What does it mean if a scam email includes my real password?

Sextortion and blackmail emails that include one of your actual passwords are designed to shock you into believing the sender has hacked your device. They claim to have filmed you through your webcam, accessed your contacts, or installed spyware. In almost every case, the password was taken from a past data breach and included to make the threat credible. These emails are sent in bulk to thousands of people at a time. No footage exists, no device was compromised. The appropriate response is to change the exposed password everywhere it was used and enable two-factor authentication — not to pay the demanded ransom.

The password is doing all the persuasive work, and it is usually old. Breach data circulates for years, so the credential quoted is often one you used long ago on a forum or shopping site. The rest of the email — the surveillance claims, the split-screen video threat, the technical jargon — is a template sent unchanged to enormous mailing lists, with only the password and payment address swapped in.

Paying does not make anything go away; it marks you as responsive, and follow-up demands are common. The correct response costs nothing: retire the exposed password everywhere it was used, switch to unique passwords with a password manager, add two-factor authentication, and delete the email. There is no footage to release and no negotiation to have.