Protect your channel: account security for creators and influencers

How channels actually get taken

Fake sponsorship offers

Google's Threat Analysis Group has tracked a campaign since 2019 that targets YouTube creators with fake collaboration offers. The "contract" or "demo" carries malware that steals the browser's login cookies, and the channel is then hijacked and either sold or used to broadcast cryptocurrency scams.

That is how Linus Tech Tips, one of the largest tech channels on YouTube, lost three channels in March 2023. A team member opened what looked like a sponsorship offer. The malware copied the browser's session tokens, which meant the attackers were already logged in: they never needed a password or a two-factor code. The channels streamed crypto scams until YouTube took them down.

Your phone number, taken over

Text-message codes depend on your phone number staying yours. Criminals take numbers over by "SIM swapping" or porting: they talk a telco's customer service into moving your number to their SIM, or pay an insider to do it. The FBI says these schemes are run through social engineering, insider threats and phishing, and that once a number is taken, the criminal simply sends "Forgot password" and "Account recovery" requests and receives your codes.

Criminal groups do recruit telco staff. Microsoft documented one group openly advertising to buy access from employees at telecommunications companies, and a US government review of that group's attacks concluded that text and voice codes are undermined by lax security at telecom firms, recommending that organisations move away from SMS-based multi-factor authentication altogether.

In Australia, telcos have had to carry out additional identity checks before porting a mobile number since 2020, and the regulator continues to take compliance action against telcos whose checks fail. The rules help, but they don't make your number a safe place to receive security codes.

Recovery details nobody checked

Platforms recover accounts through the recovery email and phone number on file. If that email is an old provider address you no longer open, or a number you gave up two phones ago, there is no way back when something goes wrong. Worse, if the recovery mailbox has a weak password and no second factor, it is the easiest door into the channel. And updating details at the last minute doesn't work: Google warns that a changed recovery phone number can take up to seven days to take effect.

Why text messages are the weakest second factor

Google measured this. An SMS code blocked 76% of targeted attacks on Google accounts; a prompt on the user's own phone blocked 90%; and no user who relied on a physical security key fell for targeted phishing at all. The Australian Signals Directorate's advice is the same: use phishing-resistant methods (passkeys or security keys) rather than SMS or voice calls.

The four-step plan

1. Audit your recovery details today

• Open every platform's security settings and check the recovery email and phone number are current and yours.
• Treat the recovery mailbox as part of the channel: a unique password and a passkey or authenticator app on it, and sign in to it regularly so it isn't closed for inactivity.
• Put a reminder in your calendar to re-check every six months and whenever you change phone or email.

2. Get off SMS codes

• Set up a passkey or a physical security key as your second factor on the channel account and the recovery mailbox. YouTube's own advice is a passkey for 2-Step Verification.
• Where passkeys aren't offered, use an authenticator app. Then remove your phone number as a code method so a ported number can't be used against you.
• Save the backup codes somewhere offline.
• If the channel is your livelihood, enrol the Google account in Google's Advanced Protection Program, which requires a passkey or security key to sign in.

3. Protect the number anyway

• Ask your telco what extra protection it offers against unauthorised porting, such as a PIN or a note on the account, and use it.
• Don't publish the number tied to your accounts. A separate, unpublished number for recovery is cheap.

4. Guard the logged-in session, not just the password

• Sponsorship and collaboration offers go to a separate device or browser profile that is never signed in to the channel. Never open an attachment on the channel machine.
• Keep devices patched and scan for malware; YouTube lists this first in its channel-security advice.
• Use the platform's manager and role features instead of sharing a login, and keep a second trusted owner so one lost account doesn't lose the channel.
• Know the recovery page before you need it, and if anything looks wrong, sign out of all sessions immediately, change the password, and start recovery.