The subject line is often your password. Not just any password: one you really used, maybe years ago. The text, usually in slightly odd English, claims a hacker has taken over your computer, recorded you through your webcam while you visited adult sites and copied all your contacts. Unless you pay somewhere between 800 and 2,000 dollars in bitcoin within 48 hours, the video will be sent to friends, family and colleagues.
Getting a message like this is frightening, and that’s exactly the point. In the vast majority of cases it’s a mass scam, known as a sextortion scam: the same text is sent to millions of people and nobody recorded anything. Here’s how to be sure, and what to do.
Where the password they know comes from
This is the detail that makes the scam believable, and also the one that exposes it. The criminals didn’t hack your PC: they took your email address and password from one of the many data breaches of recent years, when a site you had signed up to was hacked and its database ended up online. These collections have been circulating for years and contain billions of email-password pairs.
Checking takes two minutes:
- go to haveibeenpwned.com, the free service that tracks known breaches;
- enter your email address and press Check;
- scroll through the list: you’ll almost always find the site the quoted password came from, often a service you’d forgotten about.
If the password is old and you no longer use it anywhere, the threat is empty. If you still use it, the problem isn’t the video, which doesn’t exist, but the fact that the password is public: change it everywhere right away.
Other signs it’s a bluff
- No proof. Someone who really had a video would attach a frame. These emails never do, because they have nothing to attach.
- Generic text. “Your device”, “your contacts”, “an adult site”, never a name, a time or anything you could check.
- It comes from you. Some versions appear to be sent from your own address, “to prove” they control your mailbox. In reality an email’s sender can be forged like the return address on an envelope. If you open the full headers (in Gmail: three dots > Show original), you’ll see it went through servers that have nothing to do with your provider and that the SPF or DMARC checks failed.
- The countdown. “You have 48 hours, I’ve added a pixel that tells me when you open this email”: it’s only there to make you act without thinking.
- A photo of your house. A recent variant attaches a picture of your home from Google Street View, based on an address taken from a breach. It’s unsettling, but it’s public data, not proof of surveillance.
What to do, step by step
- Don’t pay and don’t reply. Replying confirms the address is active and read by a scared person: you’ll get more emails, not fewer. Paying deletes nothing; it just marks you as someone who pays.
- Check the quoted password on Have I Been Pwned and change it wherever you still use it. If it’s the same as your main email password, start there.
- Turn on two-factor authentication for your email and your most important accounts. That way, even if another password leaks in future, it won’t be enough on its own.
- Report the message as spam or phishing in your email program, then delete it. You can also report it to your national cybercrime reporting service if you wish.
- Cover your webcam if it makes you feel better. It isn’t needed for this scam, but it’s a habit that costs nothing.
When the blackmail is real
There’s a very different case, and it must be taken seriously: when you really did exchange intimate photos or videos with someone you met online, perhaps on social media or a dating app, and that person now threatens to share them. Here the material exists. The rule is still not to pay, because demands usually grow, but you need to do more:
- don’t delete the conversation: save screenshots with the date, profile name and messages;
- block the contact after collecting the evidence;
- report it to the police, who deal with these cases every day;
- if the images are published, report them to the platform. Services such as StopNCII.org help adults stop intimate images from being shared on participating platforms.
If a minor is involved, there is nothing to be ashamed of in asking a trusted adult and the police for help straight away: it’s a serious crime by the blackmailer, not the fault of the person being blackmailed.
For everyone else, the people who got the email with the old password, the bottom line is simple: it’s an extortion attempt built from old data and a lot of psychology. Change that password, turn on two-factor authentication and bin the message. To understand how passwords end up in circulation, read our guide to infostealers and stolen accounts.