How to tell if a sponsorship email is legit

A real sponsorship email comes from the brand's own domain, talks about your content, and asks about rates or deliverables. A fake one tries to get you to download something, sign in somewhere, or pay first. If an offer asks for any of those three, stop and verify the brand through its own website before you reply.

These scams are not new. In 2021, Google's Threat Analysis Group described a campaign that had targeted YouTube creators since late 2019 with fake collaboration offers, typically a demo of antivirus software, a VPN, a music player, a photo editor or an online game. The "demo" was malware that stole browser cookies, which the attackers used to hijack channels. In 2025, TeamYouTube warned about the same pattern in its community forum: a convincing brand offer, then a file "disguised as a contract, media kit, or proprietary software."

The quick check

Before you reply to a brand email, run through this list:

Sender domain. Does the address end in the brand's own domain, spelled exactly like the website you find through a search?
Files. Is there a program, an archive (.zip, .rar, .7z) or a password for a file? Contracts are normally PDF or Word documents.
Sign-in requests. Does it ask you to log in with Google or connect your channel to see a brief?
Money flowing the wrong way. Does it ask you to pay a fee, buy products first, or accept payment in crypto or gift cards?
Pressure. "Reply within 24 hours" or "only three slots left" is there to rush you.
Fit. Does the brand make sense for your audience, and does the email mention a specific video or topic of yours?

One flag is a reason to slow down. Two or more is a reason to verify before doing anything else.

Three fake offers, taken apart

Every brand, address and domain below is invented.

1. The software demo

From: Velbrisk Partnerships <velbrisk.collab@freemail.example>
Subject: Paid review of our PC optimizer ($2,500)

Dear Creator,
We love your channel and want to sponsor a 60-second review.
Please install the beta build first so you can record it:
https://files-drop.example/velbrisk_setup.zip (password: 2026)
We need the video this week, so please confirm today.

This matches the campaign Google described: a software product, a download and a password-protected archive. Gmail blocks many program file types as attachments, and Google's report says the malware arrived through download links, sometimes inside a PDF on Google Drive. YouTube also notes that encrypted files can get past antivirus scans. Add the free mail address, the generic greeting and the deadline, and this one is clear-cut.

2. The lookalike domain

From: Quiltmoss Coffee <creators@quiltmoss-partners.example>
Subject: Campaign brief for your channel

Hi! Our team at quiltmoss.example would like to work with you.
To view the brief and contract, sign in with your Google account
on our creator portal.

The sender domain adds a word to the brand's real domain, which looks official at a glance. The bigger problem is the sign-in request. Reading a brief doesn't require your Google password, and Gmail's help pages say not to enter a password after clicking a link in a message. Go to the brand's website directly instead.

3. The ambassador fee

From: Brightfennel Skincare <ambassadors@brightfennel.example>
Subject: You're selected as a Brightfennel ambassador!

Congrats! To join, order your starter kit ($49, shipping included).
We refund you in full after your first post.

The domain might even be real, but this isn't a sponsorship. In a sponsorship, the brand pays you or sends products, not the other way around.

What a real offer usually looks like

Real outreach tends to be specific:

It comes from a company address on the same domain as the brand's website, or from an agency that names the brand it represents.
It references your content, proposes a format (a 60-second integration, a dedicated video, a newsletter slot), and gives a budget or asks for your rate.
The contract arrives as a PDF or Word file.
It treats disclosure as normal. The FTC's guidance for influencers says to disclose any financial relationship with a brand, including free products, and to put the disclosure in the video itself, not only in the description.

Polished emails can still be fake, so treat this as a baseline, not proof.

How to verify before you reply

Find the brand yourself. Search for the company, open its official site, and compare the domain letter by letter with the sender's address.
Contact the brand through its site. YouTube's creator safety page suggests confirming a brand deal by calling the company or reaching out to the person you usually work with. A short note to the address on the brand's site ("Did your team contact me about a campaign?") is a quick way to check.
Check the email's authentication in Gmail. On a computer, open the email and click the Down arrow below the sender's name. Look for "Mailed by" and "Signed by" lines with the sender's domain. A question mark next to the sender's name means Gmail couldn't confirm who sent it. Scammers can authenticate mail from their own lookalike domains, so a pass is not proof.
Hover over links before clicking to see where they really go.
Walk away from installs and logins. If the "brief" requires installing software, connecting your channel or sharing a password, the deal is off.

Sort sponsorship emails in Gmail

Next, set Gmail up so brand mail lands in one place:

Use a plus address for business inquiries. Gmail delivers mail sent to yourname+sponsors@gmail.com to yourname@gmail.com. Use it as the contact address on your channel or media kit, so brand mail is easy to filter.
Create a filter for it. In the Gmail search box, click Show search options, enter the plus address in the To field, then click Create filter. Check Apply the label, pick or create a label such as Sponsorships, and click Create filter.
Flag risky files. Make a second filter with filename:(zip OR rar OR 7z) in the Has the words field and a label like Check first. Anything that lands there gets the quick check before you open it.
Report the fakes. Open the message, click More next to Reply, then Report phishing.

Filters follow simple rules, so they can't judge whether an offer is real. You still read each one.

If you already opened the file

Act quickly. Secure the Google account linked to your channel first, starting with a new password, then follow YouTube's steps to recover a hacked channel. YouTube also recommends 2-Step Verification with a passkey as the strongest protection against phishing. Check your channel permissions and remove anyone you don't recognize.

Let an n8n workflow do the first pass

Our Sponsorship Inbox Triage template for n8n runs these checks on new Gmail messages. It applies plain rules (risky attachment names, sign-in requests, upfront fees, lookalike domains), adds an AI read, and labels each email as a real offer, a lowball, a likely scam or not a sponsorship. Real offers and lowballs get reply drafts that wait for your review, and you make the call on every deal. It uses your own OpenAI API key. OpenAI usage is typically a fraction of a cent per email. You can also find it on our Creators page.

Sources

YouTube and Gmail are trademarks of Google LLC. n8n is a trademark of n8n GmbH. ReadyUpAgents is independent and not affiliated with or endorsed by n8n, Google or YouTube.