Someone is threatening to share your photos: what to do right now.

Sextortion is when someone threatens to share intimate images or videos of you unless you pay money or provide more images. It's a well-documented, high-volume scam, and law enforcement in both the US and elsewhere treats it as a priority: the FBI and the Internet Crime Complaint Center (IC3) both publish active guidance on it because it happens constantly, to people of every age. Two things matter more than anything else if this is happening to you right now: don't pay, and you are not to blame.

The two versions of this scam

Almost every case falls into one of two patterns, and telling them apart changes what you should do next.

The bluff email. By far the most common version. An email claims the sender has hacked your webcam or infected your device with spyware, and threatens to send an embarrassing recording to your contacts unless you pay in Bitcoin or gift cards. In the overwhelming majority of cases, there is no actual footage: the message is a mass-sent bluff, often padded with an old, real password of yours pulled from a past data breach to make the threat sound credible. If you don't recognize the password, or it's one you changed long ago, that's another sign the claim is empty.

Real coerced images. A more serious pattern, and the one that disproportionately targets teenagers: someone builds trust over time on social media, a dating app, or a game, convinces the target to send a real intimate image or video, and then immediately pivots to threats and demands for money or more images. This version is financially motivated and can escalate quickly, and it's the version where reporting to the right place matters most.

Why you should never pay

Paying does not reliably make the threat go away. Paying the requested money or gift cards does not ensure the offender won't still release the material: and it often works in the opposite direction: once an attacker knows you're willing to pay, victims are frequently targeted again, sometimes by the same person, sometimes because the information gets sold on to other scammers who continue the abuse. There is no version of this where sending money makes the situation safer.

What to do right now

• Stop responding. Don't argue, don't explain, don't negotiate – every reply confirms the account is active and worth continuing to target.
• Don't pay, and don't send more images under any circumstances, including a promise that it will "make them stop."
• Preserve everything as evidence before you block: screenshots of the messages, the account or profile used to contact you, any usernames, and payment details if money was demanded.
• Block and report the account on whatever platform it contacted you through – most major platforms have a dedicated reporting flow for this.
• Report it to law enforcement. In the US, file a report with the FBI's Internet Crime Complaint Center (IC3.gov), or call your nearest FBI field office.

If this involves a minor

If the person being targeted is under 18, contact the National Center for Missing & Exploited Children (NCMEC) directly: call 1-800-THE-LOST (1-800-843-5678) or submit a report through CyberTipline.org. NCMEC can help with getting images removed from websites and works directly with law enforcement on these cases. A parent or trusted adult reporting on a teen's behalf is not overreacting: this is exactly the kind of case these organizations exist for, and acting quickly genuinely helps.

Watch out for paid "recovery" services

Once you've been targeted once, a second wave of scammers sometimes appears offering to "get the images taken down" or "identify the blackmailer" for an upfront fee. The FBI has specifically warned about for-profit companies charging sextortion victims and using deceptive tactics to collect payment. Law enforcement and organizations like NCMEC provide the real version of this help for free: anyone charging you for it after the fact is worth treating with the same suspicion as the original threat.

Other variants you'll run into

The two core patterns above cover most cases, but the packaging keeps evolving:

• The AI twist. The message claims they've generated explicit images of you with AI, sometimes attaching a crude sample built from your public photos. The playbook doesn't change: it's the same bluff with new props, and paying is still the wrong move.
• Fake law enforcement. An email or call claims to be police or a government agency that "found illegal material" tied to you and demands a fine. Real law enforcement never collects fines by gift card, wire, or crypto: that detail alone settles it.
• The email "from yourself". The threat arrives appearing to be sent from your own address, offered as proof your device is hacked. It proves nothing: making an email display any sender address is trivial spoofing, not access.
• The instant escalation. On dating apps, the entire trust-building phase gets compressed into hours: a match, a quick exchange of photos, and the demands begin the same day.

How it plays out: a realistic example

Alex, 16, gets a follow request from what looks like a girl his age who plays the same game he streams. The chat moves from the gaming platform to Instagram, turns flirty, and photos are exchanged. The pivot is immediate: a screenshot of his follower list and a demand for $200 in gift cards within the hour, "or everyone you know gets these."

What Alex does right is the part worth copying. He doesn't pay, and – after a very bad half hour – he tells his older sister. Together they stop responding entirely, screenshot the profile, the messages, and the payment demand, block the account, and file a report through NCMEC's CyberTipline the same evening. The threatened mass-send never happens: accounts running this scam at volume move on to the next target when one stops responding and starts reporting. The account was gone within days – recreated under another name, certainly, but no longer aimed at him.

Prevention that goes one level deeper

The bluff-email version runs on leaked passwords from old data breaches: that's where the "proof" in those messages comes from. Using a password manager with unique passwords per site, and checking a breach-notification service to see what's already exposed, quietly removes the scariest ingredient: a message showing you a password you still use is an emergency; one showing a password you retired years ago is spam.

For the coerced-images version, the strongest protection isn't technical at all. For teenagers especially, the scam's real leverage is shame: the certainty that telling a parent would be worse than paying. Having the conversation before anything happens ("if anyone ever threatens you online, you can tell me and you won't be in trouble") measurably changes outcomes, because every hour of silence works for the extortionist. Locking social accounts down so follower lists aren't public removes their favorite prop, and a webcam cover, while mostly beside the point, costs a dollar and ends the "we recorded you" claim's power over you entirely.

Frequently asked questions