Scam library · Email & phishing · Investment & crypto
Sextortion email with your old password
The email starts with a password you really used, or your home address and a photo of your street. It says the sender hacked your device, recorded you through your webcam while you watched adult videos, and will send it to your contacts unless you pay in Bitcoin within 48 hours.
It's a bluff. The password comes from an old data breach, the street photo from online maps. There is no video.
What the message looks like
From: Unknown sender <x9k2@protonmail-mx[.]net>
Subject: Your password is hunter2021, I know everything
I know hunter2021 is your password. I installed software on your device and recorded you through your camera while you visited adult sites.
Send $1,450 in Bitcoin to the wallet below within 48 hours, or I will send the video to all your contacts. Do not reply.
How this scam works
These emails are sent to huge lists of addresses from leaked databases. The scammers have no access to your device; they rely on embarrassment and panic to get a payment. Some versions use your name and phone number, or a PDF attachment, to look more personal.
The best response is not to reply and not to pay. Paying marks you as someone who responds, which can lead to more demands.
The real lesson in the email is about the password. If it's one you still use anywhere, change it now and turn on two-step verification.
Red flags
- An old password in the subject or first line.
- Claims of hacked webcams or recorded videos.
- Payment in Bitcoin or crypto, with a deadline.
- No actual proof, like a real screenshot.
- Generic details that would apply to almost anyone.
How to tell it’s fake
- Check if the password is old: if you stopped using it years ago, it came from a breach.
- Search your email address on a breach-checking site like Have I Been Pwned to see which leaks it's in.
- Remember that real hackers don't announce themselves with a deadline.
What to do if you clicked, paid or shared info
Don’t panic, and don’t blame yourself. These scams are built by professionals. Act quickly, one step at a time.
If you clicked a link or called back
- Don't reply or pay. Mark the email as spam and delete it. You can report it to ic3.gov.
If you paid
- If you paid, report the Bitcoin wallet address and transaction to ic3.gov. Expect more demands and don't answer them.
If you shared personal info, a password or a code
- Change any password that matches the one in the email, everywhere you used it, and turn on two-step verification. A password manager helps avoid reuse.
Where to report and get help (U.S.)
If a message seems legit and you’re still not sure, get a second opinion before you act. Reporting helps stop scammers, even if money can’t be recovered. If you are in danger, call 911.
- Your bank or card issuer
Call the number on the back of your card or on your statement, not one from the message. Ask them to stop or reverse the payment and to watch the account. - Federal Trade Commission (FTC) · ReportFraud.ftc.gov
Report the scam and get a step-by-step recovery plan. - FBI Internet Crime Complaint Center (IC3) · ic3.gov
Report scams that happened online, especially if money was lost. Include phone numbers, websites and payment details. - AARP Fraud Watch Network Helpline · aarp.org helpline
Free, for anyone of any age: trained volunteers help you sort out next steps. 877-908-3360, Monday to Friday, 8 a.m. to 8 p.m. Eastern. - IdentityTheft.gov · IdentityTheft.gov
If you shared your Social Security number or someone opened accounts in your name.
How Gmork Scam Guard would warn you
Scam Guard in Chrome or Edge on your computer recognizes sextortion emails in Gmail or Outlook on the web: the old password, the webcam threat, the Bitcoin wallet. It explains, calmly, that it's a mass bluff and what to do about the password. If a threat seems personal and legit, get an expert's opinion before you react.
Scam Guard can miss things, so the checks above still matter. See what it warns about and what it keeps private.
Questions people ask
- They know my real password. Did they hack me?
- Almost certainly not. The password came from an old data breach. Change it anywhere you still use it.
- Should I pay just in case?
- No. There's no video, and paying invites more demands.
- What if the threat involves real images of me?
- If someone really has images, don't pay. Save the messages and report to the FBI at tips.fbi.gov. For anyone under 18, see our page on teen sextortion.