Sextortion scam: don't pay — here's what to do

Editorially reviewed · Last updated July 21, 2026

Yes — this is a scam. Don't pay, and take a breath: the “we recorded you” email is a mass-sent bluff — and if someone really has images of you, you are not in trouble and you are not alone.

sunrise2013 is your password

am-9917

am-9917@bulk-relay-send.net

11:03 PM

I know sunrise2013 is one of your passwords. I placed malware on an adult website you visited, recorded you through your webcam, and copied all of your contacts. If you want the video deleted, send $1,450 in Bitcoin to the wallet below within 48 hours. If you tell anyone or contact the police, it goes to every contact instantly. Do not reply — I will know when you have read this.

The Email, as received

🔎 Untrappable · case notes

SCAM

Don't pay, and take a breath: the “we recorded you” email is a mass-sent bluff — and if someone really has images of you, you are not in trouble and you are not alone.

Findings

The password “proof” came from an old data breach, not your webcam — EFF's analysis found these emails are matched from leaked password lists and sprayed at millions of people
There is no video — the same message, word for word, goes to everyone on the list; only the pasted password changes
Bitcoin, a countdown, and “don't tell anyone” are pure pressure mechanics — the FTC calls threats, intimidation, and high-pressure tactics the classic signs of this extortion scam

Do this

Don't payReport to FBI IC3 Under 18? Take It Down

Verified 2026-07-21 · checked vs FTC · FBI IC3

Other versions you might get: The other version is real and crueler: someone you met on a dating app, social media, or a game builds trust, trades photos, then demands money to keep yours private. The FBI's IC3 warns this version usually starts as a mutual, friendly contact that moves to another messaging app before the blackmail turns. If that's you — especially if you're a teenager — you are the victim of a crime, not the person in trouble. Don't pay, stop responding, save the messages, and use the steps below.

Word-for-word versions going around

Each of these is a real email, quoted exactly as people received it. If yours matches one — even loosely — it’s the same scam.

“I am aware one of your passphrase: password. Lets get directly to point. Not a single person has compensated me to investigate about you. You do not know me and you are probably wondering why you're getting this e mail?”
Documented by Electronic Frontier Foundation · July 2026
“I know about the secret you are keeping from your wife and everyone else. You can ignore this letter, or pay me a $8600 confidentiality fee in Bitcoin”
Documented by Federal Trade Commission · July 2026

Know the signs

Both versions run on shame: a threat to show intimate content to the people you love, priced against your silence. The bluff email fakes the content; the romance version extorts real content — but the mechanics, and the fix, are the same: shame only works while you handle it alone.

What to watch for

“Proof” that is really just a breached password or your phone number — anything a data leak could contain
Payment in Bitcoin or gift cards, a deadline measured in hours, and a demand for secrecy
In the romance version: a new online contact who escalates to explicit exchanges fast, then flips to threats — IC3 documents exactly this arc

The one rule: Never pay and never negotiate with anyone threatening to share images of you — paying doesn't buy deletion, it marks you as someone who pays. Tell one trusted person; secrecy is the scam's only real leverage.

What to do right now

Don't pay, don't reply, don't negotiate. For the bluff email there is no video, and in real cases the FBI's IC3 tells victims to stop all interaction with the extortionist — paying or complying invites more demands, not fewer.
If the email showed a real password, fix that today. Change it everywhere you still use it, turn on two-factor authentication, and check your exposure at haveibeenpwned.com. That password came from a breach — it's the whole trick.
If someone has real images of you: you are not in trouble, and this is not your fault. Save the messages and profile (screenshots are evidence), then block. If you're under 18 — or the images are from when you were — Take It Down, NCMEC's free, anonymous service, can help get them removed or blocked on participating platforms without the images ever leaving your device. Tell a parent or another adult you trust; carrying this alone is what the scammer is counting on.
Report it. File at ic3.gov — the FBI's own message to victims is not to be embarrassed or afraid to contact law enforcement — and at reportfraud.ftc.gov. Reporting is confidential, and you won't be blamed for anything you sent.
Be wary of “helpers” who charge. The FBI warns about companies that charge sextortion victims steep fees for “assistance” — law enforcement and NCMEC help for free.

