Financial sextortion of teens: how to find out who's behind it
The parents who call me about this are almost always calling at night, because that's when their kid finally showed them the messages — and by then the account has usually already demanded a second payment. So I'll start you where I start them: the person threatening your child is not a heartbroken teenager who got in over their head. In the large majority of these cases it's an adult, often part of an organized crew working overseas, running the same script against dozens of kids at once. That single fact should change what you do in the next hour.
Financial sextortion is one of the fastest-growing crimes against young people in the country. The National Center for Missing & Exploited Children logged more than 50,000 reports of it in 2025 — well over a hundred a day. I say that not to frighten you but for the opposite reason: your child is not the first, the pattern is well understood, and there are concrete things that help.
Say this to your kid before you do anything else
They are not in trouble, and this is not their fault. I mean that operationally, not just as comfort. These offenders are adults who build trust on purpose, using accounts and photos stolen from real people, and they are practiced at making a smart kid feel stupid and trapped inside about ten minutes. The shame is the product they're selling. A teenager who believes they're alone and about to be exposed will keep paying and keep it secret — which is exactly the outcome the blackmailer needs. The moment your child believes you're on their side, most of the leverage is gone.
Don't pay — and understand what paying actually does
Paying almost never ends it, and I want you to know why, because "just don't pay" is easy to say and hard to do at 1 a.m. From the offender's side, a payment is a signal that your child's account converts. That account then gets worked harder, and sometimes sold or passed to another operator as a known paying target. The threats don't stop after the money; the money is what proves the threats work. Stopping the payments cold is the single most effective thing you can do, even though it feels like the most dangerous.
Stop responding — but don't scorch the earth yet
Cut off the conversation. No more replies, no more money, no more images. But before you start deleting and blocking, stop for a moment, because from where I sit those messages are not just painful reminders — they're the only threads that lead anywhere. The username, the profile, the exact wallet or payment handle, the timestamps: that's my starting material. If a family blocks and wipes everything before capturing it, the case usually goes cold before it begins.
Capture first, then block. Screenshot the profile and username, the full thread including the threats, and anything showing where payment was demanded — the app, the cash app or wallet, the exact handle. Our guide on preserving evidence in the first 24 hours covers what to save and what not to touch.
Can you actually find out who's behind it? An honest answer
This is the question everyone really wants answered, and most articles dodge it. Here's the straight version from someone who does this work. There are two very different cases hiding behind the same anonymous account, and the metadata usually tells me which one I'm looking at within the first hour.
The first is the organized overseas crew — the pattern behind most of the high-volume teen cases. These groups are careful, they route through the same handful of platforms and payment rails, and identifying a specific individual to the point of an arrest is genuinely rare. If that's what your case looks like, I'll tell you so plainly rather than sell you an investigation that leads nowhere. What OSINT does still buy you there is real: linking the account to a known cluster, documenting the payment trail for law enforcement, and speeding up takedowns.
The second case is the one people don't expect — the "anonymous" account that isn't. When the person behind it is local, or an ex, or a classmate, or anyone who actually knew your child, they almost always leave threads: a reused username, a recycled photo, a phone number tied to a real profile, a payment handle connected to their name. Those cases are very often solvable, and the triage that separates the two is where the first hour of real work goes.
Get the images off the internet
If the person in the image is under 18, use Take It Down, NCMEC's free service. It creates a digital fingerprint of the image on your own device — the image itself never leaves your phone or computer — and shares that fingerprint with participating platforms so they can find and remove copies. It works even if you only fear an image might be shared. For anyone 18 or older, the equivalent is StopNCII.org, which we cover in what to do when a scammer threatens to share your photos.
Report it — in three places
Report to NCMEC through the CyberTipline or 1-800-THE-LOST; they work these cases specifically and can help with removal. Report to the FBI at tips.fbi.gov or IC3.gov, or 1-800-CALL-FBI. And report the account on the platform itself — most now have a dedicated sextortion flow. If gift cards went out before you knew, our guide on gift cards sent to a scammer covers the fast steps that can occasionally freeze a balance.
Take care of the kid, not just the case
The takedowns and reports matter, but the young person in front of you matters more, and this can hit hard and fast. Keep checking in, keep the door open, and keep saying the thing that's true: none of this changes how you see them. If you're worried about their safety at all, the 988 Suicide & Crisis Lifeline is there any time by call or text to 988, and NCMEC can connect families with further support.
Sextortion runs on a lie — that your child is alone and out of options. They're not, and the sooner an adult they trust is standing next to them, the faster the whole thing loses its grip. If you want a second set of eyes on the account before you delete anything, that's exactly the kind of case we help with.
— Lisa, GCCI