It usually arrives quietly, with no subject line that screams danger. Then you open it, and your stomach drops: the first line of the email is a password you genuinely used once. A real one. And beneath it, a stranger claims they hacked your computer, recorded you through your webcam, and will send the video to everyone you know unless you pay — in bitcoin, within 48 hours.
Take a breath. That password being real does not mean the rest is. These emails are sent by the thousand to addresses bought off leak lists, and the threats are almost always a complete bluff. The scammer has no video of you, no access to your device, and no list of your contacts. Understanding exactly which parts are real — and which are theater — is the fastest way to get your pulse back to normal.
What these emails usually claim
The wording changes a little with each wave, but the script barely does. It goes something like this: the sender installed malware on your device through a browser vulnerability or a site you visited, which gave them full access to your files, your email, your contacts, your webcam and your microphone. They recorded you while you were watching something embarrassing. You now have a short deadline — often 24 to 48 hours — to send a payment in cryptocurrency, usually bitcoin. If you don’t, the recording goes out to your friends, family and coworkers.
Some versions add a flourish that makes the message feel hand-crafted: the email appears to come from your own address, as if the sender hacked your inbox. A newer variant even opens with a photograph of your front door and your street address, warning that “visiting your home” would be more convenient for them. None of these flourishes require the scammer to actually touch your devices. The “from your own address” trick is simple email spoofing — the sender line is faked, and it proves nothing about access to your account. The photo of your house is a screenshot from a mapping site’s street view, matched to your address from a people-search page.
Why the password in the email is real
Here is the one genuinely true part: the password you see is usually one you actually used. It typically comes from an old data breach. Scammers match your email address against leaked databases — the kind that list which address used which password on some forgotten forum, shopping site or service from years ago — and paste it into the message to make the threat feel credible. Knowing that password does not mean they hacked your account, your email or your computer. It only means the password leaked somewhere along the way, which happens to most of us eventually.
If you still use that password anywhere, though, the email has accidentally done you a favor by flagging it: a password from a breach should be changed everywhere it appears, and each account should get a unique one. That is the only part of this email worth acting on.
The little tricks that make it feel personal
Every convincing detail in the message is cheap for the scammer to produce. The spoofed sender line costs nothing. The real password costs a few dollars per thousand records on the breach market. The street-view photo costs one Google search. Even the deadline is a psychological tool: a countdown leaves you no time to think, ask someone, or search for what’s really going on. Payment is demanded in cryptocurrency not because the scammer is sophisticated, but because it is hard to reverse — unlike a card payment, which can be charged back and traced.
There is also the QR code many of these emails now include to “make payment easier.” It is just a bitcoin address in a scannable format. Don’t scan it, don’t click anything, and don’t reply — even to tell them off. Any response confirms your address is read by a real person, which makes you a better target for the next attempt.
The only part of the email you should act on
So the threats are theater — but there is a genuine security lesson hiding in the one true detail. If that leaked password is still guarding any of your accounts, change it everywhere you used it, and give each account its own password. Start with your email: if someone got into your inbox, they could reset almost everything else. Then turn on two-factor authentication — or better, switch the account to a passkey where that’s offered, since passkeys can’t be phished or reused across sites.
While you’re at it, check your account’s recent sign-in activity and recovery details (most services list them in the security settings). This isn’t because the scammer broke in — they didn’t — but because a breached, reused password is the kind of thing that invites real trouble later.
What to do with the email itself
The answer is boring, and that’s the point: report it, then delete it.
In Gmail, use the Report phishing option in the message menu; Apple Mail and most other apps have a similar report-junk option. In the United States, you can also file a report with the FBI’s Internet Crime Complaint Center at ic3.gov; in the UK, forward the message to report@phishing.gov.uk, the national reporting service. Then delete the email. If you only received and read the message — no attachments opened, no links clicked — you don’t need to scan anything; simply receiving a sextortion message does not mean your device has malware.
One thing the scam shares with its cousins is worth noting: paying never ends the matter. This particular racket is closely related to the fake “virus detected” pop-up scam, and both run on the same business model — selling you relief from a problem they invented. Paying the ransom just teaches the scammer that your address belongs to someone who pays, which is the most valuable information in their entire database.
The rare case where it’s not a bluff
Honesty requires one exception: not every threatening message is mass-mailed nonsense. Real, targeted sextortion exists — but it looks very different. It usually mentions genuinely private details only someone who knew you would have, or it comes from someone who actually had access to you or your accounts. A generic email quoting a six-year-old forum password is not that. Trust the gap between the two.
If you are ever in the genuinely awful position where someone really does have intimate images of you, the advice flips: tell someone you trust first, report the content to the platform where it appears, and use the proper tools — StopNCII.org for adults and Take It Down for anyone who was under 18 when the content was made. Both work by sharing a digital fingerprint of the file with participating companies, which can then block matching uploads, and neither asks you to send the image anywhere.
For the email you actually received today, though? Delete it. The fear it caused was the whole product — and it was never yours to buy.
