Fake Sponsorship Offers: Brand Deal Scams Aimed at Streamers

The email looks good. It names a company you've heard of, it compliments a specific stream, and it offers a paid sponsorship at a decent rate. There's just one step before the contract: download their product and try it on stream, or log in to their "creator portal" to accept the offer.

That step is the scam.

Red flags covers real brands offering bad terms. This post is about something different: offers where there is no brand at all, only someone after your channel, your logins, or your money.

How the fake-sponsor scam usually works

The best-documented version comes from Google's own Threat Analysis Group (TAG). In a 2021 report on a campaign aimed at YouTube creators, TAG described attackers who "lure their target with fake collaboration opportunities (typically a demo for anti-virus software, VPN, music players, photo editing or online games), hijack their channel, then either sell it to the highest bidder or use it to broadcast cryptocurrency scams."¹

The steps TAG laid out will feel familiar to anyone who has worked a real deal:¹

1. A business email to your public contact address. TAG notes that "Many YouTube creators provide an email address on their channel for business opportunities," and that the attackers "sent forged business emails impersonating an existing company requesting a video advertisement collaboration."
2. A normal-sounding pitch. "The phishing typically started with a customized email introducing the company and its products."
3. The download, after you say yes. "Once the target agreed to the deal, a malware landing page disguised as a software download URL was sent via email or a PDF on Google Drive".
4. Fake company websites to back it up. "The attackers registered various domains associated with forged companies and built multiple websites for malware delivery." Some copied real software sites, and TAG saw a fake social media page that copied a real company's content.
5. A move off email. TAG observed the actors "driving targets to messaging apps like WhatsApp, Telegram or Discord."

What the malware went after matters for streamers in particular. TAG explains that this "Cookie Theft" technique "enables access to user accounts with session cookies stored in the browser." In other words, the attacker can ride your already-logged-in session instead of needing your password, and TAG ties the technique's resurgence to the wider use of multi-factor authentication.¹ Turning on two-step verification still matters, but it doesn't make a malicious download safe to run.

The YouTube campaign is the one Google documented in detail. Nothing about the playbook is YouTube-specific. Any streamer with a public business email has the same inbox.

The common shapes

Most fake sponsorship offers ask for one of a few things. Each one is a request a real brand almost never needs to make that way.

"Download our build / app / press kit to try it first." This is the TAG pattern. A real game studio or software company can send a key through an official store, a link on its own verified domain, or simply let you buy and expense it. Be most suspicious of password-protected archives. TAG warns that encrypted archives "are often bypassing antivirus detection scans, increasing the risk of running malicious files."¹

"Log in to our creator portal to accept the offer." A page that asks for your Twitch, YouTube, or Google password is a phishing page until proven otherwise. Gmail Help's advice is direct: "If you click a link and are asked to enter the password for your Gmail, your Google Account, or another service, don't enter your information, go directly to the website you want to use."²

"There's a small fee first." Onboarding fees, "verification" fees, paying for your own product samples, buying a course to qualify. Sponsorship money flows from the brand to you. Gmail Help's general rule applies: "Never send money or personal information to strangers."²

"Disable your antivirus, it flags our software." TAG specifically notes that attackers "social engineer users into turning off or ignoring warnings."¹ No real sponsor needs you to lower your defenses.

"Click here to see the contract / invoice." The FTC lists messages that "include an invoice you don't recognize" and ones that "want you to click on a link to make a payment" among common phishing tactics.³ A real contract arrives from a person you've already verified, usually through a known e-signature service, and it doesn't need a password re-entry to open.

Urgency and flattery. "We need an answer by tonight" and "you were hand-picked" are pressure tactics. Gmail Help: "Scammers use emotion to try to get you to act without thinking."²

Real brands do ask for some of this, and that's the hard part

A legitimate brand will eventually ask for your banking details and a tax form. Big brands often route that through a supplier portal, which our vendor setup post walks through. So "they asked for my bank details" isn't, by itself, proof of a scam.

The difference is the order and the channel:

• Real: you've agreed terms with a person you verified, there's a contract, and then the brand's accounts-payable team sends onboarding, often through a portal on a domain you can tie to the brand.
• Fake: sensitive details, a login, or a download come before there's a signed deal, from someone you haven't verified, through a link they sent you.

