Recommended Free Tools
Inspect the complete sender address and domain, then verify the offer through a phone number or contact you found independently. Do not click the message’s links, open unexpected files, send money, or provide account details while you check it.
A sponsorship email can be genuine: eligible creators may see inquiries in YouTube Studio’s Creator Partnerships area, while YouTube also documents legitimate offline inquiries, including email. Treat every message as unverified until the sender, campaign and requested action all make sense.
As an Amazon Associate I earn from qualifying purchases.
The 30-second safety check
Before you click anything, keep the message open but inactive and run this sequence:
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Outdated Drivers Are Slowing You Down
One free scan finds every outdated or missing driver and matches the right update for your exact hardware.Free scan · exact hardware match- Expand the sender details. Compare the full address and domain—not just the display name—with the company’s independently located official website.
- Read for pressure. Urgency, an implausibly large payment, demands for immediate action, or a request for upfront money are reasons to stop.
- Classify every attachment. Do not open unexpected executables,
.scrfiles, encrypted or password-protected archives, or software installers. - Ignore message links for sign-in. Never enter your Google password or channel credentials after following a link in an unsolicited offer.
- Verify outside the message. Use a phone number published on a trusted platform or contact a representative you already know. Do not use the phone number, link or reply address supplied only in the suspicious email.
- Secure the account separately. Enable two-step verification and consider a passkey or FIDO2 security key. These protect your account; they do not prove that an offer is authentic.
If any check fails, do not proceed with the deal until the company confirms it through an independent channel.
#1 Best Overall
- POWERFUL SECURITY KEY: The YubiKey 5C NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5C NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5C NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Where legitimate YouTube partnership inquiries appear
YouTube Creator Partnerships gives eligible creators a campaign-inquiry area in YouTube Studio. Inquiries through that area can generate notifications. Availability depends on the creator’s eligibility and country or region, so the feature is not evidence that every channel should have it.
YouTube also says that brand inquiries may arrive offline, including by email or through social handles. Therefore, an email is not automatically fake simply because it did not arrive in Studio, and an inquiry shown in Studio is not a substitute for checking the campaign details. Review the proposed deliverables, negotiate terms with the brand and verify the people involved.
| Check | Creator Partnerships in Studio | Offline email or social inquiry |
|---|---|---|
| Where you see it | Inside the eligible creator’s YouTube Studio workflow, with associated notifications | In your normal mailbox or social inbox |
| Eligibility | Limited by YouTube program and regional eligibility | No YouTube feature eligibility is required to receive a message |
| What still needs checking | Brand identity, campaign scope, payment terms and requested actions | Full sender address, domain, brand identity, campaign scope, payment terms and requested actions |
| Safe next step | Use Studio to review the inquiry, then confirm unusual claims independently | Do not use message links or attachments; locate an official contact route yourself |
Polished logos, a familiar campaign name or the fact that a message mentions your channel do not authenticate an offer. Attackers can copy public information and branding.
The Tool Desk
Outbyte PC Repair FREERepair Windows errors before they cause bigger problemsFix Now →Outbyte Driver Updater FREEScan for outdated or missing drivers - takes under a minuteDriver Scan →Inspect the sender address, not the display name
Expand the full address
Email programs often show a friendly name such as a company or employee. That name is editable and is not proof of origin. Open the sender details so you can see the complete address and domain. Look for a public mailbox provider being used to impersonate a company, an unexpected country-code domain, extra words or punctuation, and a domain that differs from the company’s normal web address.
Catch lookalike domains
Fraudulent domains are designed to be read quickly. A single substituted letter, an added hyphen, a doubled character or a different top-level domain can make an address appear familiar. Read the domain from right to left: identify the registered company name immediately before the final domain suffix, rather than trusting a phrase earlier in the address. A sender such as [email protected] is controlled by the latter domain, not by the brand named in the local part.
Do not treat a matching-looking address as conclusive either. A compromised mailbox or a forged message can still use a plausible domain. Sender inspection is a screening step; independent confirmation is the authentication step.
Rank #2
- POWERFUL SECURITY KEY: The Security Key C NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key C NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key C NFC via USB-C and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Compare with a source you found independently
Open a new browser tab and locate the company’s official website yourself, using a bookmark or a search result you trust. Compare the listed domain and contact information with the email. Do not follow the message’s website link to perform this comparison, because a copied site can be part of the attack.
Do these 3 things before closing this tab:
1Repair Windows errors before they cause bigger problems2Fix the driver behind crashes, sound loss and screen glitches3Clear out junk files and repair common Windows errorsRead the offer for social-engineering signals
Urgency is a deliberate tactic
Messages that demand a signature, payment or download within minutes are trying to prevent careful checking. Google’s phishing guidance summarizes the response as “Slow it down – Scams are often designed to create a sense of urgency.” A real campaign can have a deadline, but a deadline does not justify bypassing verification. Ask for time to review the contract and confirm the sender through a separate channel.