How to make sure it never bites you

Bluff emails find you because your address and an old password sit in breach dumps sold by the batch — clean up reused passwords and the threat evaporates. The romance version preys on isolation, and its antidote is the same one that ends it: one trusted person who knows. Either way, lock down your accounts and shrink what's out there about you: how to protect yourself.

Untrappable · Public service advisory

Stop the next one at the source

You got this because your details are on lists that get bought, sold, and leaked. You can't unspill that, but you can make it useless to a scammer. Start with the free steps — they do most of the work.

Freeze your credit — free at all three bureausStops anyone opening a new account in your name. Unfreeze in minutes when you need to.
Report it and get a recovery plan at IdentityTheft.govThe FTC walks you through exactly what to do next, for free.

Optional — if you'd rather it was handled for you

If you'd rather have it watched for you, an identity-protection service monitors your accounts, SSN, and the dark web, warns you the moment something new appears, and helps you recover if someone gets through.

See identity protection →

Affiliate link — we may earn a commission at no extra cost to you. It never changes our verdicts. Why we can still be trusted.

Keep this · forward it to someone who needs it

Frequently asked

The email has my real password. Doesn't that mean they hacked my webcam?

No. The password came from an old data breach, not your device — EFF investigated these campaigns and found scammers pair leaked email-and-password lists with a boilerplate threat, then mass-mail millions hoping a few panic and pay. There is no video. Change that password anywhere you still use it, turn on two-factor authentication, and delete the email.

Should I pay to make it go away?

No — never. In the bluff version there's nothing to delete, and in real cases paying doesn't end the threats; extortion runs on the hope that you'll keep paying. The FBI's IC3 tells victims to stop all interaction with the extortionist and report it instead. If you already paid, don't send more — report it at ic3.gov and tell your bank or crypto exchange right away.

I'm a teenager and someone I met online is threatening to share my photos. What do I do?

First: you are not in trouble, this is not your fault, and you are not alone — this crime is common enough that the FBI and NCMEC run national programs for exactly your situation. Don't pay and don't send more images. Save the messages, block the account, and use NCMEC's free, anonymous Take It Down to help remove or block images taken when you were under 18. Then tell a parent or an adult you trust, and report it at ic3.gov.

Will they really send the video or photos to my family and friends?

In the mass email, no — there is no video, and the same threat went to millions of inboxes. In a real sextortion case the threat can be real, but paying is still the wrong lever: it funds more demands, while reporting actually mobilizes help. Platforms remove this content, NCMEC's Take It Down can block images of minors from participating sites, and the FBI investigates these cases — that's the path that ends it.

How do I report sextortion?

Report it to the FBI at ic3.gov — include the messages, usernames, and any payment details you have, and don't delete the conversation, because it's evidence. If it involves someone under 18, also report to NCMEC and use takeitdown.ncmec.org for image removal. For the bluff email, report at reportfraud.ftc.gov and mark it as phishing. All of it is confidential — and free; be wary of anyone charging “recovery” fees.

Sources

FBI Warns about an Increase in Sextortion Complaints (PSA I-090221)— FBI Internet Crime Complaint Center
Take It Down — free removal help for images of minors— National Center for Missing & Exploited Children
How to avoid a Bitcoin blackmail scam— Federal Trade Commission
Sextortion Scam: What to Do If You Get the Latest Phishing Spam Demanding Bitcoin— Electronic Frontier Foundation

A public service

Help protect someone else

Scams spread because people stay quiet about them. If this could have fooled you, it can fool someone you know — a parent, a friend, the family group chat. Passing it on is the easiest good thing you'll do today. It's safe to forward, and stands on its own as a record for a bank or the police.