YouTube hacked and money stolen: how to recover it legally

By Advocate Panchanand Shaw, Bar Council of West Bengal · Published 2 Nov 2026 · Online fraud

A channel takeover becomes a financial case at the moment money moves. The intruder may redirect the AdSense payout to a new bank account, use the saved card on the Google account to buy advertising, sell premium subscriptions through a fake live stream, or use the channel to collect deposits from viewers who believe they are dealing with the real creator. Each route produces a different kind of loss and a different remedy, and the first twenty-four hours decide how much of it can be recovered.

The order of action is counter-intuitive. Most owners start with Google support. The correct order is to call the bank first, because the RBI's directions on unauthorised electronic transactions give the customer the strongest protection in the first three working days, and that protection weakens with every day of delay. The platform recovery and the criminal complaint can run in parallel, but the bank intimation should not wait for either.

Where the money actually goes

AdSense is the largest exposure for a monetised channel. Payments are made to a bank account nominated in the AdSense profile, and an intruder who controls the Google account can change the payee details, the tax information and the payment threshold. The change often triggers an email from Google, but the email may be filtered into a folder the owner does not check. By the time the next payout date arrives, the balance has left.

The second route is the payment method on the Google account. A saved card can be used for Google Ads campaigns, YouTube Premium subscriptions, app purchases or storage plans. These appear as ordinary merchant transactions on the statement, and banks treat them as authorised unless the customer says otherwise quickly and in writing.

The third route is viewer money. A hijacked channel streams a fake giveaway, an investment scheme or a prize draw and asks viewers to pay a registration fee, a tax or a deposit. That money never touches the owner's account. It goes to the intruder's UPI handle or bank account, which means the owner is not the victim of the payment and cannot dispute it as an unauthorised transaction. The viewers are the victims, and each of them has to report separately.

The fourth route is credential sale. A channel with a large subscriber base is sold to a scam operator, who then uses it to run the same fraud on the audience. The original owner may recover the account only to find it has been used for weeks.

The RBI rule that decides most of these cases

The RBI's directions on customer protection for unauthorised electronic banking transactions set out a three-tier liability structure. Where the fraud is not due to the customer's negligence and the customer reports it within three working days, the customer has zero liability. Where the report comes after three but within seven working days, the customer's liability is limited to a cap set in the bank's board-approved policy. Beyond seven working days, liability is determined by the bank's policy, subject to the RBI's overall framework.

Two features of the framework are frequently overlooked. First, the burden of proving that the customer was negligent lies on the bank, not on the customer. A bank cannot refuse a claim simply by asserting that the customer must have shared a password. It has to show the negligence. Second, the directions require the bank to provide a written acknowledgement and a reference number for every report, and to resolve the complaint within a defined period. Those documents are the foundation of any later complaint to the RBI's consumer education and protection cell or to the banking ombudsman.

Separately, the RBI's directions on turnaround time for failed transactions require regulated entities to reverse failed transactions within a fixed period and to pay compensation for delay. That route applies where the money left the account but the transaction did not complete, which is common in UPI and card frauds connected to a hijacked channel.

What to do, in sequence

1. Freeze the card and the payment method. Call the bank's card block line and block the card used on the Google account. Remove the card from the Google account from a clean device, and change the Google password from the same device.
2. Report the unauthorised transactions in writing. Use the bank's app or email, not only a phone call. State the transaction reference numbers, the amounts and the dates, and say clearly that you did not authorise them. Ask for a written acknowledgement with a complaint reference number.
3. Ask for the beneficiary details. Under the RBI framework the bank is required to provide the details of the account to which the money was credited, where the transaction is disputed. Those details are what the police need to request a freeze.
4. Call 1930 and file on cybercrime.gov.in. Report the financial fraud with the transaction details, not only the account takeover. The portal routes financial complaints to the bank and the cyber unit, and the reference number links the two.
5. File the police complaint. Give a written complaint under section 173 BNSS at the cyber crime unit. Attach the bank statement with the disputed entries highlighted, the bank acknowledgement and the platform screenshots. Ask the investigating officer to request a freeze on the beneficiary account before the money is withdrawn.
6. Tell Google about the AdSense change. Use the AdSense support route and the grievance officer under the IT Rules 2021. Report the unauthorised payee change and ask for the payment to be held or reversed. Provide the police complaint number; it changes how the request is handled.
7. Recover the Google account. Use the account recovery flow from a device the account has used before. Re-secure with a new password, an authenticator app and fresh backup codes, and revoke every connected app and session.
8. Notify viewers once. A short public notice naming the fake stream or payment request reduces further losses and creates a dated record that you acted promptly.
9. Keep the paper trail together. Bank complaint, portal reference, FIR number, Google ticket numbers and the AdSense case ID should all sit in one file. Each institution will ask for the others.

