Skip to main content

What to do now

Sextortion email demanding bitcoin: what to do

Last checked

These emails claim your webcam or computer was hacked and demand bitcoin. They go out in bulk; a password they quote comes from an old data breach, not from your device. The senders are guessing.

Already paid? Start with step 5.

Do this now

  1. Don’t reply and don’t pay

    A reply confirms your address is in use, and paying shows you will pay, which is likely to bring more demands. No case of these threats being carried out has been demonstrated so far.

  2. Keep the email until you have reported it

    Keep the email itself, and a screenshot of it and of the bitcoin address: a report or a complaint will ask for them.

  3. If it shows a password you use, change it

    Change it everywhere you still use it, and turn on two-step verification on those accounts.

  4. Report the email

    Forward or report it to the services below, then delete it.

  5. If you already paid, act now

    Contact the exchange or the bank you paid through, keep the transaction details, and report it to the police.
On this page07

Check it with isMalicious

isMalicious compares what you paste with the threat intelligence sources it collects. It does not scan your device and cannot undo what already happened.

Crypto wallet checker

Paste the bitcoin address from the email into the crypto wallet checker. The report shows whether scam lists, sanctions lists or ransomware payment records name it.

What it does not mean
A listed address confirms a known scam; an unlisted one does not make the threat real. Don’t pay either way.

Password breach checker

If the email quotes a password, the password breach checker tells you whether it appears in known breaches. It is hashed in your browser; only the first five characters of its SHA-1 hash are sent.

What it does not mean
A match explains where the scammer found it; it does not mean your device was hacked.

Email checker

Paste the sender’s address into the email checker to see whether threat sources report it.

What it does not mean
The sender of an email can be forged, sometimes as your own address, so a listing or its absence says little about who sent it.

Report it

Keep the message, the link or the number until you have reported it: you will need them. These are the services that handle each case.

In the United States

In the United Kingdom

Somewhere else? Report to your national police or your country’s cybercrime reporting service.

In France? The French version of this guide lists the French services.

How to spot the next one

  • It quotes one of your old passwords to look credible. Passwords like that circulate in data breach lists.
  • It appears to come from your own email address, to suggest someone controls your mailbox.
  • It sets a short deadline and demands payment in bitcoin or another cryptocurrency.
  • It contains nothing specific about you beyond your address, a name or an old password.

Questions

How do they have my password?

From an old data breach. Sites that were hacked leaked their users’ passwords, and those lists are reused by scammers. It shows they have a list, not that they are in your computer. Change it wherever you still use it.

The email came from my own address. Is my mailbox hacked?

Not necessarily: the sender of an email can be forged, and these scams display your own address to make the threat look real. If you are unsure, change the mailbox password and turn on two-step verification.

Could they really have a video of me?

Nothing suggests they do. The UK’s National Cyber Security Centre says these senders do not know whether you have a webcam: they are guessing, and they send the same email to many people.

I already paid. What should I do?

Contact the exchange or the bank you paid through immediately, keep the transaction details, and report it to the police. Paying is likely to bring new demands rather than end them.

Related guides

Sources

The steps follow these official pages, read on :

Free account

Keep checking with a free account

Without an account, checks stop at 10 an hour. With a free account you skip that wait and can run up to 60 a minute, and you can save up to 10 reports every 30 days.

Create free account

No credit card required