and Your devices | Google: hacked account steps |
| Channel name and handle | A rebrand that makes your channel look like someone else | Studio customization; delete name translations first if the name refuses to update | Cleanup guide |
| Profile picture and banner | Artwork you did not upload | Studio customization, branding section | Cleanup guide |
| Uploads | Videos, Shorts or streams you never made | Content page; check each one for strikes or claims before deleting | Cleanup guide |
| Video privacy | Your own videos switched to private or unlisted so they vanish from the channel | Content page, visibility setting on each video | Cleanup guide |
| People with access | Owners or managers you never invited | Studio Settings, Permissions, and Brand Account permissions if you still have one | Cleanup guide |
| Comments and community | Recent comments posted as your channel that nobody on your team wrote | Your channel's comment history | Cleanup guide |
| Playlists, thumbnails and subscriptions | New playlists, swapped custom thumbnails, or channels you never subscribed to | Playlists, the Content page and your subscriptions list | Cleanup guide |
| AdSense and Content Manager | A changed payment association or settings you do not recognize | AdSense for YouTube and, if you have one, Content Manager | Recovery guide |
| Gmail rules | Filters or forwarding that divert YouTube and Google security mail | Gmail settings, filters and forwarding | Google: hacked account steps |
| Live Control Room | Scheduled or past streams you did not create, and a stream key sitting in someone else's encoder | Live Control Room, Manage and Stream tabs; replace the key | Our addition, not on YouTube's list |
Restore the name, handle, picture and banner first. The cleanup guide warns that leaving those changed risks your channel being permanently suspended for trademark infringement.
Strikes, claims and termination after a hack
YouTube's two hacked-channel pages give different instructions here. The FAQ on the recovery guide says to delete videos you did not upload immediately. The more detailed cleanup guide splits the case: delete attacker uploads that carry no Community Guidelines strike, copyright strike or claim, but contact YouTube to start an investigation when they do. Follow the cleanup guide, because deleting does not help with a strike. YouTube's strike basics page says deleting content does not remove a strike, and that YouTube may still issue a strike on deleted content.
Strikes that land during a takeover follow the usual system, explained in our guide to Community Guidelines strikes and appeals. Tell YouTube the channel was compromised rather than appealing each strike as though you had posted the content yourself.
If the channel was terminated while the attacker had it, the recovery guide says the appeal details arrive by email once you have recovered your Google Account, and that you then appeal through a dedicated form. It also warns that the appeal may not be accepted if the account recovery is incomplete, so finish every first-hour step before you file. Our guide to appealing a terminated YouTube channel covers the wider termination rules, including the ban on using other channels while one is terminated.
Getting help from a person
The recovery guide links to a hacked channel assistant chat. Eligible creators, such as those in the YouTube Partner Program, can contact the Creator Support team once the Google Account is back, and anyone who cannot reach Creator Support can ask @TeamYouTube on X. Our walkthrough of every YouTube Creator Support route shows how to reach each one and how to tell real staff from impostors.
Act quickly. YouTube's recovery guide says its support is limited to hacking incidents from the past 9 months because of its data retention policy, and that it may not be able to recover a channel after that. When you write in, give the date you lost access, the changes you found, and whether the Google Account is now fully under your control.
Is the attacker really gone?
YouTube admits it cannot always confirm that a hijacker has been removed. Its advice is to review the channel and make sure the Google Account is secure. In practice that means a short watch period after the cleanup:
- Review security events again a few days later and confirm that nothing new has signed in.
- Look for fresh drafts, scheduled uploads or streams you did not create.
- Confirm Google security alerts reach your inbox, which proves the hidden filters are gone.
- Compare the permissions list against the people you actually work with.
If a teammate's account was the way in, the recovery guide's advice applies to the whole team: use channel permissions so each person works from their own account at the lowest role they need, and never share passwords. Our YouTube channel permissions guide maps every role to the tasks it allows and includes an offboarding list.
Limitations of this guide
This is general information drawn from YouTube and Google help pages as checked on October 1, 2026. Neither company promises that a hijacked channel can be recovered, menus vary between versions of Studio, and the cleanup tool only appears when YouTube has detected unusual activity. Nothing here replaces YouTube's own support, which alone can reverse strikes or reinstate a channel.
A takeover can also be a crime with consequences beyond YouTube. If money was taken, payment details were exposed or someone is using your identity, report it to your bank and to the police or national cybercrime reporting service where you live, and speak to a qualified professional about any legal exposure from content posted in your name.