The “We Have Your Browser History” Extortion Email: Don’t Pay a Cent

You open your inbox and find a message from someone you don’t know. The subject line is your own name. The body says they’ve installed malware on your computer, recorded you visiting adult websites, and captured video of you through your webcam. They’ve also, they claim, scraped your entire contact list. Unless you send $1,000 in Bitcoin to a wallet address within 48 hours, they promise to send that evidence to every person you know. Your stomach drops. Your first instinct is to panic, then to pay, just to make it go away. Don’t. This is one of the most common and most effective extortion scams doing the rounds today. And here is what you need to know to shut it down without losing a dollar.

First, understand what you are dealing with. This scam is often called “sextortion” or “webcam blackmail,” but that label gives it too much credit. In almost every case, the criminals have nothing on you. They have not hacked your computer. They have not recorded your webcam. They have not actually read your email or your browser history. What they have is a script, a mass email list, and a whole lot of nerve. The goal is simple: scare you into paying before you have time to think. The email is designed to trigger fear, shame, and urgency. It mentions your name, and sometimes your password—not because they stole it from your computer, but because they bought it from a data breach or a stolen password list. That old password from a breached website years ago is being recycled to make the threat look real. That’s it. That’s the whole trick.

So how do you spot one of these emails? Look for the telltale patterns. The message usually arrives in your spam folder or as a filtered email. It contains specific language like “I placed malware on your device” or “I have watched you through your camera.” It demands payment in Bitcoin, Monero, or another cryptocurrency because those are hard to trace. It gives you a short deadline, often 24 to 48 hours. And it will include a snippet of your actual personal information—a phone number, an old address, or a password—to convince you they are real. That piece of information is called a “bait” and it comes from publicly available data or a breach database. It is not proof that they have access to anything more.

The most important thing to remember: never engage, never reply, and never pay. Paying does not make the threat go away. It puts you on a list of people who are willing to cough up cash. You will get hit again, often within days, sometimes with even more aggressive demands. The scammers do not delete your information after you pay; they share it with other scammers because you are now a known mark. That is the only outcome of paying. If you don’t pay, the worst-case scenario is also nothing. Because the scammers have no content to release. They are bluffing. They are relying on the fact that you might have, at some point, visited a site you wouldn’t want your spouse or boss to see. But even if you have, they can’t prove it. And they aren’t going to spend hours manually targeting you. They send out millions of these emails every week. The moment you don’t respond, they move on to the next victim.

If you receive one of these emails, do the following. First, take a deep breath. Recognize it for what it is: a lie from a stranger. Second, do not click any links in the email and do not download any attachments. That is how they actually get malware onto your machine. Third, change your passwords on any accounts that use the password they listed, but do it from a separate device or after running a security scan. Use strong, unique passwords for each account, and turn on two-factor authentication. Fourth, report the email to the FBI’s Internet Crime Complaint Center at ic3.gov. You don’t need to provide anything except the original email and the Bitcoin address. That helps law enforcement track patterns and, occasionally, identify the bad actors. Fifth, block the sender and delete the email. Do not forward it to friends or post it on social media. That just spreads the scam.

What about the more frightening variants? Some emails claim to be from the federal police or the IRS, demanding “immediate payment” to avoid arrest or prosecution for “possession of illegal images.” This is also a scam. Law enforcement does not send you an email demanding Bitcoin to keep you out of jail. They do not alert you to a warrant and give you a cryptocurrency wallet address to resolve it. Similarly, if you get a call or a message from someone claiming to be a “hacker” who has accessed your computer and is now locking your files—that’s ransomware, which is related but slightly different. For ransomware, disconnect the device and take it to a professional. But for the extortion email that only claims access, the right response is the same as above: ignore it, report it, secure your accounts.

The bottom line is that you are not in any danger. This scam works only if you believe it. And for scammers, your fear is the product. They don’t have your secrets. They don’t have your video. They have a script and a spam list. So the next time you see that subject line with your name and a threat, laugh at it. Then delete it. You just saved yourself a thousand dollars and a world of worry.