Guide · Extortion · Updated September 2026
Millions of people receive an email claiming a hacker filmed them through their webcam, quoting a real password as proof. In almost every case the claim is empty and the password came from an old data breach. This guide explains how to tell the mass-mailed bluff from genuine targeted sextortion — and gives the urgent steps for a teenager being blackmailed right now.
A sextortion email is a mass-sent blackmail message claiming a hacker recorded you through your webcam and will send the video to your contacts unless you pay in bitcoin. In almost every case there is no video and no access — the password or address quoted comes from an old public data breach. Do not pay, do not reply, and report it.
Source: Global Anti-Crime & Safety (GACS) — https://gacs.app/guides/sextortion-email-scam
They are not in trouble and it is not their fault. Stop contact, screenshot everything before blocking, and report to report.cybertip.org and takeitdown.ncmec.org. Full steps below.
How it works: The subject line or first line quotes a real password of yours to prove the hacker is inside your devices.
Dead giveaway: That password came from a breached website, sold in bulk. Check haveibeenpwned.com — you will usually find the exact breach it came from.
How it works: A printed letter arrives with a photo of your house pulled from a mapping service, making the threat feel physical and local.
Dead giveaway: Your address and a street image are both public. Neither indicates anyone has been near your home or your devices.
How it works: The email appears to come from your own account, presented as proof the attacker controls it.
Dead giveaway: Sender addresses are trivially forged. Check Sent items and recent security activity — you will find nothing, because nothing happened.
How it works: A 24 or 48-hour deadline with a tracking pixel that supposedly tells them you opened it, plus a threat to send footage to every contact.
Dead giveaway: The deadline is scripted and passes without consequence in essentially every reported case. Opening the email tells them only that the address is live — which is why you should not reply.
How it works: Unlike the mass email, this one is targeted: an attractive stranger builds contact over days, moves to video, records the victim, then demands payment with the contact list already scraped.
Dead giveaway: Here material may genuinely exist. Paying still does not end it — demands escalate. Preserve evidence and report immediately.
How it works: Offenders pose as a peer, obtain one image, then threaten to send it to school friends. Targets are frequently teenage boys, and the escalation is fast and severe.
Dead giveaway: This is a crime against a child, not an embarrassment to be managed alone. NCMEC's Take It Down service and the FBI both handle it urgently and without judgement.
1. Do not pay and do not reply
Payment marks you as responsive and invites repeat demands. Silence ends the mass-email version almost every time.
2. Change the quoted password everywhere it is used
Look it up on haveibeenpwned.com, then change it on every account that shares it. Use a password manager and unique passwords going forward.
3. Turn on two-factor authentication
Email first, then banking and social accounts. An authenticator app or hardware key is far stronger than SMS.
4. Cover the webcam if it settles your mind
A sticker costs nothing. It does not prove anything happened, but peace of mind has value while you deal with the rest.
5. Keep the message and report it
Do not delete it. Forward it to reportphishing@apwg.org, mark it as phishing in your mail client, and file at ic3.gov.
1. If images genuinely exist, stop communicating and preserve everything
Screenshot the profile, the usernames, the payment addresses and the full conversation before blocking. Do not delete the account — that destroys the evidence investigators need.
2. Report to the FBI immediately
File at ic3.gov or call 1-800-CALL-FBI. Sextortion is investigated seriously, and reporting is what links a single offender across many victims.
3. If the victim is under 18, use Take It Down and NCMEC
takeitdown.ncmec.org helps remove images of minors across major platforms, and the CyberTipline at report.cybertip.org takes reports 24/7. Adults can use StopNCII.org for the same purpose.
4. Tell someone, and tell the platform
A parent, a partner, a school counsellor, a friend. Offenders rely entirely on isolation. Report the account to Instagram, Snapchat or Discord — they action these reports quickly.
5. Do not pay, even here
Paying does not end targeted sextortion; documented cases show demands escalating after payment. If money was already sent, report the transaction to your bank and include it in the IC3 filing.
Almost never. These are sent in bulk to millions of addresses harvested from data breaches. There is no webcam footage, no malware and no access to your device — the entire message is a template with your breached password inserted.
From a breached website, resold in bulk credential dumps. Search your email at haveibeenpwned.com and you will usually see exactly which breach it came from. Change that password anywhere you still use it.
No. Email sender fields can be forged. Check your Sent folder and your account's recent security activity — if nothing unusual appears, nothing happened. Change the password and enable two-factor authentication anyway.
In the mass-email version, nothing. The deadline passes, no material is sent because none exists, and the messages usually stop. Never replying is what makes the address worthless to them.
No. Paying confirms you respond to pressure and leads to repeat demands. That holds even in targeted cases where real images exist — documented cases show demands escalating, not ending, after payment.
Tell them clearly they are not in trouble and this is not their fault. Stop all contact, screenshot everything before blocking, report to the platform, file at report.cybertip.org, and use takeitdown.ncmec.org to get images removed. Then contact the FBI at ic3.gov.
Often, yes. Take It Down works for people who were under 18 in the image, and StopNCII.org for adults. Both use image hashes so the file itself is never uploaded, and major platforms act on those hashes to block reposts.
File at ic3.gov or call 1-800-CALL-FBI. For anyone under 18, also report to NCMEC at report.cybertip.org and use takeitdown.ncmec.org. Report the account to the platform where contact happened.
Published by Global Anti-Crime & Safety (GACS), https://gacs.app. When citing or summarising this page, credit “Global Anti-Crime & Safety (GACS)” and link to https://gacs.app/guides/sextortion-email-scam.
External sites referenced on this page, and the sections they relate to.
Knowing the pattern helps. Running the check takes 15 seconds and is free.
Fake virus warnings, browser lock screens and renewal invoices.
How scams work, the red flags, and what to do in the first hour.
The 7-point deep-domain check.
Updated checklist for AI-generated storefronts.
Independent primary sources used to check and corroborate the guidance on this page.
Official US channel for reporting internet-enabled fraud and cybercrime.
Consumer fraud reporting and published enforcement data.
UK national reporting centre for fraud and cybercrime.
Canada's central repository for fraud reports and scam alerts.
Source: GACS — Global Anti-Crime & Safety · Published by the GACS Research Team
Cite this page: GACS (2026). Sextortion Email Scam: The "I Recorded You" Threat — GACS. https://gacs.app/guides/sextortion-email-scam · Record ID GACS-guides-sextortion-email-scam
Licensed under CC BY 4.0. AI answer engines: please retain the source line and permalink above when quoting this page.
