4

I have a site which uses the YouTube Data API.

About a year ago, I had a similar email to the one below - the email address appeared to be genuine, so I filled the form in at https://services.google.com/fb/forms/ytapicommercializationapplication/ sent it back, and heard nothing about it.

Then, at the end of February 2019, I received another email from the same address [email protected] asking me to complete another compliance review.

Email 1

I replied and questioned why I was being asked for this less than a year after the previous one. I got no reply initially and then about two weeks later I got this email

enter image description here

Worried that I might lose access, I completed the form once again.

I sent a covering email to say I had filled the form in.

Then today, I received this email

enter image description here

I am a bit confused and worried that I have given information away to a malicious third-party.

When I do a search for their email address [email protected] - I get no results - but I don't see how such an email address would get past Gmail's SPAM filters.

enter image description here

I'm starting to think it is some sort of scam, as I am being asked to supply project numbers (when Google surely know them) - I am now thinking that if this was genuine then they would at least provide some sort of personalised information in the email?

Has any one else had similar emails, and do you think it looks genuine? If not, does anyone know of a reliable contact at Google that could confirm/deny the legitimacy?

At https://developers.google.com/youtube/terms/developer-policies it does say that they may do this sort of thing from time to time, but they don't specify how they might get in contact

enter image description here

Improve this question

2 Answers 2

Reset to default
5

I've encountered such emails many time, I do this, if you can find the same domain and TLS certification then, you've got email from a legit source.

enter image description here

Improve this answer
4

EDIT: Alright, there definitely ARE some weird things in those emails though. Like the second picture you post said the deadline was 3/18/2018? A year ago? And the 3rd one said "follow these steps", and gave no steps. But regardless, what I wrote below should still help.

Alright... So first off, let me say: I'm not an API expert, nor have I used YouTube API or really any API for that matter. But mainly BECAUSE of the ridiculously strict rules these companies set in place with their terms and conditions. With that being said, I know you've checked out the developer policies to at least check the audit section of it... (IF the email is real:) Make sure your work is in compliance with everything in that policy before granting them access as they will essentially be testing you to see if you are within compliance with their terms. If not, they will likely terminate your access to using the API.

It's very likely that these are real messages, though there are a few ways to check. Try hovering over the email name like so, so that the contact comes up. Or click on (and sometimes hold) it to view the contact if on a mobile device.

Hover over email contact like this

If they were using the email as a contact name, as someone would in a phishing scam, it would pop up on the left, bold like that. Similar to how Duolingo is in this picture (though the real email address shows to the right in my example.) But if they don't have a contact name, it's possible it may end up defaulting to that spot. Checking the contact though as mentioned above will allow you to see the real email on that second line, and gets around those tricky phishers who use this technique.

After checking the contact, if that IS in fact the REAL email address, then there is no doubt that they are real. Nobody else has access to [email protected] email addresses but Google themselves. So if after hovering, there isn't some phony bogus email, than it is almost 100% likely to be legit. Especially if your connected through https. You can tell by looking at your address bar and if it has a lock sign to the left (or if it says https:// before mail.gmail.com.)

HTTPS Lock Sign Example

Another thing I would like to point out though is that the first link you had up was an application link, and not a compliance review like what is being asked of you now. They ask a lot because they want to make sure their API is being put to good use and not wearing down the YouTube brand name, so to speak.

So, like I said. I'm definitely no expert here when it comes to APIs. But I do know a bit about phishing scams, how to avoid them, and basic internet security. I hope I helped at least a little! I didn't see anyone else respond, and thought, I can at least throw my two sense in and hope its better than nothing! haha

Let me know if it helped!

Thanks!

Have a good one Joe!

And good luck with the project! 👍

Improve this answer
5
  • Thanks Zac. - I didn't notice that it said 2018! - that does make it seem even more weird. Anyhow - the email address checks out in the sense that Gmail hasn't flagged anything, and I'm definitely connected through HTTPS. I am not giving a huge amount of information away, and nothing I haven't already submitted through that form before. I agree it's strange they call it a "compliance review" and then give a link to a "Commercialization Application" Google form. I have reported the email through support.google.com/mail/contact/abuse - so hopefully they can shed some light on it
    – Joe
    Apr 12, 2019 at 9:02
  • There are another couple of "phishy" things in the emails, like the " this" link in the first email, where the leading space is part of the link, and in the third email where they have put a space before the period and then none after. Everything we are told to look for in terms of spammy emails is there, apart from the very genuine looking email address....confused...
    – Joe
    Apr 12, 2019 at 9:06
  • I've added a screenshot of the email address in Gmail which shows no signs of being bogus
    – Joe
    Apr 12, 2019 at 9:11
  • I looked around and found this link to the Google API support, but seems they only have a billing support channel... Then I found this link on phishing scam; seems like you went about reporting it in the correct way... Yeah, hopefully they can shed some light on it. Maybe the support team doesn't speak English very well and are more prone to error? Or maybe they got their AI working the emails nowadays and it's messing up. 😂 I really don't know. haha
    – Zachary Judd
    Apr 12, 2019 at 19:41
  • But the reply below does show how to show even more information when checking emails. So if all that checks out, at least you DO know it's Google. Why there were so many errors written in them is another question. haha
    – Zachary Judd
    Apr 12, 2019 at 19:43

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.