Free tools Windows power users keep installed
One-click scans. No signup required.
Clicking a phishing link does not, by itself, prove that your YouTube account was taken over. The correct response depends on what happened after the click: whether you entered a Google password or verification code, downloaded or ran a file, see unfamiliar sign-ins or channel changes, or can no longer sign in. Because YouTube access is controlled through your Google Account, secure that account first, then inspect the channel.
Do these things first
- Close the suspicious page and stop entering information. Do not return through the message, email, comment or direct message that contained the link. Type accounts.google.com yourself or use a trusted bookmark. Google says passwords and verification codes should only be entered at that address, and it will not ask for them by email, phone or message.
- If you entered a password or code, change your Google password immediately. Use a new password that has never been used on another site. If the same password was reused elsewhere, change those accounts too, especially accounts that use your Google email address or contain saved payment or personal information.
- Review account activity and devices. In Google Account settings, open Security & sign-in, review recent security events, and inspect Your devices or Manage devices. Sign out sessions you do not recognize and follow Google’s secure-account prompts.
- Check recovery and sign-in controls. Confirm the recovery phone, recovery email, alternate or contact email, two-step verification methods and connected apps. Remove unfamiliar changes and revoke access for apps you no longer need.
- Inspect the YouTube channel. Look for videos, comments, live streams, messages, channel-name changes, profile-photo changes, altered descriptions, modified email settings, and unfamiliar managers or collaborators.
- If a file was downloaded or run, scan the device. Use trusted antivirus software, review unfamiliar browser extensions and applications, and enable Chrome Enhanced Safe Browsing. A click does not automatically mean malware was installed, but a downloaded or executed file changes the risk.
- If you are locked out, start Google Account recovery. Use a familiar device, browser and usual location if possible, and answer recovery prompts carefully.
These steps follow Google and YouTube account-security guidance available on October 13, 2026. Account labels can change, so use the current options shown in your Google Account.
As an Amazon Associate I earn from qualifying purchases.
Work out which situation you are in
Your next action is determined by both what you did and what evidence you can see. A suspicious click with no submitted information is different from entering a password, approving a prompt or running a download.
The Tool Desk
Outbyte PC Repair FREEClear out junk files and repair common Windows errorsFree Scan →Outbyte Driver Updater FREEFix the driver behind crashes, sound loss and screen glitchesFind Drivers →| What happened | Risk interpretation | Priority actions |
|---|---|---|
| Clicked, entered nothing, and see no unusual activity | A warning sign, not proof of takeover | Review security events, devices, recovery settings, connected apps and the YouTube channel |
| Entered a Google password | Treat the password as exposed | Change the Google password through a trusted route; change every reused password; sign out unfamiliar sessions |
| Entered a verification code or approved a sign-in prompt | The attacker may have completed an authentication step | Change the password, review recent events and two-step verification, remove unknown sessions and verify recovery details |
| Downloaded or ran a file | The device may have been exposed to harmful software | Scan the device, remove suspicious software or extensions, then secure the account from a clean device if possible |
| See unfamiliar channel content or settings | Possible YouTube channel compromise | Secure the linked Google Account, remove unknown access and use YouTube’s hacked-channel recovery route |
| Cannot sign in | Possible password or recovery-detail change | Use Google Account recovery and do not give credentials to anyone offering unofficial help |
If you only clicked the link
Do not assume that the account is hacked solely because a page opened. Google and YouTube guidance does not say that every click results in account compromise. The page may have tried to collect information, deliver a download or identify active visitors, but you need account evidence before concluding that access was lost.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Close the page, then sign in through a known route rather than the message. Review recent security events and every listed device or session. Check recovery details, two-step verification and connected apps, and inspect your YouTube channel for changes. If all of those are normal and you entered nothing, you may not need to reset every account password; continue monitoring and strengthen sign-in protection.
If you entered your Google password
Assume the password is no longer secret, even if the page looked exactly like YouTube. Open Google Account settings through accounts.google.com and change it to a unique password. Do not use a variation of the exposed password. A password manager can help generate and store a different password for each service, but it does not replace the immediate account review.
Search your other accounts for password reuse. Change reused passwords directly on those services, giving special attention to your primary email, financial accounts, cloud storage, social accounts and any service that uses the same Google email address for recovery. Changing only the YouTube password is insufficient because YouTube and other Google services use the same Google Account credentials.
After changing the password, inspect recent security events and devices again. An attacker who obtained the old password may already have created a session, changed recovery information or connected an application. A password change is essential, but it is not the entire cleanup.
If you entered a verification code or approved a prompt
A verification code can be as valuable to an attacker as a password. If you typed one into a fake page or approved an unexpected sign-in prompt, treat the event as an authentication compromise. Change the Google password through a trusted route, review the exact time and location of recent security events, and sign out sessions you do not recognize.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Open the two-step verification settings and verify every method listed. Remove unfamiliar phone numbers, authenticator entries, passkeys or security keys, and investigate any method you did not add. Keep methods you control, and add a backup recovery option after the account is clean.
Google notes that several sessions can be legitimate. A session may be created by a new browser, application, service or reauthentication, and the displayed time can reflect background synchronization. Compare the device, browser, approximate location and activity with your own use before signing out a session. When in doubt, sign out and sign in again from your known devices.
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware matchReview Google Account security in detail
Recent security events
Look for password changes, recovery-detail changes, new sign-ins, new devices, two-step verification changes and connected-app authorizations around the time of the phishing incident. Open each event for details. If an event is not yours, use the available account-security action and continue through Google’s prompts.
Your devices and active sessions
Open Your devices or Manage devices and list everything that currently has access. Sign out an unfamiliar phone, computer, tablet, browser or service. Do not rely only on a familiar device name: check the last activity, location and browser information as well.