When in doubt, use the FTC's test. If a message asks you to click a link or open an attachment, ask "Do I have an account with the company or know the person who contacted me?" If the answer is yes, the FTC says to "contact the company using a phone number or website you know is real — not the information in the email."³

A five-minute check before you reply

Run through this for any unsolicited offer, before you click a link or open a file:

1. Compare the sender with the company. Gmail Help says to "Check that the email address and the sender name match."² A big brand's marketing team writing from a free webmail address, or from a lookalike domain, is a stop sign.
2. Find the company yourself. Go to the brand's site by typing it in or searching for it, not by clicking the link in the email. Look for a press, partnerships, or contact address there, and ask that address whether the person who emailed you works there.
3. Hover before you click. "On a computer, you can hover over any links before you click on them. If the URL of the link doesn't match the description of the link, it might be leading you to a phishing site."²
4. Refuse executables before a contract. If the deal genuinely depends on trying software, ask for it through an official store or the brand's verified domain. If you must test a file, TAG recommends to "perform virus scanning using an antivirus or online virus scanning tool like VirusTotal to verify file legitimacy" before running it.¹
5. Keep it on email until it's real. If they push you to WhatsApp, Telegram, or Discord before anything is signed, that's the same move TAG documented.¹ Reply on email and keep the paper trail.
6. Never pay to be sponsored. No fee, no deposit, no "refundable" verification charge.

If a message fails any of these, don't reply to argue. Report it and delete it.

Lock down the accounts a scammer wants

The prize in most of these scams is the channel, so protect it the way you'd protect a bank account:

• Turn on multi-factor authentication everywhere you stream and on the email address those accounts use. The FTC: "Multi-factor authentication makes it harder for scammers to log in to your accounts if they do get your username and password."³
• Keep security software on and updated. The FTC recommends you "Set the software to update automatically so it will deal with any new security threats."³
• Take browser warnings seriously. TAG's first recommendation was to "Take Safe Browsing warnings seriously."¹
• Use a separate business inbox for sponsorship mail if you can, so a slip on a deal email doesn't hand over your main account.

If you already clicked

Act quickly and in this order:

1. Scan the device. The FTC says that if you think you opened something that downloaded harmful software, to "update your computer's security software," then run a scan and remove anything it flags.³
2. From a clean device, change your passwords and sign out other sessions on your streaming accounts and their email. Because cookie theft rides existing sessions, signing out everywhere matters as much as the password change.
3. Use the platform's official recovery page if you've lost access. Go there directly, not through any link in a message.
4. Report it. For a phishing email, the FTC says to "forward it to the Anti-Phishing Working Group at reportphishing@apwg.org" and to report the attempt "to the FTC at ReportFraud.ftc.gov".³ Also tell the real company being impersonated, through the contact you found yourself.

FAQ

How can I tell if a sponsorship email is fake?
Check whether the sender's address matches the company, find the company's contact details yourself rather than using the links in the email, and be suspicious of any request to download software, log in through their link, or pay a fee before there's a signed deal. Those are the patterns Google's Threat Analysis Group and the FTC describe.

Why would a scammer want to sponsor a streamer?
Usually they want the channel. Google's Threat Analysis Group documented a campaign that used fake collaboration offers to plant cookie-stealing malware, hijack creators' channels, and then sell them or use them to broadcast cryptocurrency scams.

A brand wants me to download their game or app before signing. Is that a scam?
Not always, but it's the most common delivery method for malware in these campaigns. Ask for a key through an official store or a download from the brand's own verified domain, and don't run password-protected archives or anything that asks you to disable your antivirus.

Do real sponsors ever ask for my bank details?
Yes, but after you've agreed a deal with someone you've verified, usually through the brand's accounts-payable or supplier onboarding. A request for bank details, logins, or a fee before any contract exists is a warning sign.

Does two-factor authentication protect me from these scams?
It helps a lot against stolen passwords, and you should turn it on. But Google's Threat Analysis Group notes that cookie theft hijacks sessions already stored in your browser, so two-factor authentication doesn't make it safe to run a malicious download.

Where do I report a fake sponsorship email?
The FTC says to forward phishing emails to the Anti-Phishing Working Group at reportphishing@apwg.org and to report the attempt at ReportFraud.ftc.gov. Also let the impersonated company know, using contact details you looked up yourself.