What to Do When a Blackmailer Claims They Have Your Password

You open your email and see a message that makes your stomach drop. The sender says they have a piece of software on your computer that recorded you visiting adult websites, and they threaten to send that video to every contact in your address book unless you pay them in Bitcoin. To prove they’re serious, they include one of your actual passwords in the message. Your first instinct is panic. Your second is shame. But before you do anything else, take a breath. This is one of the most common extortion scams operating right now, and the people behind it are playing a numbers game, not hacking your webcam.

This scam works because the criminals use password lists stolen from old data breaches—millions of exposed records from sites that were hacked years ago. They don’t have access to your computer. They never recorded you. They simply bought or downloaded a file containing millions of email addresses and passwords, then sent the same threatening email to everyone on that list. The password they show you is real because you reused it somewhere, but that’s the only thing real about their threat. They’re counting on fear and embarrassment to make you pay before you think clearly.

What should you do if you receive one of these messages? First, do not pay. Sending money to a blackmailer accomplishes nothing. Once they know you’re willing to pay, they’ll come back with more demands, and they’ll keep threatening you with the same nonexistent video. Paying puts you on a list of easy targets, and the harassment will only get worse.

Second, resist the urge to verify whether they actually have any footage. They don’t. A real hacker who had compromising videos would include a screenshot or a short clip as proof. The vast majority of these scams won’t include any evidence beyond the password, because they have none. The password is their only hook, and it’s enough to fool thousands of people every year.

Next, treat the exposed password as an urgent warning. Immediately change that password anywhere you’ve used it, especially on your email, banking, and social media accounts. If you’re like many people, you’ve reused that same password across multiple sites, which is exactly what makes this scam feel believable. Once you’ve changed it, make sure you aren’t still using old passwords anywhere else. Open a password manager and start generating long, unique passwords for every account. Enable two-factor authentication on your email at minimum. This isn’t just about stopping the blackmail—it’s about closing the door that the data breach opened in the first place.

Then, check whether your email address has been involved in known breaches. A website called Have I Been Pwned lets you enter your email and see exactly which companies have leaked your information. This helps you understand where the password came from and reminds you that the threat is generic, not personal. The scammers sent that exact email to every address they had, not just to you because they spied on you. That’s an important distinction. They don’t know who you are. They see a list of names and a stolen password, and they fire off thousands of messages hoping a few people will be frightened enough to pay.

You should also consider filing a complaint with the FBI’s Internet Crime Complaint Center, or IC3. While the FBI can’t pursue every individual extortion email, your report contributes to tracking broader campaigns and building cases against the criminal networks behind them. If the threat seems unusually specific or mentions something that truly worries you, contact your local police department. But in the overwhelming majority of cases, the best response is to ignore the demand, secure your accounts, and move on.

Finally, talk to someone about it. The shame that fuels these scams is powerful, and it isolates you exactly when you need a clear head. A spouse, a trusted friend, or a counselor can help you see that the email is a crude bluff. Professional security experts, like the ones at consumer protection agencies, repeat the same advice: don’t engage, don’t pay, and secure your digital life. You are not the first person to receive this message, and you won’t be the last. Extortion through email is a dirty, low-effort crime that preys on middle-aged people who may not have grown up with the internet but have lived with it long enough to understand its dangers. The scammers don’t want to expose you. They want your money and your fear. Give them neither. Change your passwords, enable two-factor authentication, and get back to your day. The only thing you have to lose is a lie they told you.