Is an email claiming to have a video of me visiting adult websites real?

Mass-sextortion emails claim the sender installed malware on your device while you visited an adult website, recorded your screen and webcam simultaneously, and will send the footage to your contacts unless you pay in cryptocurrency. To make the threat seem credible, some emails include an old password from a data breach or the first few digits of your phone number — details obtained from publicly available breach databases. In the vast majority of cases, no such recording exists. These are bluff campaigns sent to millions of people at once. The payment request is the only goal. Replying, paying, or engaging escalates contact. If the email contains a password you still use, change it immediately and enable two-factor authentication on affected accounts.

Understanding the economics removes most of the fear. These campaigns are sent to enormous mailing lists assembled from breach data; the sender has no idea who opened the message, owns no footage, and profits because a small fraction of recipients panic and pay. The leaked password is set dressing — genuinely yours, but harvested from an old breach, not from your device. What actually deserves your attention is that credential exposure: anywhere that password or its variants survive, an attacker could genuinely log in. The email is a bluff; password reuse is the real vulnerability it accidentally points at.