Attacks
An email claiming to have recorded you, demanding payment in crypto. It is a bluff. A mass emailed extortion attempt. The message says the sender installed malware, watched you through your camera, and will send the footage to your contacts unless you pay, usually in Bitcoin and usually within a deadline. These are sent by the hundred thousand. There is no footage and there is no malware.
What it is
A mass emailed extortion attempt. The message says the sender installed malware, watched you through your camera, and will send the footage to your contacts unless you pay, usually in Bitcoin and usually within a deadline. These are sent by the hundred thousand. There is no footage and there is no malware.
How it plays out
It opens with something that seems to prove access
Often a real password of yours, or your phone number, or a photo of your street pulled from a mapping service. All of it comes from public data breaches, not from your computer.
It describes something embarrassing
Deliberately vague, because it is written to fit anybody. The specificity you feel is you filling in the blanks.
It gives a wallet address and a countdown
Usually 24 to 72 hours, and usually a few hundred to a few thousand dollars in Bitcoin.
It tells you not to reply or tell anybody
Isolation is part of the pressure. It is also how they avoid the moment you find out this email went to a million other people.
What gives it away
- A password you recognize but have not used in years. That is a breach dump, not a hack.
- A crypto address to pay to, and a deadline.
- No actual evidence attached. They never attach anything, because there is nothing.
- Text that could describe literally anyone.
- Instructions not to contact anyone.
How to not be caught by it
- Do not pay. Paying marks you as someone who pays and brings more of them.
- Do not reply, and do not open attachments or links in it.
- Check your email at a breach notification service to see which old leak your password came from.
- Change any password you are still reusing, and switch to a password manager.
- Cover the webcam if it makes you feel better. It is not the actual risk, but it costs nothing.
If it already happened
- If you already paid, that money is gone. Report it anyway, because the addresses get tracked.
- Stop paying immediately. There is no second demand that ends it.
- Rotate every password that shares anything with the one they quoted.
- Tell somebody. The shame is the leverage, and it stops working the moment you say it out loud.
- Report it to your national fraud reporting service, and to the FBI IC3 if you are in the US.
Common questions
How common is sextortion phishing?
Common enough that it has a name and a playbook. The specific numbers move constantly, so rather than quote a figure that will be wrong next quarter: assume you will meet this one, and set your wallet up so meeting it is survivable.
Can the money be recovered?
Once a blockchain transaction confirms, no. What reporting can occasionally do is get funds frozen at the exchange where a thief tries to cash out, which is why reporting quickly is worth doing even when it feels pointless.
Does a hardware wallet stop this?
It stops anything that needs your keys, because the keys never leave the device. It does not stop you approving a malicious transaction on the device itself, so read what the screen says before you press confirm.
Where to go next
Check your setup before you need to
An hour on a screen share, going through your wallets, your approvals, your backups and your recovery plan. You click everything and we never ask for keys.