Is the “I hacked your webcam” email real — and can you trace who sent it?
An email lands and the subject line is engineered to stop you cold — sometimes it even quotes a password you actually use. The message says malware has been living on your device, that your own camera filmed you on an adult site, and that unless a few hundred or a few thousand dollars in bitcoin reaches them within a day, the video goes to your family, your contacts, your coworkers. For a few seconds it lands as completely real.
In almost every case, it’s a bluff. No video, no malware, no one watching through your camera. It’s a scripted extortion email blasted to millions of addresses at once, built to make you panic before you have time to think it through. I see these constantly, and the pattern never changes.
Why it feels so convincing
The detail that rattles most people is the password. When the email quotes a real one you have used, it feels like proof that someone is inside your accounts. It almost never is. These passwords come from old data breaches at unrelated companies, bought and traded in bulk, then pasted into the template automatically next to your email address. Seeing it means your address turned up in a leak at some point, along with millions of others, not that anyone filmed you or broke into your machine today.
Other versions skip the password and instead make it look like the email came from your own account, as if the sender were writing to you from inside your inbox. That is a spoofing trick, where the “from” line is forged so the address matches yours. It does not mean they logged in. It is the same bluff wearing a different costume.
How to tell it is a bluff
The tells are consistent once you know them. There is a tight deadline, usually 24 to 48 hours, designed to keep you from stopping to check. Payment is demanded in bitcoin to a wallet address, because crypto is hard to claw back. The message never contains any actual video or screenshot, only the claim that one exists, because there is nothing to show. And the language is generic, addressed to no one in particular, describing your habits in vague terms that would apply to almost anyone. A real extortionist who had genuinely compromising material would show you a piece of it to prove the threat. These emails never do, because they have nothing.
What to do
Do not pay, and do not reply. Paying marks you as someone who responds, which invites more demands, and replying confirms your address is live. Delete the message, or better, report it as phishing first so your provider learns the pattern. Then do the one thing the email was hoping you would skip: change the password it showed you anywhere you still use it, and turn on two-factor authentication on your email and important accounts. If that old password is still active somewhere, that is the only real risk in front of you, and it is one you can close in a few minutes.
It also helps to check where your address has been exposed. A free service like Have I Been Pwned will tell you which breaches your email showed up in, so you can update those passwords too. Using a different password on every account, ideally through a password manager, means a leak at one company can never unlock the rest.
Can you actually trace who sent it?
Since the title of this piece asks, let me answer it as an investigator rather than dodge. For the mass-blast version, honest attribution is usually not worth chasing. The “from” address is forged, the email was relayed through throwaway infrastructure, and the only real thread is the bitcoin wallet. That wallet can sometimes be followed on the blockchain to an exchange, but these are high-volume operations pushing thousands of identical emails, and a single small payment rarely justifies the cost of tracing it to a person. Where wallet tracing genuinely earns its keep is the larger, targeted case — not this one. The good news is that with the mass version you don’t need to identify anyone, because there’s no real threat to neutralize.
If you already paid
If the email frightened you into sending bitcoin before you found this, you are not the first and you have not lost your footing. Stop there, keep every version of the message, and do not send more, no matter what a follow-up demand says. Crypto payments cannot be reversed like a card charge, but they can sometimes be traced, and the sooner it is reported the better the odds. Our guide on how to report a crypto scam and what can still be traced walks through where to send it, and our note on preserving evidence in the first 24 hours covers what to capture before anything gets deleted.
When there really are photos involved
The email above is a mass bluff with nothing behind it. That is different from a situation where you actually did share intimate images with someone, and they are now threatening to spread them. That is real sextortion, and it calls for a different response, including tools built specifically to stop images from spreading. If that is what you are facing, our guide on what to do when a scammer threatens to share your photos is written for exactly that, and the same rule still holds: do not pay.
An email designed to make you panic is not evidence of anything except that your address is on a list, the same as millions of others. Slow down, close the one real gap by changing that password, and let the threat fall apart the way these always do.
— Lisa, GCCI