Unusually generous or vague promises
Be cautious when compensation is far above what the sender could reasonably know about your channel, when the email avoids naming the product or campaign, or when it promises guaranteed payment before discussing deliverables. Check whether the proposed audience, format, usage rights and timeline fit your channel. A plausible-sounding campaign name can still be a lure for a download or payment request.
Requests for money or sensitive information
Do not send advance payment, “shipping” money, taxes, gift cards or other funds to receive a product or unlock a deal. Google describes an influencer scam in which a fake brand offer is followed by a demand for product or shipping money upfront. Its guidance also states: “No reputable person or agency will ever demand payment or your personal information on the spot.”
Pause if a sender asks for your Google password, recovery codes, two-step verification codes, channel ownership, payment-login credentials or a copy of identity documents before the business relationship is established. A legitimate contract may require ordinary business information through a verified process; it should not require surrendering control of your account.
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Repair Windows errors before they cause bigger problemsFix Now →Scan for outdated or missing drivers - takes under a minuteDriver Scan →Unexpected changes in the conversation
Watch for a switch from a normal business discussion to an urgent request to install “brand software,” open a protected document, disable security controls or move the conversation to an unfamiliar service. The change itself is a warning sign, especially when the person refuses a phone call through the company’s published number.
Rank #3
- POWERFUL SECURITY KEY: The YubiKey 5 NFC is the most versatile physical passkey, protecting your digital life from phishing attacks. It ensures only you can access your accounts
- WORKS WITH 1000+ ACCOUNTS: Compatible with popular accounts like Google, Microsoft, and Apple. A single YubiKey 5 NFC secures 100+ of your favorite accounts, including email, password managers, and more
- FAST & CONVENIENT LOGIN: Plug in your YubiKey 5 NFC via USB and tap it, or tap it against your phone (NFC), to authenticate. No batteries, no internet connection, and no extra fees required
- MOST SECURE PASSKEY: Supports FIDO2/WebAuthn, FIDO U2F, Yubico OTP, OATH-TOTP/HOTP, Smart card (PIV), and OpenPGP. That means it’s versatile, working almost anywhere you need it
- PRIMARY & SPARE KEYS: Just like having a spare house key, we recommend buying two YubiKeys - one for daily use and one as a spare. That way you’ll never get locked out of your accounts
Treat links and attachments as hostile until verified
Do not open suspicious files
TeamYouTube warns that attackers may send convincing brand materials and ask creators to download a file disguised as a contract, media kit or proprietary software. The file can be the attack rather than a genuine campaign document.
Do not open unexpected executables or .scr files. Do not open encrypted or password-protected archives merely because the sender supplies a password in the same email. Encryption can prevent ordinary scanning from inspecting the contents; a plausible filename does not make the file safe. Do not install software sent by an unknown contact.
Do not sign in from a message link
A link can lead to a page that imitates Google, YouTube, a document service or a brand portal. If you need to check your account, type the known service address yourself, use a bookmark or open the official app. YouTube states: “YouTube will never ask for your password, email address, or other account information in an email, message or phone call.”
Preview without interacting
You can read the plain text of an offer and record the sender details without activating links or files. If your mail client automatically previews attachments, close the preview and use the service’s reporting or quarantine controls. Do not reply with your phone number or confirm that your address is active until the sender has been independently verified.
Verify the company independently
- Write down the claimed company, campaign and representative. Note the requested deliverables, payment terms, deadline and any file or website name without opening it.
- Find a trusted contact route. Locate the company’s official website through a route unrelated to the message. Use a phone number published there or on another trusted platform, or contact a representative you have worked with before.
- Ask a narrow confirmation question. State that you received an offer from the named person, include the campaign name and sender address, and ask whether the company sent it. Do not forward a suspicious attachment unless the company’s security team specifically requests it through a verified process.
- Wait for confirmation before acting. A reply from the original address, a second email in the same thread or a confirmation from another address controlled by the same unverified domain does not count as independent verification.
- Check the terms after identity is confirmed. Confirm the legal entity, deliverables, payment schedule, usage rights, exclusivity, cancellation terms and who supplies products. Verification of the sender does not make every contract term acceptable.
If the company cannot confirm the message, report it as phishing or spam and do not continue the conversation.
Keep channel credentials and access under your control
Separate account protection from offer verification
Two-step verification, passkeys and physical FIDO2 security keys reduce the chance that a stolen password will be enough to access your account. They do not tell you whether a sponsorship is real. A scammer can send a convincing offer even when your account is well protected, so continue to verify the sender and campaign.
Rank #4
- POWERFUL SECURITY KEY: The Security Key NFC is the essential physical passkey for protecting your digital life from phishing attacks. It ensures only you can access your accounts.
- WORKS WITH 1000+ ACCOUNTS: Compatible with Google, Microsoft, and Apple. A single Security Key NFC secures 100 of your favorite accounts, including email, password managers, and more.
