Impersonation, AI & Phishing · Global
Sextortion Scams
Someone has intimate images of you — or says they do — and wants money to keep them private. It is one of the most frightening messages a person can receive, and it is built to make you act alone and fast. Here is how it works, why paying never ends it, and what to do in the first hour.
Updated Oct 2026 · 9 min read
If this is happening to you right now
Stop replying. Do not pay. Save the messages. Tell someone you trust.
You are not in trouble and you are not alone — this happens to thousands of people every week. If you are thinking about harming yourself, contact a crisis line now: 988 in the US, Samaritans on 116 123 in the UK, Tele-MANAS on 14416 in India, Lifeline on 13 11 14 in Australia. Then come back to the steps below.
Instagram DM · new account
“I have screenshots of everything and a list of your followers. Your family, your friends, your school. Send $500 in the next 30 minutes or I post it to all of them.”
Sextortion is blackmail using intimate images — real ones you were tricked into sending, fakes made with AI, or ones that never existed at all. It is usually run not by a jilted individual but by organised groups working through scripts, many targets at a time, with one aim: get a payment before you have time to think.
It often begins as a romance or dating-app scam, but it moves in minutes rather than months. Everything about it — the countdown, the list of your followers, the threat to your family — is designed to make you feel there is no time to tell anyone. That feeling is the scam working.
The Four Forms It Takes
The fake flirt that turns into blackmail
A friendly, attractive stranger on Instagram, Snapchat, a dating app, or a game chat. The conversation moves quickly, there is an exchange of photos or a video call, and within minutes — sometimes before you have even replied — the tone flips. They have screenshots of your followers, your friends, your family, and a deadline. This is the form that causes real harm, and teenage boys are now its most common target.
The “I recorded you through your webcam” email
A mass-mailed bluff claiming your device was hacked, your camera recorded you, and the video goes to every contact unless you pay in Bitcoin. To look credible it quotes an old password from a data breach, your name, or even a photo of your house taken from online maps. There is no video. Nothing on your device was touched.
AI-faked images made from ordinary photos
You never sent anything. Someone has taken pictures from your public profile and used an AI tool to produce fake explicit images, then threatens to publish them. The images being fake does not make the fear smaller, but it changes nothing about the right response — and the takedown routes below still apply.
The “I’m from the police” follow-up
Shortly after a sextortion attempt, someone claiming to be a police officer, a lawyer, or a “cyber investigator” makes contact. They can delete the images, or close the case, for a fee. They are the same group, or one that bought your details from them. Real police do not charge to remove content.
The one fact that matters most
Paying never buys deletion. It only proves you will pay again.
There is no way to verify that anything was deleted, and every payment marks you as a target worth returning to. The people who come out of this best are the ones who stop responding, save the evidence, and get help — not the ones who found the money.
Three Things That Are True Even When It Doesn’t Feel That Way
Paying does not end it
Payment confirms that you will pay. In case after case, the demand comes back larger within a day, and again after that. The money does not buy deletion — there is no way to check that anything was deleted, and they have no reason to.
Most of them do not publish
Their business is volume: hundreds of targets at once, from a script. Publishing the images ends the leverage and earns them nothing, so the far more common outcome when someone stops replying is that they move on to the next person. It is not a guarantee, which is why the takedown steps matter — but it is the honest pattern.
You are the victim of a crime
Whatever you sent and whoever you thought you were talking to, the person threatening you is committing extortion. That is how police, platforms, and support services treat it. You will not be in trouble for reporting it — and if you are under 18, the people helping you are there to protect you, not to judge you.
What to Do in the First Hour
- 1
Stop replying. Do not pay.
Do not negotiate, plead, or explain. Every reply tells them you are engaged and worth pushing. Do not block them just yet — you want evidence first.
- 2
Save the evidence
Screenshot the profile, username, the messages, the threats, and any payment details they gave you — wallet address, gift-card instructions, account number. Note the platform and the time. Then block and report the account on that platform.
- 3
Lock down your accounts
Set your social profiles, friend and follower lists to private so they cannot see who to contact. If the threat quoted a real password, change it everywhere you used it and turn on two-factor authentication.
- 4
Tell one person you trust
A parent, a friend, a partner, a teacher. This is the step people most want to skip and the one that helps most — the scam runs entirely on isolation and shame, and both shrink the moment someone else knows.
- 5
Start a takedown
Use the hash-matching services below so the images are blocked from the major platforms before anyone can post them. You do not have to upload the images or show them to anybody.
- 6
Report it
To the police and your national cybercrime service — details at the end of this guide. If you have already paid, include the payment details: that is how accounts get frozen.
Getting Images Blocked or Taken Down
These services work by creating a digital fingerprint (a “hash”) of an image on your own device. Only the fingerprint is shared, never the image, and participating platforms use it to block the picture from being uploaded.
