In this guide 10 sections
At a glance
The short version.
Watch for
- An email claiming your device or webcam was hacked and you were recorded on adult websites
- A real password — often an old one — quoted as ‘proof’ that the sender has access
- A demand for Bitcoin, other cryptocurrency or gift cards, often with a deadline of hours
Already acted?
Stop replying and don’t pay anything more, whatever new deadline or threat arrives.
See every recovery stepWhat is changing now
The current pattern.
Sextortion currently arrives in two main forms. Mass emails claim a hacked webcam recorded the recipient on adult websites, sometimes quoting a real password from an old data breach, and demand Bitcoin within hours. Targeted, financially motivated sextortion starts with a friendly or flirtatious contact on social media, dating, messaging or gaming apps and turns to threats once an intimate image is shared — or fabricated. The UK National Crime Agency says victims of any age can be targeted, but teenage boys aged 14–17 and men aged 18–30 are particularly at risk. NCMEC reports a dramatic increase in financial sextortion, with teenage boys the most common targets.
How it works
How the scam unfolds.
The mass email is a numbers game. It claims malware or a hacked webcam captured you on an adult website and threatens to send the footage to your contacts unless you pay in cryptocurrency, often within hours. The UK’s National Cyber Security Centre says the sender does not know whether you have a webcam or what you have looked at: they are guessing, and gambling that enough recipients will pay. A real password in the message most likely comes from an old data breach, not from your device.
Targeted sextortion begins with what looks like an ordinary contact — a follow request, a flirtatious message on a dating or gaming app, or a message from a friend’s account that has been hacked. The profile may pose as someone attractive, younger or of a different gender, may already follow people you know, and quickly pushes the chat to a private app or video call. Once an intimate image or recording exists, the tone switches to threats to send it to family, friends or colleagues unless money, gift cards or cryptocurrency are paid. Some offenders use edited or AI-generated images, so a threat can arrive even when no real image was shared.
Both versions run on panic, shame and secrecy: the offender wants payment before you have time to think or tell anyone. Financially motivated sextortion is usually run by organised criminal gangs, often based overseas, and safety bodies in the UK, US and Australia agree that paying rarely makes it stop — once you have shown you can pay, more demands are likely. The person making the threat is the one committing a crime. Being targeted, even after sharing an image you now regret, is not your fault.
Warning signs
Reasons to stop and verify.
- An email claiming your device or webcam was hacked and you were recorded on adult websites
- A real password — often an old one — quoted as ‘proof’ that the sender has access
- A demand for Bitcoin, other cryptocurrency or gift cards, often with a deadline of hours
- A new contact who turns flirtatious quickly and pushes to move to a private app or video call
- A camera that ‘isn’t working’, or a profile that doesn’t match what you see and hear on a call
- A threat to send an intimate image to your family, friends or colleagues unless you pay
Spot the signs
What it can look like.
Highlighted phrases are warning signs; the numbered notes explain each one.
Security Notice <notice.4471@inbox-relay.example1 (warning sign 1)>
I know your password: bluebell19872 (warning sign 2)
I’ll keep this short.
I installed malware on your device months ago and have been watching through your webcam.3 (warning sign 3) I recorded you while you were visiting adult websites.
If you want the recording deleted, send £950 in Bitcoin4 (warning sign 4) to this wallet: bc1q-example-wallet
You have 48 hours.5 (warning sign 5) If I don’t receive payment, the video goes to everyone in your contacts — family, friends and colleagues.6 (warning sign 6)
- A stranger’s address
An address you have never dealt with. The sender doesn’t need to know you: the NCSC says they are gambling that enough recipients will respond for the scam to pay.
- An old password as ‘proof’
The NCSC says passwords in these emails most likely come from old data breaches. It shows the sender has leaked data, not that they have been inside your device — but change it anywhere you still use it.
- Technical claims with no evidence
Malware and webcam access are claims, not proof. The FTC calls them ‘all talk’, and the NCSC says the sender does not even know whether you have a webcam.
- A cryptocurrency demand
Every version ends in a payment demand. The NCSC warns that paying is likely to mark you as a ‘willing’ target for more scams.
- A deadline in hours
The FTC describes threats to send the video ‘within hours’. A short deadline is there to stop you thinking, checking or telling anyone.
- A threat aimed at your relationships
Naming family, friends and colleagues makes embarrassment do the work. The sender is relying on shame, not on a recording.
The message proves only that your email address and an old password were leaked. Don’t reply or pay — report it, then change that password everywhere you reused it.
Composite example: names, numbers and “.example” addresses are fictional.
Worked example
A realistic pattern, separated into evidence.
This composite example is educational. It does not describe a real person or reproduce a live malicious message.
A friendly new follower turns into a blackmailer
- 01The opening
A 20-year-old student accepts a follow request from someone who appears to be a woman his age. The account already follows several people from his university, and the conversation is easy and flattering.
- 02The escalation
The same evening she suggests moving to a private messaging app, says her camera isn’t working and sends a photo she claims is of herself. Soon after he shares an intimate image, the tone changes: a message names his family members and demands £300 in gift cards within the hour, or the image will be sent to them.
