"Pay in bitcoin or I'll release the video": how to handle blackmail and sextortion emails

The email lands in your inbox: “I hacked your device. I recorded you. Send $1,500 in bitcoin to this address within 48 hours or I’ll send the video to all your contacts.” Sometimes it includes a password you really used, which makes it terrifying.

In almost every case, it’s a bluff sent to thousands of people at once. This guide explains how these blackmail emails work, why they mention your password, what to do and how to avoid making things worse.

How the scam works

The FTC describes the pattern: an email claims the sender has hacked into your computer and recorded you visiting adult websites, and threatens to send the video to your friends and family within hours unless you pay into a bitcoin account.

Variations include claims that they’ve installed software on your phone, that they know about an affair or another secret, or messages sent by post to your home. The FTC says scammers may send emails or US mail saying they have embarrassing photos, videos or personal information, and threaten to make it public unless you pay in crypto.

Why bitcoin? Because crypto payments are very hard to reverse once sent.

Why it sounds so convincing

The UK’s National Cyber Security Centre (NCSC) calls these emails a type of phishing attack, and explains the trick. They include plausible-sounding technical details about how you were supposedly hacked, and sometimes your password, to make the threat feel real. They’re written to trigger fear and shame, so that you act out of character and pay quickly.

But the sender is gambling: they send the same message to huge numbers of people, hoping enough will pay to make it profitable. In the NCSC’s words, they don’t know whether you have a webcam, whether you’ve visited adult websites or how you communicate with people. They’re guessing.

Why they know your password

This is the detail that frightens people most. The FTC explains it: scammers may really know one of your old, or recent, passwords, usually from a data breach at some website you used.

Knowing an old password doesn’t mean they’re in your computer. The FTC is direct: claims that they have access to your computer or webcam, or have installed clever software, are “all talk”.

What to do

The FTC’s advice:

1. Don’t pay. The FTC’s advice is simply not to pay, and the FBI also advises victims of sextortion not to pay.
2. Delete the message, after saving a copy if you plan to report it.
3. Change the password mentioned, and any other accounts that use the same one. The NCSC notes criminals know many people reuse passwords and will try them elsewhere.
4. Report it: the FTC says these messages are blackmail and a criminal extortion attempt, and recommends reporting them to the FBI.

The NCSC adds a practical reason not to pay: paying will likely encourage more scams, because the sender will know they’ve found a “willing” target.

In the UK

The NCSC’s steps:

• Don’t engage with the sender. Forward the email to its Suspicious Email Reporting Service at report@phishing.gov.uk, then delete it.
• Don’t worry if it includes your password. It has most likely come from historic data breaches. You can check whether your email address appears in known breaches, and get alerts about future ones, at Have I Been Pwned (haveibeenpwned.com), a service the NCSC links to.
• If the password is one you still use, change it immediately, and turn on extra sign-in protection such as two-step verification.
• If you’ve already paid, report it to your local police on 101. Emotional support is available from charities such as Victim Support.

Extra steps that help:

• Turn on two-factor authentication on your email and important accounts. See SIM swap attacks and two-factor authentication.
• Update your devices and run a security scan if you’re worried.
• Don’t reply or click any links in the message.

How common it is

The FBI’s Internet Crime Complaint Center received 89,129 extortion complaints in 2025, with $122.5 million in reported losses. Of those complaints, 23,797 had a cryptocurrency link, with $63.2 million in losses. Separately, the IC3 received more than 75,000 submissions about sextortion in 2025, and referred more than 5,700 involving minors to the National Center for Missing & Exploited Children.

The IC3’s breakdown of 2025 sextortion reports by age shows that everyone is targeted, and that older people report the largest losses:

People aged 60 and over made fewer reports than those in their 20s, but reported about twice the losses. See crypto scams targeting older adults.

Watch out for paid “help” services

Fear makes people vulnerable to a second scam: companies that promise to track down the blackmailer and make the threat disappear, for a large fee.

On 13 October 2026 the FTC sued one such operator, Digital Forensics Corporation, and affiliated companies. According to the FTC’s complaint:

• it promised “sextortion assistance” such as tracking criminals’ locations, contacting them and reporting crimes to law enforcement;
• it charged consumers between $1,499 and $20,000 for the first phase alone;
• it often simply blocked the blackmailer on victims’ social media, something victims can do themselves, created fake chat transcripts and didn’t contact law enforcement;
• it took at least $60 million in total.

These are the FTC’s allegations. The broader lesson is the same one that applies to crypto recovery scams: be very wary of anyone who charges you to make a crime go away. See crypto recovery scams.

When it isn’t a bluff

Mass emails are almost always fake. But real sextortion also exists. The FBI says it can start on any site, app, messaging platform or game where people meet, and it can target young people. If someone really has images, or if a child or teenager is involved:

• don’t pay and stop all contact;
• keep evidence: usernames, messages and any payment details;
• report it to the police. In the US, the FBI’s IC3 refers cases involving minors to the National Center for Missing & Exploited Children;
• talk to someone you trust. The FBI notes that shame and fear often stop people from asking for help.

Where to report

• US: the FBI at ic3.gov, and the FTC at ReportFraud.ftc.gov.
• UK: Report Fraud (England and Wales) or Police Scotland. Forward scam emails to report@phishing.gov.uk.
• Canada: the Canadian Anti-Fraud Centre and your local police.

See crypto scams and where to report them.