Webcam Blackmail / Sextortion Email Scam

The webcam blackmail sextortion email scam is a form of mass-distribution extortion in which automated systems send millions of identical or lightly personalised threat emails per day. Criminals purchase leaked password databases from past data breaches and merge victim email addresses with their old passwords to manufacture a convincing proof of access. Recipients who recognise their own password naturally panic, which is exactly what the scammer counts on.

In reality, no intrusion has taken place. The scammer has not accessed your device, installed malware, or recorded anything. The password is simply recycled from a years-old breach. Security researchers who have analysed these campaigns at scale confirm the emails are sent in bulk using automation, with the rare payment representing a tiny fraction of total sends — but enough to make the campaign profitable.

First, criminals compile bulk email lists combined with plaintext passwords from public breach databases available on dark-web forums. Automated tools merge the two datasets, producing personalised-looking emails at massive scale with no manual effort.

Second, the email lands in the inbox and opens with the victim's password to simulate insider knowledge. It then describes a lurid scenario of dual-screen recording, claims the victim has a limited window to pay in Bitcoin or Monero, and provides a wallet address. Some variants include a Bitcoin QR code, countdown language, or a claim that the tracking pixel in the email has already confirmed the victim opened it.

Third, if the victim pays, they are simply added to a 'confirmed payer' list and will receive further demands. If they ignore the email, the scammer moves on. No footage is ever distributed because none was ever captured.

The scam exploits shame and the universal fear of private moments being exposed to family, colleagues, or employers. Even a person who has never visited an adult website may briefly wonder whether the claim is plausible — and that moment of doubt is sufficient to generate compliance in a small percentage of recipients.

The inclusion of a real password dramatically increases believability. Most people do not know that billions of email-and-password pairs are freely available online from past hacks that had nothing to do with their current device. Seeing a password they recognise feels like hard proof of access, even though it proves only that they were in a breach database.

The victim receives an unsolicited email addressed to them by name. The message claims the scammer installed malware on the victim's device months ago, secretly recorded the victim through their webcam during a visit to an adult website, and simultaneously captured the video playing on screen. The scammer threatens to send the 'split-screen' recording to every contact in the victim's address book and post it publicly unless a payment — typically a few hundred to a few thousand dollars in cryptocurrency — is made within 24 to 72 hours. To create urgency and false credibility, the email often includes a real password the victim has used in the past, sourced from a publicly available data-breach leak. After the deadline passes without payment, the scammer sends one or two follow-up threats, then goes silent. No video is ever distributed because none exists.

"I know your password is [OLD_PASSWORD]. I installed malware on your device 6 months ago and have been recording your screen and webcam. Pay [AMOUNT] in Bitcoin to [WALLET] within 48 hours or I will send the video to all your contacts."

"Subject: [OLD_PASSWORD] — Payment required. Your password above proves I have full access. A split-screen recording of you and the site you were visiting is ready to be sent to your employer and family unless you comply."

"This is your final notice. The counter is at 24 hours. Your contacts list has been downloaded. The only way to delete the file is to send [AMOUNT] Bitcoin to the address below."

"I have your browsing history and a video of you. I am giving you a chance to pay quietly. If you try to contact police I will release everything immediately."

Check whether the included password is current or old. If it is from an account you no longer use or a password you changed years ago, it was pulled from a breach list. You can search your email address on a reputable breach-notification service to see which data leaks you appear in.

If you are still unsure, place a piece of opaque tape over your webcam and scan your device with up-to-date security software. These steps will confirm no active compromise. Law enforcement agencies in multiple countries have publicly confirmed this specific email format is a bluff campaign with no genuine video.