Sextortion Emails: What to Do When a Stranger Threatens to Expose You

A message lands in your inbox from an address you do not recognize. The sender claims to have recorded you through your webcam while you were visiting an adult website. They may include an old password you recognize, which makes the threat feel real. They demand payment in Bitcoin within forty-eight hours, or they will send the video to your contacts, family, and employer. This is a common extortion scam designed to frighten you into paying before you think clearly.

The first thing to understand is that most of these messages are mass-produced lies. Scammers buy stolen email lists and old password dumps from data breaches. Then they blast thousands of nearly identical threats. The password they show is not proof they hacked your camera. It is proof that your email address appeared in a breach years ago. They hope the shock of seeing a real password will make you believe the rest of the story. It does not.

Some variations are more specific. The sender may claim they installed malware on your device through a link or attachment. They may say they have access to your browsing history, messages, photos, and contacts. They may threaten to ruin your reputation, send explicit images to your spouse, or report you to police for viewing illegal content. A few messages include personal details like your name, phone number, or home address. That information is often available in public records or people-search sites. It is not evidence of a webcam hack.

Real sextortion can happen, especially when someone has actually shared intimate images with another person. A romance scammer may convince a lonely adult to send a compromising photo or video, then demand money to stay silent. A catfishing operation may move a conversation from a dating app to a video call, record the call, and threaten to share it. These cases are more serious because the scammer has real material. Even then, paying is almost never right. Payment proves you are willing to send money, and it usually leads to more demands.

If you receive a threatening message, do not reply. Do not click links or open attachments. Do not send money, gift cards, cryptocurrency, or banking information. Any response tells the scammer that your address is active and that you are scared. Save the message and take screenshots before deleting it. You may need the sender’s address, timestamps, and wording for a police report. If the threat involves explicit images or videos, do not forward them to anyone except law enforcement.

Next, secure your accounts. Change the password on the email account that received the threat. If you reused that password anywhere else, change it there too. Turn on two-factor authentication for email, banking, social media, and cloud storage. Check your account recovery settings and remove any phone numbers or email addresses you do not recognize. Run a reputable security scan on your computer and phone, but be careful of pop-up ads that claim you are infected and push you to call a tech support number.

If the message included a password you still use, assume it has been exposed. Stop using it immediately. A password manager can help you create and store strong, unique passwords. This is not about being tech-savvy. It is about reducing the damage from old breaches that are already circulating.

Report the threat. In the United States, file a complaint with the FBI’s Internet Crime Complaint Center, known as IC3. Contact your local police, especially if the sender knows your address, has contacted your family, or has actual images. If minors are involved, contact the National Center for Missing and Exploited Children. If the threat targets your workplace, tell your information technology or security team. Reporting helps investigators connect cases and may protect someone else.

Finally, do not carry this alone. Extortion thrives on shame and silence. Talk to a trusted spouse, friend, attorney, or counselor. The scammer’s power depends on your fear. When you refuse to pay, refuse to engage, secure your accounts, and report the crime, the threat loses most of its force. Delete the message after you preserve it, block the sender, and move on with your life. That is the strongest response you can give.