The criminal side of a financial takeover

Where money is taken, the offence is no longer only unauthorised access. Section 66 of the IT Act 2000 covers dishonest or fraudulent access causing wrongful gain or loss. Section 66C covers identity theft, section 66D covers cheating by personation, and section 318 of the BNS 2023 covers cheating itself. Section 336 BNS applies where forged documents or a forged identity were used to change the payee details. Where the intruder threatens to delete the channel unless paid, section 351 BNS applies.

The investigation has to follow the money. That means the beneficiary account, the UPI handle, the merchant account that received card payments and the AdSense payee details. A complaint that lists these identifiers gives the officer a route. A complaint that only says the channel was hacked and money was taken does not. Under section 78 of the IT Act 2000 the investigation is conducted by an officer of Inspector rank or above, and under section 173 BNSS a cognizable offence must be registered. If the station refuses, section 173(3) BNSS allows a written complaint to the Superintendent of Police, and section 175(3) BNSS allows an application to a magistrate for a direction to investigate.

Civil recovery is a separate track. A suit for damages and for an injunction can be filed against an identified operator, and where the operator is unknown, the court can be asked to direct the platform and the bank to disclose the relevant records. A civil claim does not depend on a criminal conviction, though a charge sheet helps. It is usually worth considering where the loss is large, the operator is identifiable, and the criminal investigation is moving slowly.

What decides the outcome

The first factor is the reporting date. The RBI framework is explicit that the three-day window determines whether the customer bears any liability. The date the bank records the complaint is what counts, not the date the owner first suspected. A phone call that is not followed by a written complaint is often treated as no report at all.

The second is the negligence question. A customer who shared an OTP, used the same password across accounts, or clicked a phishing link that harvested credentials faces a harder claim, because the bank can argue contributory negligence. A customer who can show that the password was changed without any action on their part, and who reported at once, is in a much stronger position. The bank still carries the burden of proof, but the facts shape how that burden is assessed.

The third is whether the money can still be frozen. Funds move through mule accounts quickly. A complaint that reaches the bank and the cyber unit on the same day has a realistic chance of stopping a transfer. A complaint made a week later usually finds an empty account and a closed handle.

The fourth is whether the loss is the owner's or a viewer's. An owner can dispute an AdSense payout or a card charge. An owner cannot dispute a payment that a viewer made to a third party, even if the fake stream carried the owner's face. In that situation the viewers must report their own transactions, and the owner's case becomes one of impersonation and reputational harm.

What not to do

• Do not wait for Google to confirm the takeover before telling the bank. The bank's clock starts when you report, not when the platform agrees with you.
• Do not dispute the transaction as a product not received. That framing puts the claim in the merchant dispute queue instead of the unauthorised transaction queue, which has different timelines.
• Do not delete the security alerts or the payment emails. They establish the time of the change and the amount.
• Do not pay the intruder to release the channel. The payment is a fresh loss and it confirms the account is active.
• Do not close the bank complaint because the amount is small. A written complaint with a reference number is also the evidence for the criminal case.
• Do not let the channel keep running while the money dispute is processed. Change the password and remove the payment method on the same day.

When to involve a lawyer

A lawyer helps when the bank rejects a zero-liability claim and the next step is the banking ombudsman or a consumer forum, when the loss is large enough to justify a civil suit, or when the police will not register the FIR and a section 175(3) application has to be drafted. For a small card charge that the bank has already reversed, the platform and bank routes are usually sufficient. Where the channel is a business with advertising revenue and the AdSense balance is significant, an early legal assessment will tell you which of the three tracks to press hardest. The cyber crime lawyer in Kolkata page covers financial cyber frauds, and cyber law in West Bengal sets out the local court routes.

Frequently asked questions

Information for general guidance only and not legal advice. Provisions cited follow the Information Technology Act 2000, the Bharatiya Nyaya Sanhita 2023 and the Bharatiya Nagarik Suraksha Sanhita 2023.

Related articles

• WhatsApp hacked and money debited: how to recover it legally
• TeamViewer hacked and money stolen: legal recovery steps
• LinkedIn hacked and money debited: how to recover it legally
• Instagram hacked and money stolen: how to recover it
• Google Pay hacked and money stolen: recovery steps
• Facebook hacked and money stolen: how to recover it legally

Cyber crime lawyer in your city · Bank account freeze help · Contact