"I hacked your camera": why the sextortion email is almost always a bluff

It usually starts with something that makes your stomach drop. The email says the writer has hacked your device, recorded you through your webcam while you visited adult websites, and copied your contacts. Unless you pay in Bitcoin within 48 hours, the video goes to everyone you know.

Sometimes it's worse: the email includes a password you really used, or appears to be sent from your own email address, or even contains a photo of your house.

If you've received one of these, take a breath. This is one of the most common scam emails in the world, sent to millions of people at once, and in almost every case there is no video, no hack and no hacker watching you. Here's how the trick works, and what to do.

How the scam works

The whole scam relies on three things: fear, embarrassment and a few details that seem impossible for a stranger to know. Each of those details has a boring explanation.

"They know my password"

This is what convinces most people. The explanation: over the last fifteen years, billions of email addresses and passwords have leaked in data breaches of websites like LinkedIn, Adobe, Dropbox and countless smaller ones. Those lists are traded and sold openly among criminals.

The scammer simply takes a list of email addresses with old passwords and mail-merges them into a template. They don't have access to your computer; they have a line in a spreadsheet. Notice that the password is usually one you used years ago. You can check which breaches your address appeared in with our guide: How to know if your email was leaked in a data breach.

"It was sent from my own email address"

This looks like proof that they're inside your account. It isn't. Email was designed without any check on the "From" line, so anyone can type any address there, a trick called spoofing. Look in your Sent folder: the email won't be there, because you didn't send it. Many providers now flag or block these, but some still get through. (Our article on how email works explains why this is possible at all.)

"They sent a photo of my house"

A newer version includes your name, your street address and a picture of your home. It's frightening, but the picture comes from free online street maps, and the name and address from leaked or publicly available data. It proves the scammer did a lookup, not that they've been anywhere near you or your devices.

"They know I watch adult content"

They don't know anything. The message is identical for millions of recipients. A large share of adults have visited such websites at some point, so the claim hits home often enough to make the scam profitable. If you haven't, you've just noticed the scam's biggest flaw.

Signs it's the mass-mailed scam

• It demands payment in cryptocurrency, usually Bitcoin, to a wallet address.
• It gives a short deadline, typically 24 to 48 hours.
• It claims it has "installed malware" through a website you visited, in vague technical language.
• It says it will know when you've opened the email. (It can't, at least not in a way that means anything.)
• It contains no actual evidence: no screenshot, no clip, no specific detail about what you were doing.
• The grammar is often odd, because the same text is translated and reused in many countries.

That last point about evidence is the key. Anyone who genuinely had a video would show you a still frame. They never do, because there isn't one.

What to do

1. Don't pay. Paying doesn't make anything go away. It marks you as someone who pays, and you may receive more demands.
2. Don't reply. A reply confirms your address is active and read by a worried person.
3. If the password is one you still use, change it now, everywhere you've used it, and turn on two-step verification. The threat is a bluff, but the leaked password is real, and someone could try it on your accounts.
4. Report it as phishing or spam in your email app, then delete it.
5. If it's a work email, tell your IT team. The same message has probably reached colleagues too.

If you're worried your webcam really was accessed, run a full scan with your security software and keep your system updated. Many people also put a small cover over the webcam, which is cheap peace of mind.

When it isn't a bluff

There's a different and much more serious crime that shares the same name. In real sextortion, someone genuinely has intimate images, usually because they were sent to a person the victim met online who turned out to be a criminal using a fake identity. These cases increasingly target teenagers.

You can tell them apart: in real cases, the criminal knows exactly who you talked to and when, and often shows the images. If that's your situation:

• Don't pay, and don't send anything else. Payment almost never ends it.
• Keep the evidence: screenshots of messages, usernames and payment requests.
• Block the person and report the account on the platform where you met.
• Report it to the police. This is a serious crime, and you are the victim of it.
• If the images were taken when you were under 18, the Take It Down service run by the US National Center for Missing & Exploited Children can help get them removed from participating platforms, wherever you live.
• Talk to someone you trust. People in this situation often feel they have to handle it alone. They don't.

Why these emails keep arriving

Sending a million emails costs a scammer almost nothing. If even a tiny fraction of recipients panic and pay, the scam is profitable, so they keep sending. Blockchain researchers have tracked wallets from these campaigns receiving real payments, which is why the template keeps coming back in new variations.

The best long-term defence is keeping your main email address out of the lists they're built from. Use unique passwords (a password manager makes this easy), turn on two-step verification, and give sites you don't trust a temporary email address instead of your real one. An address that no longer exists can't be leaked, sold or scammed.