Recovery phone and email
Confirm that the recovery phone and recovery email belong to you and still work. Check the alternate or contact email as well. An attacker who changes these details can make later recovery harder, so undo any change you did not make and secure the affected email account separately.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Two-step verification
Check the enrolled methods, backup codes and trusted devices. Delete unknown methods and generate new backup codes if you believe the old ones were exposed. YouTube recommends a passkey as the second verification method for strong protection against phishing. A physical security key is another phishing-resistant option.
Connected apps and services
Review every application with access to the Google Account. Revoke access for anything unfamiliar, unnecessary or installed around the incident. Removing an app does not prove what it did previously, so also inspect security events and channel activity.
Inspect the YouTube channel for takeover signs
Once the Google Account is protected, open YouTube and compare the channel with your last known state. Check:
- Videos, Shorts, live streams, playlists or scheduled uploads you did not create
- Comments, community posts, replies or direct messages sent without your permission
- Channel name, handle, profile image, banner, description and links
- Email, monetization or other channel settings that have changed
- Unknown channel managers, owners, collaborators or permissions
- Unusual livestreams or content that could violate YouTube rules and trigger enforcement
Remove unknown managers or collaborators only after recording enough information to recognize the unauthorized change. If the channel identity or content was altered, treat it as a possible channel compromise even if you can still sign in. Secure the Google Account, then use YouTube’s hacked-channel recovery route. Do not promise yourself a particular restoration time or outcome; Google and YouTube determine recovery and enforcement results case by case.
What to do after downloading or running a file
A phishing page that merely opened is not the same as one that delivered a file. If you downloaded a file, do not open it. If you ran it, disconnect the device from sensitive work until it has been checked, and avoid changing account passwords on that device until you trust it.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
- Run a full scan with reputable, up-to-date antivirus software.
- Remove software the scan identifies as harmful, and uninstall applications you do not recognize.
- Inspect browser extensions and remove unfamiliar or recently added extensions.
- Install operating-system and browser security updates.
- From a clean, trusted device when possible, change the Google password and review sessions, recovery details and connected apps.
YouTube recommends antivirus software and Chrome Enhanced Safe Browsing to help avoid malware scams. These measures reduce risk; they do not establish that a particular download was harmless or malicious.
Recover an account or channel when you are locked out
If the password, recovery phone or other sign-in detail was changed, use Google’s official Account recovery flow rather than a third-party “recovery agent.” Google advises using a familiar device, familiar browser and usual location when possible. Answer prompts accurately and provide the most recent information you know; repeated guesses can make the process less reliable.
Never send your password or verification code to someone who claims to work for Google or YouTube. Google explicitly warns that it does not work with services promising account or password support. YouTube’s official channel-security guidance also says: “YouTube will never ask for your password, email address, or other account information in an email, message or phone call.”
If you regain Google Account access but the channel still shows unauthorized content or managers, follow YouTube’s hacked-channel recovery route. Preserve emails, screenshots, timestamps and links to unfamiliar uploads where possible. This documentation can help you describe what changed, but it does not guarantee a particular recovery result.
Do these 3 things before closing this tab:
1Clear out junk files and repair common Windows errors2Fix the driver behind crashes, sound loss and screen glitches3Repair Windows errors before they cause bigger problemsStrengthen sign-in protection after cleanup
Use a phishing-resistant second factor
YouTube recommends using a passkey as the second verification method for the strongest protection against phishing. A physical FIDO2 security key is another option for people who want a separate device. Keep more than one recovery path if appropriate, and understand how you will sign in if your primary phone or security key is unavailable.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Maintain recovery options
Keep the recovery phone and email current, test that you can access them, and store backup codes somewhere protected. Review these settings whenever you change phones, email addresses or devices.
Reduce app access
Grant connected apps only the permissions they need. Remove access when you stop using an app or no longer recognize why it is connected.
Verify messages independently
For sponsorship, brand-deal or account-warning messages, verify the sender through a publicly listed contact or a contact method you already know. Do not use the phone number, email address or link supplied only in the suspicious message.
Common mistakes that prolong a compromise
- Returning to the original link: use a typed or trusted address instead.
- Changing only the YouTube password: YouTube access follows the Google Account, so secure the Google Account and reused passwords.
- Ignoring recovery details: an attacker can retain access through a changed recovery phone, email or verification method.
- Signing out only one device: review every session and connected application.
- Assuming every unfamiliar session is an attacker: new browsers, apps, services and background sync can create legitimate sessions; inspect details before deciding.
- Changing passwords on a potentially infected computer: scan first or use a clean device.
- Hiring unofficial recovery help: never disclose a password or verification code to a supposed agent.
- Deleting evidence immediately: record unfamiliar channel changes and security events before removing content or access.
When should you contact Google or YouTube support?
Use official recovery and hacked-channel routes when you cannot sign in, recovery information was changed, unauthorized channel content remains, or an unknown manager controls the channel. If you can sign in and find no suspicious activity, the self-service security review is the appropriate first step.
Be cautious of anyone who contacts you offering guaranteed restoration, asks for payment to “unlock” the account, or requests a password, verification code or remote access. Official guidance does not authorize those requests.
Quick Recap
A practical checklist
- Closed the suspicious page and stopped entering information
- Used a trusted route to open Google Account settings
- Changed the Google password if a password or code was submitted
- Changed every reused password on other services
- Reviewed recent security events
- Inspected and signed out unfamiliar devices or sessions
- Verified recovery phone, recovery email and two-step verification
- Removed unfamiliar connected apps
- Checked YouTube videos, comments, messages, identity and managers
- Scanned the device after any download or execution
- Started official Account recovery if locked out
- Used YouTube’s hacked-channel recovery route for channel changes
- Added a passkey or physical security key and kept recovery options current
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
