Sextortion scam emails: "I hacked your camera"

The email says a hacker has taken over your computer, recorded you through your webcam while you visited adult websites, and will send the video to everyone you know unless you pay in Bitcoin within 48 hours. It may even quote one of your passwords, or appear to come from your own address. It's frightening by design. In the bulk version that lands in inboxes everywhere, it's also a bluff.

What is a sextortion scam email?

A sextortion scam email is a mass-mailed blackmail threat. The FTC describes emails claiming "they hacked into your computer and recorded you visiting adult websites," threatening to share the video with your contacts unless you pay. Its advice is direct: "Stop. Don't pay anything. Delete the message. It's a scam."

The FBI's Internet Crime Complaint Center (IC3) has warned about the same scam several times. Its 2018 alert and 2020 alert list the features these emails share.

How do you recognize a sextortion email?

If the email you received matches most of this table, you're looking at the bulk scam.

Why is the threat almost always fake?

The password came from a data breach

The scariest part is a real password in the subject line or first paragraph. The FTC explains that your email address was likely exposed in a data breach, and scammers may include a real old or recent password "to prove it." They didn't get it from your computer. They got it from a list of leaked credentials from some website you once signed up to.

That still matters. If you use that password anywhere, someone else may already be trying it. Change it.

The webcam claim is "all talk"

The FTC says the scammers may claim access to your webcam or computer, and calls this "all talk." There's no recording. The email is a template sent to many people at once, with each recipient's address and leaked password slotted in.

The "from your own address" trick is spoofing

Some versions arrive from your own address, which the scammer presents as proof they control your account. It isn't. Email lets a sender put any address in the From line. Gmail Help says spammers can use your address as the sender or reply-to address, and that when a message in Spam shows your address replaced with "Me", someone tried to use your address as the sender.

To confirm, check your Sent folder: the message won't be there. Then look at the headers in the free Email Header Analyzer. A spoofed copy usually fails SPF, DKIM or DMARC and shows servers you've never used. Our guide to someone sending email from your address covers the full spoofed-or-hacked test.

What should you do if you get a sextortion email?

1. Don't pay. The FBI "does not condone the payment of extortion demands as the funds will facilitate continued criminal activity" (IC3, 2018).
2. Don't reply. The IC3 advises: "Do not communicate with unsolicited email senders." A reply confirms your address is read by a real person.
3. Don't click links or open attachments in the message.
4. Change the quoted password, everywhere you still use it. The FTC says to change it on the account it belongs to and consider changing other passwords too. Use a different password for each site.
5. Turn on multifactor authentication. CISA explains how MFA stops a stolen password being enough on its own.
6. Report it. In the US, file a complaint at ic3.gov. The FBI asks you to include "the extortion e-mail with header information and Bitcoin address if available." You can also report it to the FTC at ReportFraud.ftc.gov. Our guide on how to report a phishing email covers other countries and your mail app.
7. Delete it, after reporting it.

If it arrived at work, tell IT. The same message has probably reached colleagues, and some of them may be frightened enough to pay.

When is it not the bulk scam?

The bulk email above is a bluff. Real sextortion also exists, and it's different: someone you've been in contact with online has images you actually shared and is threatening to release them. If that's your situation, or if the target is a child, treat it as a crime in progress.

• Don't pay, and keep everything. Don't delete the messages or the account; they help investigators.
• Report it to the FBI. The FBI's 2023 alert lists IC3 at ic3.gov, 1-800-CALL-FBI (225-5324) and your local FBI field office.
• For a child, contact NCMEC on 1-800-THE-LOST (843-5678). The FBI notes that NCMEC can help request removal of images from websites.
• Beware of companies charging for help. The same FBI alert warns about for-profit firms charging victims, and says law enforcement and non-profit agencies "will provide assistance at no charge to victims."

Why do these emails count as spam?

Sextortion emails are unsolicited bulk mail. The same template goes to huge numbers of addresses taken from breach lists, with only the name and password changed. That's exactly what spam filters are built to catch: senders with no reputation, failed authentication when your own address is forged, and content that matches known campaigns.

Filters won't catch every variant, because the wording and payment details keep changing. That's why two simple controls matter just as much:

• Report the copies that get through. Each report helps your provider recognize the next wave. In Outlook, use Report > Report phishing; in Gmail, More > Report phishing.
• Enforce DMARC on your domain, so receivers can reject messages that forge your exact address, including the "from yourself" version. Check yours with the DMARC Checker, and see how to stop email spoofing of your domain.

How should IT handle a wave of sextortion emails?

These emails often arrive in batches. When one person reports one, assume others received it too.

1. Find and remove other copies. Search for the subject line, sender and Bitcoin address across mailboxes, and remove or quarantine the matches.
2. Block what's reusable. Add the sending address or domain to a block list where it makes sense. Expect the next wave to change both.
3. Check the quoted passwords. If the email shows a password, ask whether it's used for any work account. If it is, reset it, sign out existing sessions and confirm MFA is on. A leaked password that still works is a real risk, even though the blackmail isn't.
4. Check the From line. If the copies forge your own domain, review your DMARC policy. At p=none, receivers aren't asked to act on mail that fails.
5. Send one short staff notice. Describe the email, say it's a known scam, and repeat: don't pay, report it, delete it.
6. Keep a copy with headers in case anyone files a report with IC3.

What should businesses tell staff?

• Expect it. Tell staff these emails exist, that they're a bulk scam, and that the right response is to report and delete, not to pay.
• Make reporting embarrassment-free. Nobody wants to forward an email accusing them of watching adult content. Say clearly that IT has seen it many times and won't read anything into it.
• Use breach alerts. When an employee's work address shows up with a leaked password, make sure that password isn't used anywhere at work.
• Quarantine, don't just junk. A quarantine keeps these messages out of sight while still letting you release anything caught by mistake.

Next steps

1. Change the password the email quoted, on every site where you used it, and turn on MFA.
2. Report the email to IC3 or the FTC with its headers, then delete it.
3. Read how to spot a phishing email so the next scare is easier to recognize.
4. Check your domain's SPF, DKIM and DMARC with the free Email Health Check. If you'd like spam and spoofing filtering in front of every mailbox on your domain, see how iBlockSpam works.

Browse our other phishing and threat guides.