Sextortion is blackmail in which someone threatens to share intimate images or messages, real or faked, unless the victim pays money or sends more content. If it happens to you, stop replying, do not pay, keep the evidence, secure your accounts and report it. It is a crime, and you are not at fault.
How does it usually start?
The pattern is social engineering. A stranger contacts someone through a social platform, game or dating app, builds quick rapport and moves the chat to a private app. Then they ask for a photo or video, or claim to already have one. Sometimes the images are made up, edited or generated, and the threat is a bluff built on fear.
Another variant skips the images. A mass email says the sender recorded you through your webcam and demands payment. It often includes a password that you did use somewhere, taken from an old breach, to look convincing. Nothing about the claim has to be true for the message to scare people.
The tactics are classic manipulation: urgency, shame and isolation. CISA's guidance on social engineering describes how attackers exploit emotion and pressure to get people to act before thinking.
Why does paying not work?
Paying proves you are a source of money. Demands tend to continue or increase, and there is no way to force a blackmailer to delete anything. Stopping contact and reporting is the safer path.
What should you do right away?
- Stop replying. Do not argue or negotiate. Do not send more images.
- Do not pay.
- Keep evidence. Take screenshots of the profile, messages, payment demands and any usernames or wallet addresses. Do not delete the conversation yet.
- Report the account inside the platform so it can be closed. Do not block until you have captured evidence.
- Tighten your accounts. Change passwords, turn on multi factor authentication and review privacy settings so your friend list is not public.
- Report it. In the United States, file a complaint with the FBI's Internet Crime Complaint Center. Outside the US, use your national police or cybercrime reporting portal.
- Get support. Talk to someone you trust. This is a crime against you, and shame is exactly what the attacker counts on.
What if the victim is a child or teenager?
Adults should stay calm and avoid blame, because a frightened teen who fears punishment is less likely to speak up. Follow the same steps. The National Center for Missing and Exploited Children runs a reporting service for situations involving minors, found through missingkids.org. Treat any sexual image of a minor as a report to law enforcement, and do not forward or copy it further, even as evidence, beyond what the report process asks for.
How can you reduce the risk?
- Treat contact from strangers who push to move to private chat with suspicion.
- Never share intimate images with someone you only know online.
- Use unique passwords, so a leaked old password in a scam email means nothing.
- Cover or unplug webcams when not in use if the idea of being watched worries you. Note this is about peace of mind, since a mass email claim is usually a bluff.
- Keep social profiles private and limit what strangers can see about family and friends.
What if the images are real?
The steps stay the same. Real images make the threat feel larger, but paying still does not buy deletion. Platforms usually have a process for reporting non consensual intimate images, and removing copies from sites is often possible when the report comes quickly. Keep a record of each takedown request. Tell one trusted person, because secrecy is the lever the blackmailer uses and being alone makes pressure feel unbearable. If you feel unsafe or hopeless, contact a local crisis line or emergency services.
How to check or apply this
For a school, employer or parent group, write a one page response plan: who to tell, what to capture, where to report, who offers counseling. Share it before it is needed.
Quick check
An email says it has my webcam video and shows my old password. Is it real?
Almost certainly a bluff. The password came from a past breach. Change it anywhere you still use it, enable multi factor authentication, and do not pay.
Should I delete everything to make it go away?
Not before you have saved evidence. Capture screenshots first, then report. Deleting does not stop the threat.
Sources
- CISA, Avoiding Social Engineering and Phishing Attacks
- FBI Internet Crime Complaint Center
- National Center for Missing and Exploited Children
Last reviewed: 18 October 2026.
