YouTube is one of the longest-tenured content sharing platforms still dominating video hosting today. Since its launch in 2005, YouTube has seen its fair share of viral moments — both in funny videos and company controversies. One of these corporate black eyes is scammers on the platform. As you will come to learn, this has hurt YouTube in both their reputation and their wallet. Keep reading to learn more about YouTube’s struggles with scammers and ways you can keep yourself safe.
Why Scammers Survive on YouTube
YouTube provides a surplus of ways to scam unsuspecting users and an environment to reach these targets easily. Many people use YouTube as a public library of helpful tips and guides. “How to (insert task here)” is a common phrase you’ve probably entered before in a YouTube search query.
Scammers use this to their advantage. They may post a fraudulent how-to video leading viewers to download malware or visit a phishing website. This is often done by dropping a malicious link in the video description or on screen during the video. They may also target the comments of a legitimate video to use its credibility to push their scheme.
To illustrate this, we will use Timmy. Timmy is a young viewer looking for a way to earn virtual currency (VC) in a popular video game he likes to play. His favorite YouTuber streams the game and posts highlights to his channel. In the comments, he sees the YouTuber posted a link to earn free VC for liking videos. Eagerly, Timmy clicks the link and imagines the fictional fortune he’s about to make.
Common Types of YouTube Scams
As you may have guessed, our friend Timmy is about to enter a common scam on YouTube — a fake product promotion. This is a popular tactic used by cybercriminals on the platform, but it’s far from the only scam targeting users. The following are some of the scams our experts see most frequently on YouTube.
Fake Product Promotion
As the name implies, this scam involves the promotion of a product that doesn’t exist. Scammers may post videos advertising a product that are misleading or completely fabricated altogether. They may also link to fraudulent listings under legitimate videos advertising real products or discussing related topics.
This is what occurred to our friend, Timmy. While watching a video discussing his favorite game, He thought his Idol posted a link to earn VC. What he didn’t realize was that the uppercase “I” in his username was actually a lowercase “l”. This was a phishing account that did not actually belong to the YouTuber who posted the video.
Giveaway Scams
Instead of posting a sham product promotion, some scammers may pretend to give away a fake prize. This can consist of a YouTuber running a giveaway with no intention of selecting a real winner and awarding a prize in an attempt to farm engagement. It can also include posing as a popular creator on the platform and using their clout to capitalize on a fake giveaway.
The goal is usually to collect personal information or even directly ask for money. Scammers will typically ask their targets to divulge shipping data and other credentials. They may even ask the supposed “winner” to pay a small fee to initiate the shipping process of an item they will never receive.
Malware Attacks
Instead of pushing a fake product or giveaway, scammers may try to get you to click a malware-ridden link. These are typically listed in video descriptions or comments on videos promoting some sort of “life hack” or shortcut.
These programs can be used to impact device performance, survey and gather intel on victims, as well as harvest online credentials. They are often employed to jumpstart or in coordination with larger fraudulent attacks like extortion or identity theft.
Misinformation and Deepfakes
YouTube has earned a reputation as one of the internet’s prime locations for housing conspiracy theory content. Unconfirmed and ungrounded information is often discussed — and even passed off as fact — by creators on the platform. This misinformation cycle has only been perpetuated by the advent of AI-generation software.
Users can easily create and share deepfake content cheaply and with quick turnaround times. This allows scammers to spread misinformation, acquire fraudulent product promotions, tarnish the reputations of public figures, and much more.
Scammer Training Material
Sometimes, scammers aren’t using YouTube to actively push a scheme. Instead, they utilize the platform’s video-sharing capabilities to spread training material and recruit new scammers. This is an especially common tactic by sextortion groups such as the Yahoo Boys in Nigeria.
“Those we’ve seen on YouTube provide a step-by-step tutorial in how to commit these blackmail offences from start to finish, including creating fake online accounts, obtaining a texting number, tips on how to target victims and how to realize the profit of the crime,” said Senior Manager for the National Crime Agency Adam Priestley
These guides provide cheap insight on everything from creating convincing phishing accounts to determining which targets will be most susceptible. They often tout previous success in scamming, including their number of successful “clients” and accumulated wealth.
“There is advice to criminals to target secondary schools, and instructions on how to threaten victims and the language to use. There are examples of the tutorials available for sale online, offered as a ‘full blackmailing guide’ at a cost of around 10,000 Nigeria Naira (roughly $7).”
Real-World Cases of YouTube Scams
So far, we’ve followed the journey of our friend, Timmy. While Timmy is not a real person, his fictional experience is very similar to those of actual YouTube users. By revisiting their experiences, we can get a better idea of how scammers operate on the platform. This allows us to create a better response and keep ourselves safe.
Popular YouTube Channel Hacked to Promote Crypto Scam
In 2022, YouTuber Scuba Jake had his channel of over 13 million subscribers hacked and used to pedal a crypto scam. The criminals acquired roughly $21,000 in Bitcoin by convincing users to send funds to fraudulent wallets.
After compromising the channel, the hackers changed the name and profile to impersonate the crypto and business intelligence firm MicroStrategy. They then hosted livestreams that consisted of old, legitimate videos from CEO Michael Saylor. These livestreams directed users to send cryptocurrency in order to receive a bonus from Saylor, a common tactic in crypto scams.
Stephen Carr found himself the victim of a similar scam on YouTube. The Ontario resident lost roughly $500,000 — his entire life savings — to the scheme. He was lured in by a scammer’s YouTube video promising lucrative returns for investing in their project.
