The Password Extortion Scam: How to Spot and Stop Digital Blackmail
It is almost certainly a lie. This is a classic password extortion scam, and it has targeted hundreds of thousands of middle-class Americans. The scam works because it preys on fear and shame, but once you understand how it operates, you can laugh at it and delete it.
The email typically includes a real password you have used somewhere online. How did they get it? Not by hacking your computer. They bought it from a data breach. Over the past decade, billions of passwords have been stolen from companies like LinkedIn, Yahoo, Marriott, and Adobe. These stolen credential lists are sold on the dark web for pennies. Scammers buy them, then plug your email and password into a bulk mailing program. They don’t know if you still use that password. They don’t know you. They just know that seeing your own password makes you take the threat seriously.
The rest of the email is pure fiction. They claim to have installed malware on your devices and recorded you through your webcam. In reality, most modern laptops have a small light that turns on when the camera is active. If that light never came on, nobody filmed you. They also claim to have accessed your browser history and contacts. They haven’t. They want you to panic and pay before you think clearly.
What should you do if you get such an email? First, do not pay. Paying does not make them go away. It marks you as an easy target, and they will come back with bigger demands or sell your name to other scammers. Second, do not reply. Engaging only confirms your email address is active. Third, change that compromised password immediately on any account where you still use it. If you reused that password elsewhere, change those accounts too. This is a good reminder to stop reusing passwords altogether.
After that, delete the email. You can also report it to the FBI’s Internet Crime Complaint Center at ic3.gov, but most law enforcement agencies cannot investigate a single threat like this unless you actually lost money. If you did send money, file a report anyway. Some victims have been able to trace Bitcoin payments, though recovery is rare.
The scam works because it taps into two very human fears: exposure and shame. Scammers know that many people, especially those over forty-five, are less comfortable with technology and more likely to believe that a hacker could really see through their camera. They also count on embarrassment preventing victims from talking to family or police. Do not let shame silence you. Tell a trusted friend or your bank. The more people who know about these emails, the fewer victims there will be.
Prevention is straightforward. Use a password manager to create strong, unique passwords for every site. Enable two-factor authentication on your email, bank, and social media accounts. Cover your webcam with a piece of tape or a sliding cover when you are not using it. That last habit is simple, cheap, and completely eliminates any fear about someone watching you.
Some scammers have gotten more sophisticated. They may include your home address or a relative’s name, scraped from public records or social media. This does not mean they hacked you. It means they spent a few minutes on Google. The threat remains empty. They have no video, no recording, no leverage.
Remember: if a stranger had actual compromising video of you, they would not send a mass email asking for Bitcoin. They would have already posted it or sent it to a few contacts to prove their threat was real. The fact that they only send a generic email with a stolen password is the biggest giveaway. Real blackmailers do not negotiate via spam.
Do not let fear override your common sense. Delete the email. Change the password. Go about your day. You were not hacked. You were targeted by a cheap, cruel bluff. And you just called it.
Scam Watch
Protect it before they take it.
The “Missed Package” Text That Could Empty Your Bank Account
How Emergency Plumbers and HVAC Companies Gouge You When You’re Desperate
