How it works
The bait is money you are already owed. The email claims your payment threshold was reached but the payout failed, that your tax or bank details are out of date, or that AdSense needs re-verification before it can release this month's earnings. The link goes to a page styled like AdSense or Google Payments. It asks you to sign in with your Google account, then collects payout details: a bank account, or in some versions a card "for verification." The Google sign-in step is the real prize, since the account controls both the channel and the earnings.
Payment settings for YouTube earnings are managed inside YouTube Studio and the linked AdSense or Payments profile, reached from the product, not from an email link. Google surfaces a held payment inside those dashboards. It does not ask you to re-enter banking details through a link in an unsolicited email.
The tell-tale signals
- The sender domain is not owned by Google, and it is newly registered with weak or missing DMARC.
- The visible link text mentions adsense.google.com or payments.google.com while the real link points somewhere else.
- A shortener or a raw address stands in for the destination.
- Pressure that this payout expires or is forfeited unless you update now.
- The page asks for banking or card details right after a Google sign-in.
What to do
Ignore the link and open adsense.google.com or studio.youtube.com directly to check the payments section. A real hold shows up there with instructions inside the dashboard. Never enter bank or card details on a page you reached from an email about a payout. If you already did, contact your bank about the exposed account or card, change your Google password from a trusted device, and revoke any unfamiliar access on your Google account permissions page. Running the original email through LegitSponsor shows the sender and link evidence behind the warning.