You open your email and find a message with a subject line that makes your stomach drop. It contains one of your old passwords — a real one you actually used. The email claims that a hacker installed malware on your computer, activated your webcam, and recorded you while you were visiting adult websites. They threaten to send the video to everyone in your contact list unless you pay $1,000 to $5,000 in Bitcoin within 48 hours.
The email is terrifying. And seeing your real password makes it feel completely genuine. But here is what you need to know: it is a bluff. There is no video. There is no malware. The scammer has nothing on you except an old password from a data breach.
Where Your Old Password Came From
Over the past decade, billions of usernames and passwords have been exposed in data breaches at major companies — LinkedIn, Adobe, Yahoo, Dropbox, and hundreds of others. These stolen credentials are compiled into massive databases and sold on the dark web for pennies.
Sextortion scammers buy these lists and send automated emails to millions of addresses. They include the old password in the email to make it seem like they have actually hacked your computer. Seeing a real password you once used is alarming, but it does not mean they have access to your computer, your webcam, or anything else.
The password they show you is often years old. Many people recognize it as something they used a long time ago and have since changed. That is exactly what it is — old data from a breach, nothing more.
The Webcam Hack Claim Is False
The email typically claims the scammer installed a “trojan” or “RAT” (remote access tool) on your computer that gave them control of your webcam. They say they recorded you through your own camera while you were browsing the internet.
This is not true. While webcam hacking does exist in theory, it requires specific malware to be installed on your device — and sextortion scammers do not have this capability. They are sending millions of identical emails using nothing more than a list of old email addresses and passwords. They have no access to your computer and have never seen you through your webcam.
Think of it this way: if they actually had compromising footage of you, they would show you a screenshot as proof. They never do, because they have nothing.
The Bitcoin Payment Demand
Sextortion emails almost always demand payment in Bitcoin or another cryptocurrency. There is a reason for this: cryptocurrency transactions are extremely difficult to trace and impossible to reverse. Once you send Bitcoin to a scammer’s wallet, the money is gone forever.
The email typically includes a Bitcoin wallet address and a deadline — usually 24 to 48 hours. The deadline creates artificial urgency, pressuring you to act out of fear rather than reason.
Many people who receive these emails do not even know how to buy Bitcoin, and the scammer is counting on the panic being enough to motivate them to figure it out.
Why You Should Not Pay
There are several important reasons never to pay a sextortion email:
- There is no video. The scammer has nothing to release.
- Paying confirms your email is active. If you pay, the scammer knows they have a responsive target and will likely send more demands.
- You cannot buy silence. Even if a scammer did have something (they do not), paying would not guarantee they would delete it. Criminals do not honor agreements.
- It encourages more scams. Every payment funds the operation and leads to more people being targeted.
What You Should Do Instead
- Do not reply. Do not engage with the scammer in any way.
- Do not click any links in the email. They may lead to malware.
- Change the exposed password if you are still using it anywhere.
- Check Have I Been Pwned. Visit haveibeenpwned.com to see which data breaches have exposed your email address and passwords.
- Enable two-factor authentication on your email and important accounts.
- Mark the email as spam and delete it.
- Report it. Forward the email to the FTC at spam@uce.gov and file a report at ic3.gov.
Talking to Older Family Members About This Scam
Sextortion emails are especially frightening for older adults who may not understand how data breaches work. Seeing a real password in an email can be deeply unsettling, and the shame associated with the sexual nature of the threat may prevent them from asking for help.
If you have older parents or grandparents, proactively tell them about this scam. Let them know that these emails are mass-produced fakes, that the scammers have no actual information beyond an old password, and that the correct response is to delete the email and change passwords.
Most importantly, make it clear that receiving this email does not mean they did anything wrong. Millions of people get these emails, and none of them should feel ashamed or afraid.
The Emotional Impact Is Real
Even though the scam is a bluff, the emotional impact on recipients is genuine. Fear, shame, anxiety, and confusion are all normal responses. If you or a loved one is struggling after receiving a sextortion email, talk to someone you trust. The relief of learning it is fake is usually immediate and significant.
Sextortion emails are one of the most common scams on the internet today. They are sent by the millions, and they rely entirely on fear. Now that you know how they work, they have no power over you. Delete, change your passwords, and move on.
🛡️ Got a suspicious message? Check it free at NoScamForMe.com — takes seconds.