You open your inbox and find an email claiming someone has recorded you through your webcam. It threatens to send the footage to everyone you know unless you pay in Bitcoin within 48 hours. Your stomach drops. Before you do anything else, read this — because a sextortion email follows a very predictable pattern, and understanding that pattern is the fastest way to calm down and respond correctly.
What a sextortion email actually looks like
The typical email is cold and businesslike on purpose. It does not read like a ransom note from a movie. It reads like an invoice. The sender claims to have installed malware on your device, recorded you through your webcam while you visited adult websites, and now holds footage that will go to your entire contacts list unless you pay — usually a few hundred to a couple of thousand dollars in cryptocurrency — within 24 to 48 hours.
The detail that shocks most people is the password. Many of these emails include a real password the recipient has used before. That password was not obtained by hacking your device. It came from one of the many large data breaches that have leaked billions of login credentials over the years. The scammer bought or downloaded a list and dropped your old password into the email template automatically. Its only job is to make the threat feel personal and real.
The short answer: most are pure bluff
The sender almost certainly has no video, no images, and no access to your device or your contacts. These messages go out in bulk — the same template sent to tens of thousands of addresses at once. There is no individual targeting. The scammer has not visited your profile, does not know your name, and cannot see your screen.
The business model is simple: if one person in a hundred panics and pays before they stop to think, the campaign turns a profit. Carrying out the actual threat would take time, create evidence, and expose the sender to serious criminal liability. Fear is the product. The threat is the mechanism. Following through is never the plan.
When the threat is not a bluff
There is an important distinction between mass-blast scam emails and situations where someone genuinely holds real material. Real cases of image-based abuse do happen, but they look different. The person contacting you knows your name, references specific details about you, and usually reaches out via social media or direct message rather than a generic email to an address they scraped from a database.
If a message includes an actual image of you as proof, treat that as a separate and more serious situation. The same applies if you shared intimate images directly with someone and that relationship has since broken down.
Minors face a higher-risk version of this. Grooming — where an adult builds trust with a young person over time specifically to obtain images — does result in real material being held. This is why teenagers need a clear, non-judgmental route to ask an adult for help before the situation escalates.
Why paying makes things worse
Paying confirms two things immediately: your email address is active and monitored, and you are willing to pay under pressure. Once a scammer knows both of those things, demands escalate. The original amount doubles. New threats appear. Your details get passed or sold to other operations as a verified payer, which means more attempts follow from different senders.
There is no agreement to honour. The scammer has no incentive to stop once you pay because stopping means losing leverage. Payment does not end the threat — it starts a longer one.
What to do when you receive one
Here are specific steps you can take right now, not vague guidance for some future moment:
- Do not reply and do not pay. Any response tells the sender the address is live.
- If the email contains a password you still use anywhere, change it today — on every site where that password appears. Use a different password for each site. A free password manager makes this manageable.
- Mark the email as spam and delete it. Do not keep it open on your screen.
- If you have genuine reason to believe real material exists, contact your national cybercrime reporting body. In the US that is the FBI’s Internet Crime Complaint Center (IC3). In the UK it is Action Fraud. Do not try to negotiate alone.
- Tell one person you trust. Isolation is exactly what these schemes rely on. Saying it out loud to a friend or family member reduces the psychological grip immediately.
If someone really does have an image of you
This is the situation people fear most, and it is the one where concrete help exists and is least well known. Free services can stop an image spreading, and you do not have to send the image to anyone to use them.
- If you are 18 or over: StopNCII.org creates a digital fingerprint of the image on your own device and shares only that fingerprint — never the picture itself — with participating platforms so they can block it from being uploaded. It is free and works internationally.
- If you are under 18, or the image was taken when you were: Take It Down, run by the US National Center for Missing & Exploited Children, does the same thing for young people. In the UK, Report Remove from Childline and the Internet Watch Foundation offers the same help.
- Keep the evidence before you delete anything. Screenshot the messages, the profile and the account name. You can block the sender afterwards.
None of these services require you to have paid, to have reported to police first, or to explain how the image came to exist. They exist to stop the spread, nothing else.
The psychological trick behind the timer
The 48-hour countdown is not a technical deadline. There is no server waiting to fire off emails the moment the clock runs out. The timer exists for one reason: to stop you from sleeping on it, searching for it online, or asking someone what they think. Any one of those actions would almost certainly lead you to recognise the scam and not pay.
Scammers know that a panicked person acts alone and fast. A calm person who takes 20 minutes to search the email’s exact wording finds thousands of identical reports and pays nothing. Artificial urgency is a standard tool in fraud and high-pressure sales alike — the mechanism is the same whether someone is selling you a car you do not need or threatening you into a Bitcoin transfer.
Why this keeps happening
These campaigns keep working at scale because the online systems most of us use every day have no reliable way to verify that the person sending an email or creating an account is who they claim to be. There is no meaningful cost to sending a threatening email to 50,000 strangers. When fraud happens, the response is almost always to investigate and prosecute after the fact — chasing people who are often operating across multiple jurisdictions under false identities. The foundation that would make this harder — some way to tie an online action to a real, accountable person — was never built into how the internet works. Until it is, the economics favour the scammer, and ordinary people bear the cost.
How to talk about this with someone you care about
Shame keeps many people from mentioning these emails to anyone, which is exactly what scammers rely on. If you want to bring it up with a family member or friend, frame it matter-of-factly: these emails reach millions of inboxes and receiving one says nothing about what the person has been doing online. It is the digital equivalent of a scam letter.
For parents: teenagers are more likely to encounter the version where real material is involved, because grooming is specifically designed to target younger people. The most useful thing you can do is make it clear — before anything happens — that they can come to you without being judged or punished. A teenager who is afraid of your reaction will handle it alone, and that is when real harm occurs.
Frequently asked questions
How can I tell if a sextortion email is real?
Look at how it reaches you and what it knows. A mass-blast scam arrives by email at an address that has appeared in a data breach, does not use your name, and offers no actual proof. A real case usually comes by direct message from someone who knows who you are, and includes genuine material as evidence. If the only “proof” is an old password, that came from a breached website rather than from your device — billions of credentials have leaked from hacked websites over the years, and scammers insert them into the template automatically to make the threat feel credible.
What happens if I ignore a sextortion email?
In the overwhelming majority of cases, nothing happens. The sender moves on to the next address on the list. The one action worth taking before you ignore it is checking whether the password mentioned is still in use anywhere — if it is, change it, because that password has been exposed regardless of the scam itself.
Should I be worried about a sextortion email?
If it arrived as a generic email with no image attached and no use of your real name, the realistic risk is very low. Worry is the product being sold. What is worth acting on is the password: its appearance means an account of yours was in a breach, and that is a genuine security issue separate from the threat itself.
Should I report a sextortion email to the police?
You can, and doing so does help build a picture of how these campaigns operate. In most countries the practical route is an online cybercrime report rather than a local police station visit. In the US, file with the FBI’s IC3 at ic3.gov. In the UK, use Action Fraud. If you are a minor, or if real material is genuinely involved, involve law enforcement directly and do not wait.
Mafiology tracks the tactics behind these schemes so you can recognise them early. Get our fraud-pattern alerts, plus a free copy of Wes Kussmaul’s Escape the Plantation on how scammers attack you and your family, and what can be done to stop them.