The portfolio was convincing, and Carr was even able to make an initial withdrawal of $1,000 with no issue. However, his fund soon reached a value of $1.3 million, which sparked some concern. He tried to make a withdrawal but was told he’d need to pay a $150,000 liquidation fee — confirming his suspicions.
YouTube has also faced negative ramifications as a result of these crypto scams. Apple Co-Founder Steve Wozniak raised a civil lawsuit against the video sharing giant for the overuse of his likeness to promote crypto scams. Other public figures like Elon Musk have also publicly called out the platform for similar issues.
False Royalty Claims Backfire on Scammers
In some cases, misinformation isn’t necessarily posted on the platform. Instead, its spread in regard to ownership rights over copyrighted content. This was the case for two scammers who made off with over $23 million in false copyright claims.
The scammers, Webster Batista Fernandez and Jose Teran, were able to fraudulently claim the ownership rights to a library of over 50,000 songs. They did this by exploiting YouTube’s copyright claim system, which is mechanically automated.
Their four-year scheme came to an end in 2021 when they were indicted on federal charges. The men plead guilty and received 46 and 70-month sentences for their crimes. They also had to forfeit possessions to satisfy a $25 million payout to the victims.
Another scammer, Christopher Brady, also exploited YouTube’s copyright system — but in a different way. Instead of issuing fraudulent claims to steal money, he used it as a threat to extort users on the platform.
Brady issued two fraudulent copyright claims to numerous content creators before messaging them and threatening a third. On YouTube, three copyright strikes are grounds for termination of a channel. Knowing this, Brady would leverage the threat of a third strike to get his victims to pay up.
YouTube eventually became privy to the situation and filed a lawsuit against Brady under the DMCA’s prevision against fraudulent takedown notices. The suit was settled out of court, and Brady paid a penalty of $25,000 and issued a public apology.
Fraudulent Giveaway Costs Victim $7,200
Jason Blentlinger was at his desk at work when he believed he was issuing a payment to secure a gift he’d won. He was a longtime subscriber of the channel Grimm Life Collective, and he’d just received a notification that he’d won a MacBook Pro for his support.
All Blentlinger had to do was cover a $131 shipping fee and the prize was his. Simple enough — or so he thought. He went to a nearby store to buy a gift card to pay the fee, but the demands for money were just getting started.
The “YouTuber”, who was really a phishing scammer, explained that a cash prize was included with the MacBook, causing the package to be seized by customs. They explained the Blentinger would need a large sum to get the FBI and Interpol “off their backs”.
In total, Blentlinger bought and sent gift cards reaching a grand total of $7,200. After the store employee raised concern of a potential scam, Blentlinger reported the matter to the police, who confirmed the scam suspicions.
What YouTube is Doing to Combat Scammers
YouTube has policies in place that prohibit scam-related content, such as spam, misleading information, or use of third-party content. Violations can be reported by users, and YouTube utilizes both human moderators and machine learning models to detect potential scams.
If a channel’s content is determined to be in violation of the community guidelines, it can potentially lose monetization. In some cases, the channel may even be deleted entirely. YouTube channel termination operates under a three-strike policy, and scam content may warrant a strike.
If the user is only issued a warning, they can complete an optional policy training to have it removed. However, if they violate the same policy, the warning will not be removed — and a strike may be assigned. YouTube also reserves the right to refuse the optional policy training to repeat offenders.
How to Avoid Falling for a YouTube Scam
Now that you are aware of the potential scams on YouTube, let’s circle back to our friend Timmy and learn what you can do if you encounter one. But first, let’s take a look at what Timmy could’ve done to avoid the situation he found himself in.
- Avoid Suspicious Links. Timmy’s most critical mistake was clicking a suspicious link from an unconfirmed source. You should never click links that come from sources you don’t know or have unknown destinations that remove you from your current platform.
- Be Cautious of Phishing. Before clicking the link, Timmy failed to properly investigate the source. If he had, he may have noticed the minor typo in the username. Be mindful of scammers on YouTube who try to pose as trusted sources.
- Steer Clear of Unbelievable Offers. We’d all love to find a shortcut or easy way to get what we want with minimal effort. Younger, less experienced users like Timmy are especially susceptible. If an offer seems too good to be true, it likely is.
Unfortunately, Timmy’s case exceeded the point of prevention. However, he quickly realized he needed to take action to resolve the serious threat he now faced. He quickly alerted his parents, and they helped him respond. Here’s what they did.
- Document Evidence. Timmy and his parents quickly got to work preserving evidence of the scam. They took screenshots of the account, comment, and the website that Timmy was taken to.
- Secure Devices and Accounts. Timmy’s parents helped him update his passwords and end any account sessions that they didn’t recognize. They set up a password manager and enabled two factor authentication. Furthermore, they ran a reputable malware scanner to determine if the device had been compromised.
- Report to the Proper Authorities. Timmy and his parents reported the scam to YouTube. They also filed a police report at their local precinct and notified the FBI through the Internet Crime Complaint Center (IC3). For additional assistance, they consulted cybersecurity professionals to investigate the case and improve their online security.
Because Timmy acted quickly and in agreement with expert suggestions, he was able to avoid a worse fallout. If you find yourself in a similar situation, you can count on the team at Digital Forensics Corp. You can contact helpline anytime to speak with one of our specialists and plan your next move.
