The “I Know Your Password” Extortion Email: What It Really Means and How to Respond

An email arrives with a subject line like “Your account has been compromised” or “I know your password.“ It may include a password you used years ago. The sender claims to have infected your computer, recorded you through your webcam, and copied your contacts. They demand payment in Bitcoin, usually within hours, or they will send embarrassing video to everyone you know. The message is designed to make your heart race. That is the point. It is a mass-produced extortion scam, not a sign that a criminal is sitting inside your device.

The most convincing detail is often the old password. Scammers buy huge lists of email addresses and passwords stolen in data breaches. Then they send thousands of threatening emails and insert one of those passwords into each one. If you recognize it, you may assume the worst. But an old password is not proof that your computer is hacked. It only proves that some company you once used lost its data. Many people have dozens of old passwords floating around from breaches they never heard about. The scammer is counting on that single detail to make the rest of the lie believable.

The claims that follow are almost always false. The sender says they installed malware, turned on your webcam, and captured video of you doing something private. They say they have your contacts, your browsing history, and your personal files. None of that means they actually have access. Email addresses are easy to fake. The goal is fear, not technical skill.

Do not pay. Payment does not make the problem go away. It marks you as someone who responds to threats. The scammer may demand more money, share your information with other criminals, or sell your email address as a proven target. Bitcoin and gift cards are preferred because they are difficult to trace and reverse. Once you send money, it is gone. No legitimate investigator, bank, or police agency will demand payment in cryptocurrency to keep a secret. That demand alone is a red flag.

Do not reply. Do not click links or open attachments. A reply confirms that your address is active. Clicking a link may lead to a fake login page that steals your current password, or it may download malware. The extortion email itself usually does not install anything. The danger comes when you engage. Mark the message as spam or phishing, then delete it. If your email provider allows you to report phishing, do that first. Preserve the message only if you plan to file a police report. Otherwise, there is no reason to keep it.

Take a few sensible steps to protect yourself. If the password in the email is still used on any account, change it immediately. Make it long, unique, and different from every other password. A password manager can create and store them for you. Turn on two-factor authentication wherever it is offered, especially for email, banking, and social media. If you are worried about malware, run a reputable security scan and update your devices. You can also cover your webcam when it is not in use, but do not let fear convince you that a stranger is watching. The odds are strongly against it.

If the threat involves intimate images, it is called sextortion. Scammers often claim they have compromising video, even when no such video exists. They rely on shame to keep you silent. Do not let embarrassment make the decision. Report the message to your email provider and to law enforcement. In the United States, you can file a complaint with the FBI’s Internet Crime Complaint Center or the Federal Trade Commission. If you are in immediate danger or someone has actually shared private images without consent, contact local police. You are not the first person to receive this email, and you will not be the last. The scam works only when fear overrides common sense.

The bottom line is simple. An extortion email is a bluff wrapped in threats. A stolen password is not a hacked computer. A demand for Bitcoin is not a legitimate investigation. Delete the message, secure your accounts, and do not pay. That is how you take away the scammer’s power.