- 03The decision point
Panic pushes towards paying quickly to make it stop. But the demand comes from someone who has already lied about who they are, and nothing guarantees that a payment ends it. Showing that he can pay is likely to bring a second demand.
Independent verification
Test the request without using its evidence.
These checks deliberately move the decision away from the person, link, number or account that introduced the request.
- 01
Stop before you reply or pay
Don’t answer, argue or negotiate, and don’t send money, gift cards, cryptocurrency or more images. Safety bodies in the UK, US and Australia agree that paying rarely ends the threats and is likely to bring further demands.
- 02
Ask what the message actually proves
Your name, email address or an old password shows only that the sender has data from a breach. It does not show they have been inside your device or recorded anything. The NCSC says senders of mass sextortion emails do not even know whether you have a webcam.
- 03
Check the quoted password
The NCSC suggests checking your email address at haveibeenpwned.com to see whether it appears in known breaches and to get alerts about future ones. If you still use the quoted password anywhere, change it there now — starting with your email account — and turn on 2-step verification.
- 04
Keep the evidence, then block
If the threat comes from someone you have been talking to, screenshot the messages, their profile, usernames, links, dates and any payment details before you block them. Deactivate rather than delete your accounts so evidence is not lost, and don’t send your images to anyone else.
Prevention
Make the next attempt harder.
- 01
Use a different password for every account
A password leaked in one breach then can’t unlock anything else. Turn on 2-step verification for your email and social media, and let a password manager remember the passwords for you.
- 02
Lock down who can reach you
Set social media and gaming accounts to their highest privacy level so strangers can’t message you or see your friends and followers. Mutual friends are not proof: fake profiles sometimes follow many people from the same school, team or community first.
- 03
Treat speed as the warning sign
End and block any conversation that turns sexual quickly, pushes you to a private app, or comes from a friend’s account that suddenly doesn’t sound like them. It is always OK to say no to sending images.
- 04
Talk about it before anything happens
Families can have regular, calm, non-judgemental conversations about relationships and being online. Make sure young people know they can come to you without being punished, and how to report if they would rather not.
If you already acted
Protect access and contact the real provider.
- Stop replying and don’t pay anything more, whatever new deadline or threat arrives.
- If you paid, contact your bank or payment service straight away — some transfers can be cancelled if you act quickly — and report it to the police.
- Before blocking, screenshot the messages, profile, usernames, links, dates and payment details. Deactivate rather than delete accounts so the evidence survives.
- Report the account to the platform and the police. Young people and parents can also use CEOP (UK), NCMEC’s CyberTipline (US) or the ACCCE (Australia).
- Use StopNCII.org for images taken at 18 or over, or Take It Down and Report Remove for images taken before 18, to help stop them spreading on participating platforms.
- Tell someone you trust or contact a support line. If you feel overwhelmed or at risk of harm, call emergency services or a crisis line now — what someone else chose to do is not your fault.
Common questions
Short answers to real doubts.
Should I pay to make it stop?
No. The UK National Crime Agency says there is no guarantee that paying will stop the threats, and once you have shown you can pay you are likely to be asked for more. NCMEC says paying rarely stops the blackmail, and Australia’s eSafety Commissioner notes that blackmailers usually give up when they realise they won’t be paid. If you have already paid, don’t pay anything more and contact your bank or payment service quickly — a transfer may be cancellable if you act fast.
What to do if you already paidThe email included my real password. Have I been hacked?
Probably not in the way the email claims. The NCSC says passwords in these emails most likely come from old data breaches, and the FTC calls the claims of webcam access ‘all talk’. The real risk is the password itself: if you still use it anywhere, change it on every account where it was reused and turn on 2-step verification, starting with your email. Then report the email — in the UK, forward it to report@phishing.gov.uk; in the US, report it at ReportFraud.ftc.gov — and delete it.
Secure accounts after a password leakMy child is being threatened. What do we do?
Stay calm and make it clear this is not their fault: the person making the threats is responsible, even if your child made a choice they regret. Help them stop replying, don’t pay, and screenshot the messages and profile before blocking. Report the account to the platform and to the police. In the UK, young people can also report to CEOP’s Safety Centre and use Report Remove from Childline and the IWF; in the US, report to NCMEC’s CyberTipline; in Australia, report to the ACCCE. Take It Down can help stop images taken before 18 being shared on participating platforms.
Use Take It Down from NCMECCan an intimate image be removed if it has been shared?
Help is available, although no service can guarantee every copy disappears. StopNCII.org, for images taken at 18 or over, creates a digital fingerprint of the image on your own device so participating platforms can detect it; the image itself is not uploaded. Take It Down works in a similar way for images taken before 18, and UK under-18s can use Report Remove. In Australia, eSafety can help get shared images removed. Report the content to the platform where it appears as well.
Go to StopNCII.orgSources
Official guidance used for this article.
Stop & Verify summarises these sources for general education. Reporting routes and legal protections vary by location.