Deepfake Sextortion Scams

If you have received a message threatening to share intimate images of you, you are the victim of a crime. The images may be entirely fabricated using AI — you do not need to have shared any intimate images for this to happen. Creating and distributing non-consensual intimate images — whether real or AI-generated — is a criminal offence in a growing number of jurisdictions. You are not at fault.

Deepfake sextortion scams generate fabricated intimate images or videos using a target's publicly available photographs — social media profiles, professional headshots, or images scraped from any online source — and then use those images as the basis for an extortion demand. The scammer threatens to send the images to the victim's contacts, employer, family, or social network unless a payment is made or further compliance is extracted. The images have never been voluntarily shared; they are entirely AI-generated.

This crime affects people across all demographics and age groups, including minors. Younger people are disproportionately targeted because of the volume of photographs they share on social media. The threat causes severe distress because the harm the scammer threatens — reputational damage, relationship breakdown, professional consequences — can feel immediate and real regardless of whether the images are fabricated. The shame and fear generated are the mechanism, not the images themselves.

Scammers harvest publicly available images from social media profiles, professional networking sites, public-facing websites, or any other accessible source. A small number of photographs is sufficient for modern AI image-generation tools to produce fabricated intimate content that appears realistic and places the target's face convincingly in the generated image.

The scammer then contacts the target — typically via email, social media direct message, or text — with a message claiming to possess intimate images or videos and threatening to distribute them. In some variants, the message includes a sample of the generated image to make the threat feel credible. The demand is usually for money transferred immediately, or in some cases for the target to produce and send genuine intimate images under threat of the fabricated ones being shared — a tactic that escalates the harm and extends the scammer's leverage.

Payment demands are typically for cryptocurrency or gift cards to preserve anonymity. If the victim pays once, demands commonly escalate. Each payment signal increases scammer confidence that further compliance is available. The scammer often has no genuine intention of stopping after a single payment — extraction continues until the victim stops responding or the scammer moves on.

Minors are targeted because their distress at the prospect of intimate images — even fabricated ones — reaching parents, teachers, and peers is acute, and because they may be less aware of legal protections or reporting options. Targeting minors is a serious criminal offence in virtually every jurisdiction and is treated with corresponding severity by law enforcement.

Sextortion works because the threatened harm — intimate images reaching people who matter to the victim — is genuinely devastating and difficult to fully undo even when the images are known to be fabricated. The shame and embarrassment the scammer anticipates is real; they are not threatening something the victim can dismiss easily.

The AI deepfake dimension adds a new layer: victims who have never shared any intimate images now face the same threat as those who have. The scam does not require any prior mistake or vulnerability on the victim's part — only the possession of publicly available photographs. This means the pool of potential victims is effectively everyone with any online presence.

The threat's credibility is enhanced by the sample image, if one is included, which demonstrates that the scammer can produce something plausible. Whether contacts would actually believe the fabricated images is a separate question — but the anxiety produced by the threat is immediate and does not require careful reasoning to take hold. The scammer sells fear, not images.

A person receives a direct message claiming that the sender possesses intimate images of them and will send them to their contacts and employer unless a payment is made within 24 hours. The person has never shared any intimate images. The message may include a sample image that appears to show their face. The images are AI-generated from photographs taken from their public social media profile. After the initial demand, any payment triggers an escalated demand. The scammer typically has no long-term intention of deleting anything — the threat is maintained as long as payments continue.

I have images of you that would destroy your reputation. Pay [amount] in crypto to [address] within 24 hours or I will send them to everyone you know.

I found your photos online and created something you do not want shared. Send [amount] in gift cards to stop this.

Your [family member/employer/contacts] will receive these images tomorrow unless you pay. [crypto address]

Do not ignore this. I will send the attached to [platform] contacts if you do not respond within [timeframe].

Instead of paying, send me [demand for genuine images]. Otherwise the fabricated ones go out.

I have already sent to one contact as proof. Pay now or more people receive them.

If you receive this kind of threat, you do not need to verify whether the images exist or are real. The appropriate response is the same regardless: do not pay, do not send further images, and report the contact to your national law enforcement and cybercrime reporting service.

If you are unsure whether a received image is AI-generated or genuine, consult a trusted adult, a support organisation, or a law enforcement contact. You should not have to deal with this alone, and professional support is available specifically for this situation.

For prevention, regularly review the privacy settings on social media profiles so that photographs are visible only to connections rather than to the public. This does not eliminate risk but reduces the volume of source material available to an attacker. Profile pictures on most platforms remain publicly visible regardless of other settings — be aware of this when selecting a profile image.