- Over 18: StopNCII.org, run by the Revenge Porn Helpline, works with Facebook, Instagram, TikTok, Reddit, and others.
- Under 18: Take It Down (takeitdown.ncmec.org) from NCMEC, or in the UK Report Remove from Childline and the Internet Watch Foundation.
- If something has been posted: report it on the platform as non-consensual intimate imagery, and use Google’s and Bing’s removal forms for explicit images of you in search results. Save the link first.
- Australia: the eSafety Commissioner can order removal directly at esafety.gov.au.
Red Flags Before It Starts
- A stranger with very attractive photos who messages first and moves fast towards flirting.
- Someone who will not do a live video call, or whose camera is always “broken” — or one who insists on a video call early and wants you to undress on it.
- A request to move from the platform you met on to Snapchat, Telegram, WhatsApp, or Google Chat.
- Pressure to send a photo first, or a photo of them sent first to make you feel you owe one back.
- Questions about who your friends and family are, or which school, college, or employer you are at.
- An email claiming your webcam recorded you, especially one quoting an old password or showing a photo of your street.
- Any demand for payment in gift cards, crypto, or to a payment app — with a countdown.
- Someone claiming to be police, a lawyer, or an investigator offering to delete images for a fee.
Got an “I Recorded You” Email?
Paste it into the checker. It flags the hallmarks of the webcam-blackmail bluff — the quoted password, the Bitcoin demand, the countdown — so you can see it for what it is and delete it.
Open the Email Scam Checker →For Parents: The Talk Worth Having Before It Happens
Financially motivated sextortion now targets teenage boys more than any other group, and the speed is what makes it dangerous — some cases go from first message to threat in under an hour. The single most protective thing a parent can do is make it easy to come to you.
Say it plainly, ahead of time: “If anyone ever threatens to share a picture of you, come to me. You will not be in trouble, whatever happened. We will sort it out together.” A child who already knows that sentence is far less likely to pay, and far less likely to carry it alone.
Where to Report
- US: the FBI at ic3.gov or 1-800-CALL-FBI; for anyone under 18, NCMEC’s CyberTipline at report.cybertip.org.
- UK: the police on 101 (or 999 in an emergency), and the Revenge Porn Helpline for adults; Childline on 0800 1111 for under-18s.
- India: 1930 or cybercrime.gov.in, which has a dedicated route for sexual content that can be filed anonymously.
- Australia: ReportCyber at cyber.gov.au, and the eSafety Commissioner for image removal.
- Ignore anyone who contacts you afterwards offering to delete the images or recover your money for a fee — see recovery scams.
Frequently Asked Questions
Will they really send the pictures to my family if I don’t pay?
Usually not. Sextortion is run at volume from scripts, and publishing ends the leverage without earning them anything, so the common outcome when you stop responding is that they move on. It is not impossible, which is why you lock down your follower lists and start a hash-based takedown — but paying makes further demands far more likely, not less.
I already paid. What now?
Stop paying, now, even if they promise this is the last one — it will not be. Report the payment to your bank, card issuer, or the payment app straight away and give them the recipient details; then report to the police with the same details. Then follow the first-hour steps as normal. Having paid once does not change anything about what to do next.
I am under 18. Will I get in trouble?
No. You are the victim, and police and child-protection services treat it that way. In the US, NCMEC’s Take It Down service and CyberTipline exist specifically for this; in the UK, the Report Remove tool from Childline and the IWF does the same. Telling a trusted adult is the fastest way to make it stop, and the person threatening you is counting on you not doing it.
The email has my real password in it. Was I hacked?
Your device almost certainly was not. The password comes from an old data breach of some site you used — those lists are sold and shared openly, and these emails are generated from them automatically. Change that password anywhere you still use it, turn on two-factor authentication, and delete the email. There is no video.
How do I get the images removed if they were posted?
Report the post on the platform as non-consensual intimate imagery — every major platform has a dedicated route and treats it as a priority. Use StopNCII.org (adults) or Take It Down (under 18) to block re-uploads across participating platforms. Search engines also have removal forms for explicit images of you. Keep the links as evidence before they come down.
The images are AI fakes. Is that still sextortion?
Yes, and it is treated as such. Fake explicit images made from your real photos can be reported and removed through the same platform routes and hash-matching services, and creating or sharing them is a criminal offence in a growing number of countries. Do not pay to have fakes “deleted” any more than real ones.
Related: romance & dating-app scams, how to talk to someone who’s being scammed, passwords & 2FA, or account takeover.
Informational only — not legal advice. Sources: FBI and NCMEC public guidance on financially motivated sextortion, the UK Revenge Porn Helpline and Internet Watch Foundation, Australia’s eSafety Commissioner, and India’s National Cyber Crime Reporting Portal. Service names and helpline numbers can change — check the official site before relying on them.