- FAST & CONVENIENT LOGIN: Plug in your Security Key NFC via USB-A and tap it, or tap it against your phone (NFC) to authenticate. No batteries, no internet connection, and no extra fees required.
- TRUSTED PASSKEY TECHNOLOGY: Uses the latest passkey standards (FIDO2/WebAuthn & FIDO U2F) but does not support One-Time Passwords. For complex needs, check out the YubiKey 5 Series.
- BUILT TO LAST: Made from tough, waterproof, and crush-resistant materials. Manufactured in Sweden and programmed in the USA with the highest security standards.
Never hand over control
Do not share your password, recovery codes or one-time verification codes. Do not approve an unexpected sign-in prompt. Do not add an unknown person as an owner or manager of the channel because a message claims that access is required to review campaign analytics. Use YouTube’s documented permission and business workflows only after the company and contract are verified.
Use official security guidance
YouTube’s channel-security guidance recommends browser and account protections and discusses physical security keys as phishing-resistant authentication. Set up these protections by navigating directly to your account settings, not through a sponsorship email. Keep your browser and operating system updated and use reputable security scanning on files you already downloaded.
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.What to do if you already clicked or downloaded something
If you only clicked a link
Stop interacting with the message. Close the page without entering information and open your account by typing the official service address yourself. Check the device with your security software, update the browser and review the account’s security activity from the official account interface.
If you entered a password or code
Use the official Google account security page directly to change the password, review active sessions and remove unfamiliar access. Re-establish two-step verification and replace compromised recovery information. If the channel shows unauthorized changes, follow YouTube’s official channel-recovery guidance rather than instructions in the email.
If you opened or installed a file
Stop using the file and disconnect the affected device from sensitive work until it has been scanned. Do not reconnect the file to other computers or cloud storage to “see whether it works.” Run reputable security scans, install updates and seek qualified incident-response help if the device or channel behaves unexpectedly. The email itself is not a safe source of cleanup instructions.
The exact recovery steps depend on what happened and which accounts or devices were involved. The essential order is to stop the interaction, secure the account through official pages, scan the device and use YouTube’s recovery process for any channel compromise.
Best Value
- FIDO2 & Passkey Ready: Business-ready and FIDO2 L1 certified. This key is supported by major management suites and is ideal for both individual and enterprise deployment. Works seamlessly with Gmail, Facebook, GitHub, Dropbox, Coinbase, and more.
- Universal Connectivity (USB-A ): Features a built-in USB-A connector—simply unfold the key and plug it into your compatible PC or laptop for seamless authentication on the go.
- Dedicated Manager App: Use the Thetis Manager App for the initial hardware PIN setup. Setting the PIN on the device first ensures a smooth registration process. Once the PIN is configured, you can begin registering the key across your favorite FIDO2-compatible online services.
- Ultra-Durable & Portable: Featuring a rotating metal cover, this key is water, crush, and tamper-resistant. It fits easily on a keychain and requires no batteries or network connectivity.
- Check FIDO2 compatibility before purchase - Known limitations: ID Austria is not supported (requires FIDO2 Level 2). Windows Hello login only works with Windows Enterprise editions that support Entra ID, and NFC is NOT supported.
Common scenarios and the correct response
“The sender uses a free mailbox, but the offer looks professional.”
A public email address is a warning sign when the person claims to represent a company, but it is not the only test. Do not click or send information. Locate the company’s published contact route and ask whether it authorized the message. If it cannot confirm the offer, discard it.
“The email includes a password-protected contract.”
Password protection does not make an unsolicited file trustworthy. TeamYouTube specifically warns about encrypted or password-protected files in fake brand-deal messages. Request a verified, safe document-sharing process after the sender is confirmed; until then, do not download or open the file.
“The message says I must pay shipping today.”
Stop. Upfront product or shipping demands are a documented influencer-scam pattern. Do not pay, provide card details or let the deadline pressure you. Verify the campaign through an independently located company contact.
“The inquiry is visible in Creator Partnerships.”
Use the Studio workflow to review it, but still examine the campaign, sender and requested actions. Program visibility does not remove the need to confirm unusual payment, download or account-access requests.
A reusable pre-click checklist
- Full sender address and domain expanded
- Domain compared with the company’s independently located official site
- No public mailbox or lookalike spelling used to impersonate the brand
- No urgent deadline that prevents verification
- No implausible payment promise or demand for upfront money
- No request for a password, recovery code, personal information or channel access
- No unexpected executable,
.scr, encrypted archive or installer opened - No message link used for Google or YouTube sign-in
- Company confirmed through a trusted phone number or known representative
- Two-step verification, passkey or security key enabled independently of the offer
Any unchecked item is a reason to pause, not a reason to negotiate faster. A legitimate brand can wait while you confirm who sent the message and what it asks you to do.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
