What are the warning signs of a sextortion & blackmail email?

Watch for: Email includes an old password to scare you (often from a years-old breach); Demand for Bitcoin / USDT / Monero within a tight deadline; Threats to send footage to your contacts, employer or family; Generic wording with no actual proof of any footage.

How can I tell if this is a scam?

Stop and verify independently. Contact the organisation using details you look up yourself, never the ones in the message, and don't act on urgency. You can also paste the message into the ScamShield AI scam checker for a risk assessment — it gives guidance, not a guarantee.

What should I do if I clicked the link or replied?

Stop all contact, change the password on any account you logged into and turn on two-factor authentication, and watch your accounts for changes you didn't make. Do not pay — paying marks you as a target for repeat extortion. Change any reused passwords and enable 2FA on important accounts. Check haveibeenpwned.com to see which breach exposed the password.

What should I do if I already sent money?

Contact your bank immediately and ask about stopping or recalling the payment, keep all evidence, then report the scam. Be wary of anyone who later offers to recover your money for a fee.

Where should Australians report this scam?

Report scams to Scamwatch (National Anti-Scam Centre), report cybercrime to ReportCyber, forward scam texts to 7726, and contact IDCARE if identity details were exposed. Contact your bank first if money is involved.

All scams

🔒

Sextortion & blackmail email

Email or DM claiming to have intimate footage of you, demanding crypto to stay quiet.

Student

How it works

You receive a threatening message saying the sender hacked your webcam or has explicit photos. To look credible they include an old leaked password of yours (from a data breach). They demand Bitcoin within 24-48 hours or they'll send the footage to all your contacts. In most cases no footage exists at all.

Common scenarios to watch for

This scam shows up in several different shapes. Recognise the pattern, not just one message.

Reporting locationHotlines on the printed checklist will match this location.

Old-password 'I hacked your webcam' email

An email contains a real but old password from a data breach to scare you, then claims the sender filmed you via webcam and demands Bitcoin.

"I know your password is sunshine99. I have a video of you. Send $1,500 in BTC to bc1q... within 48 hours."

Red flags to spot

Does the email contain an old password you used years ago?
Is the sender demanding payment in Bitcoin or crypto?
Is there a tight deadline (24-72 hours)?
Is there NO actual video or screenshot attached — only threats?

Instagram / Snapchat catfish blackmail

A new account messages a teen or young adult, builds quick flirty rapport and convinces them to send intimate photos — then immediately demands money or threatens to share with their followers.

"Send $500 PayPal in 30 min or I send these to your mum and your soccer team. I have your followers list."

Red flags to spot

Did the conversation escalate to intimate images within hours of meeting?
Did the account suddenly switch to demanding money after you sent images?
Are they threatening to send images to specific people in your life?
Is payment demanded via PayPal, gift cards or crypto, fast?

Fake 'we filmed you on adult site'

Mass email claims malware on an adult website recorded you and your screen simultaneously. No malware exists — it's a bulk fishing email sent to millions.

"Our pixel-tracker on xvids recorded you on 12 Mar. Pay $2,000 in BTC or your contacts get the split-screen video."

Red flags to spot

Is the email sent to a generic address with no personal detail beyond a leaked password?
Are the threats vague (no real screenshot, just description)?
Does the wording match scripts found by Googling the first sentence?
Is the Bitcoin address one you can find reused in other scam reports?

Red flags

🚩Email includes an old password to scare you (often from a years-old breach)
🚩Demand for Bitcoin / USDT / Monero within a tight deadline
🚩Threats to send footage to your contacts, employer or family
🚩Generic wording with no actual proof of any footage
🚩Sender address is spoofed to look like your own email

What to do

1Do not pay — paying marks you as a target for repeat extortion.
2Change any reused passwords and enable 2FA on important accounts.
3Check haveibeenpwned.com to see which breach exposed the password.
4Report to ReportCyber (Australia), IC3 (US) or local police; save the message.
5If real images of a minor are involved, contact eSafety Commissioner immediately.

Who's targeted

Young men aged 14–30 (most reported group).
Anyone who's had a password leaked in a public breach.

Why it works

Shame and urgency push victims to pay before thinking.
Quoting a real (old) password makes the threat feel credible.

Common variations

Different shapes of the same scam — recognise the pattern.

1Email claiming malware on your device with old breached password.
2DM after a flirty chat asking to move to WhatsApp / video.
3Crypto demand to delete fabricated 'recorded' footage.

If you've already been scammed

1Stop replying — engagement encourages more demands.
2Save the messages, sender details and any wallet addresses.
3Report to eSafety Commissioner (esafety.gov.au) and ReportCyber.

Frequently asked

Do they really have footage?▾

In email blasts, almost never. In DM-based sextortion of teens, sometimes — still don't pay.

What if I paid?▾

Don't pay again — paying marks you as a target. Report to police and eSafety.

Where can I get help?▾

Kids Helpline 1800 55 1800, or eSafety's image-based abuse portal.

Questions people ask about this scam

How does the sextortion & blackmail email work?: You receive a threatening message saying the sender hacked your webcam or has explicit photos. To look credible they include an old leaked password of yours (from a data breach). They demand Bitcoin within 24-48 hours or they'll send the footage to all your contacts. In most cases no footage exists at all.
What are the warning signs of a sextortion & blackmail email?: Watch for: Email includes an old password to scare you (often from a years-old breach); Demand for Bitcoin / USDT / Monero within a tight deadline; Threats to send footage to your contacts, employer or family; Generic wording with no actual proof of any footage.
How can I tell if this is a scam?: Stop and verify independently. Contact the organisation using details you look up yourself, never the ones in the message, and don't act on urgency. You can also paste the message into the ScamShield AI scam checker for a risk assessment — it gives guidance, not a guarantee.
What should I do if I clicked the link or replied?: Stop all contact, change the password on any account you logged into and turn on two-factor authentication, and watch your accounts for changes you didn't make. Do not pay — paying marks you as a target for repeat extortion. Change any reused passwords and enable 2FA on important accounts. Check haveibeenpwned.com to see which breach exposed the password.
What should I do if I already sent money?: Contact your bank immediately and ask about stopping or recalling the payment, keep all evidence, then report the scam. Be wary of anyone who later offers to recover your money for a fee.
Where should Australians report this scam?: Report scams to Scamwatch (National Anti-Scam Centre), report cybercrime to ReportCyber, forward scam texts to 7726, and contact IDCARE if identity details were exposed. Contact your bank first if money is involved.

General scam awareness information. ScamShield AI cannot guarantee that every scam will be detected or that a message is legitimate.

Check a message like this Report & next steps