Is that “I hacked your webcam” email real?
An email lands, and the subject line is a shock: it may even show one of your own passwords. The message claims that malware has been sitting on your device, that your camera recorded you while you visited an adult website, and that unless you send a few hundred or a few thousand dollars in bitcoin within a day or two, the video goes to your family, your contacts, and your coworkers. Your heart drops, and for a moment the whole thing feels real.
Take a breath. In almost every case, this is a bluff. There is no video, no malware, and no one watching through your camera. It is a scripted extortion email sent to millions of addresses at once, and the entire thing is built to make you panic before you have time to think it through.
Why it feels so convincing
The detail that rattles most people is the password. When the email quotes a real one you have used, it feels like proof that someone is inside your accounts. It almost never is. These passwords come from old data breaches at unrelated companies, bought and traded in bulk, then pasted into the template automatically next to your email address. Seeing it means your address turned up in a leak at some point, along with millions of others, not that anyone filmed you or broke into your machine today.
Other versions skip the password and instead make it look like the email came from your own account, as if the sender were writing to you from inside your inbox. That is a spoofing trick, where the “from” line is forged so the address matches yours. It does not mean they logged in. It is the same bluff wearing a different costume.
How to tell it is a bluff
The tells are consistent once you know them. There is a tight deadline, usually 24 to 48 hours, designed to keep you from stopping to check. Payment is demanded in bitcoin to a wallet address, because crypto is hard to claw back. The message never contains any actual video or screenshot, only the claim that one exists, because there is nothing to show. And the language is generic, addressed to no one in particular, describing your habits in vague terms that would apply to almost anyone. A real extortionist who had genuinely compromising material would show you a piece of it to prove the threat. These emails never do, because they have nothing.
What to do
Do not pay, and do not reply. Paying marks you as someone who responds, which invites more demands, and replying confirms your address is live. Delete the message, or better, report it as phishing first so your provider learns the pattern. Then do the one thing the email was hoping you would skip: change the password it showed you anywhere you still use it, and turn on two-factor authentication on your email and important accounts. If that old password is still active somewhere, that is the only real risk in front of you, and it is one you can close in a few minutes.
It also helps to check where your address has been exposed. A free service like Have I Been Pwned will tell you which breaches your email showed up in, so you can update those passwords too. Using a different password on every account, ideally through a password manager, means a leak at one company can never unlock the rest.
If you already paid
If the email frightened you into sending bitcoin before you found this, you are not the first and you have not lost your footing. Stop there, keep every version of the message, and do not send more, no matter what a follow-up demand says. Crypto payments cannot be reversed like a card charge, but they can sometimes be traced, and the sooner it is reported the better the odds. Our guide on how to report a crypto scam and what can still be traced walks through where to send it, and our note on preserving evidence in the first 24 hours covers what to capture before anything gets deleted.
When there really are photos involved
The email above is a mass bluff with nothing behind it. That is different from a situation where you actually did share intimate images with someone, and they are now threatening to spread them. That is real sextortion, and it calls for a different response, including tools built specifically to stop images from spreading. If that is what you are facing, our guide on what to do when a scammer threatens to share your photos is written for exactly that, and the same rule still holds: do not pay.
An email designed to make you panic is not evidence of anything except that your address is on a list, the same as millions of others. Slow down, close the one real gap by changing that password, and let the threat fall apart the way these always do.
— Gus