Bomb Threat Extortion Scam

Bomb-threat extortion emails are a public-safety variant of the mass-extortion model. Unlike most extortion scams, the primary harm is not financial — it is the operational disruption and fear caused by forced evacuations and emergency-service callouts. The secondary harm is the possibility of a recipient panicking and paying without reporting.

These campaigns are typically deployed in geographically targeted waves — a city or region receives the same email template sent to hundreds of organisations on a single day. The timing exploits news coverage of genuine threats or high-profile public events when institutions may be more anxious. No credible bomb threat has ever been delivered exclusively by bulk email with a cryptocurrency payment demand.

Criminals scrape published email addresses for businesses, schools, and public buildings in a target area. The email template is sent en masse with a time-sensitive payment demand, a wallet address, and instructions not to call police or the bomb will be triggered.

The psychological design is to force a choice under extreme time pressure: pay quickly and quietly, or trigger an evacuation and lose hours of operations. Many organisations correctly follow safety protocols regardless, which means the financial yield of these campaigns is extremely low — but the disruption is high.

In jurisdictions with mandatory reporting, the bomb threat itself requires emergency response, making non-reporting an unacceptable option. The scammer relies on a small number of recipients choosing to pay rather than report.

Responsibility for staff or student safety creates intense pressure on whoever receives such a message. The instruction not to call police creates a false dilemma between safety and compliance with the threat. Extreme time pressure is intended to prevent consultation with colleagues or proper security advisors.

For organisations with previous security incidents or operating in a high-threat environment, the perceived risk of dismissing even a likely fake threat may feel unacceptably high — and the scammer deliberately targets this reasonable caution.

An organisation, school, or business receives an email — often to a published contact address or abuse mailbox — claiming that a bomb has been hidden in the building and is set to go off within a specific number of hours. The message demands immediate cryptocurrency payment to receive instructions for deactivating or removing the device. Campaigns of this type are typically sent in bulk to thousands of addresses simultaneously on the same day, causing widespread disruption as organisations follow evacuation protocols. Law enforcement investigation consistently finds no device; the emails are templates designed to produce panic and quick payment from the small fraction of recipients who do not follow proper procedures.

"A bomb device has been planted in your building. Pay [AMOUNT] Bitcoin to [WALLET] within [HOURS] hours and I will tell you where it is so you can disarm it. Call police and it detonates."

"My associate placed an explosive in your premises yesterday. You will not find it without our help. Pay [AMOUNT] now to receive instructions."

"I work for a group that has targeted your organisation. The device is active. You have [HOURS] hours. Do not evacuate or it triggers automatically."

No credible explosive device is ever managed via email with a cryptocurrency payment option. Real bomb threats — rare as they are — are communicated through different channels and are investigated by specialists, not resolved through Bitcoin payment.

If your organisation receives such an email, follow your established emergency procedures and contact emergency services immediately. Do not pay. Law enforcement responders will assess the threat; their standard outcome in bulk-email campaigns is no device found.