Sextortion: what to do if you're targeted

You get a message. Someone claims to have compromising photos or video of you. They demand payment, gift cards, cryptocurrency, wire transfer, or they'll send the material to your contacts, your employer, your family. The deadline is urgent. The threat feels real.

This is sextortion. It's fraud, not blackmail. The distinction matters because it changes what you do next.

What sextortion is and how it works

Sextortion is a social engineering scam where operators threaten to expose private or fabricated sexual content unless you pay. The mechanism relies on panic, shame, and urgency to extract money before you realize the threat is hollow.

Two common patterns:

Pattern 1 , No material exists. You receive an email or message claiming the sender hacked your webcam, recorded you watching adult content, and will send the video to everyone in your contact list unless you pay. The email might include an old password from a breach to seem credible. This is pure bluff. No webcam hack occurred. No video exists. The password came from a public breach database.

Pattern 2 , You shared material willingly. You met someone online, dating app, social media, gaming platform. The conversation turned sexual. You shared photos or video. Now they demand payment or threaten to distribute the content. Sometimes the person you spoke to was never who they claimed. Sometimes they were an adult. Sometimes they were another minor running the scam. The relationship was fake from the start.

The FBI's Internet Crime Complaint Center receives thousands of sextortion reports annually. The 2024 IC3 report showed sextortion complaints increased by roughly 35% year-over-year, with losses exceeding $300 million. Operators target adults and minors, men and women, across every demographic.

Sextortion succeeds because it exploits shame and urgency. You're given minutes or hours to pay. The threat feels immediate and catastrophic. That's intentional. Panic is the product they're selling.

Step 1 , Stop all contact immediately

The moment you recognize the demand as sextortion, stop responding. Block the sender on every platform where contact occurred. Do not negotiate. Do not ask questions. Do not try to reason with them.

Every response you send confirms you're engaged and vulnerable. Operators interpret any reply, including "I don't have the money" or "please delete the photos", as evidence that you're a viable target. Silence is not weakness. It's the first defense.

If the scammer sent the demand through email, mark it as spam and delete it. If it came through social media, report the account to the platform and block the user. If it arrived via text, block the number and delete the thread.

Do not send money. Do not buy gift cards. Do not transfer cryptocurrency. Do not wire funds. Payment proves you're willing to comply, which invites repeat demands. Operators rarely stop after the first payment. They return with higher demands because you've demonstrated you'll pay under pressure.

In The Fellowship of the Ring, Gandalf tells Frodo that the Ring's power grows the more you use it. Sextortion works the same way. Every interaction, every payment, every concession strengthens the scammer's leverage. The only way to break the cycle is to stop feeding it.

Step 2 , Secure your accounts and devices

Lock down every account the scammer might have accessed or could use to escalate the threat.

Change passwords. Start with email, then social media, then any account where you shared personal information with the scammer. Use strong, unique passwords for each account. If you reused passwords, assume the scammer has them.

Enable two-factor authentication. Use an authenticator app, not SMS. SMS codes can be intercepted through SIM swapping, and sextortion operators sometimes work with groups that specialize in account takeovers.

Review account activity. Check your email for password reset notifications, login alerts, or account recovery attempts. Look for unfamiliar devices or locations in your security settings. If you see anything suspicious, revoke access immediately.

Lock down social media. Make your profiles private. Restrict who can send you messages. Disable tagging. Remove your phone number and email address from public view. The scammer may try to identify your contacts to make the threat feel more credible.

Scan your devices. Run a full antivirus scan on any device you used to communicate with the scammer. If you downloaded files, opened attachments, or clicked links, assume malware is possible. Malwarebytes and Bitdefender both offer free scans.

If the scammer claims they hacked your webcam, they didn't. But if you're worried, cover your webcam with tape or a physical slider. It's low-cost peace of mind.

Step 3 , Document everything before you delete anything

You need evidence before you erase the conversation. Screenshots, account details, payment demands, and timestamps all matter when you file reports.

Take screenshots. Capture the entire conversation thread, including the scammer's username, profile photo, and any identifying details. Screenshot the payment demand, the deadline, and any threats to contact specific people. If the scammer sent photos or video, screenshot those too, but do not forward them to anyone. Possession of explicit images of minors is illegal, even if you're the victim.

Record account details. Write down the scammer's username, email address, phone number, social media profile URL, and any other identifiers. Note the platform where contact occurred and the dates of each interaction.

Save payment information. If the scammer demanded gift cards, cryptocurrency, or wire transfer, record the payment method, the amount, and any wallet addresses or account numbers. If you already paid, include transaction IDs and receipts.

Note the timeline. Write down when the contact started, when it turned sexual, when the demand was made, and when the deadline expires. Timelines help investigators connect your case to others.

Once you've documented everything, you can delete the conversation. But keep the screenshots and notes in a secure location, encrypted cloud storage or a password-protected folder on your device.

Step 4 , Report to the FBI Internet Crime Complaint Center

Sextortion is a federal crime. The FBI investigates these cases, and reporting helps them track operators, identify patterns, and build prosecutions.

Go to IC3.gov and file a complaint. The form asks for your contact information, the scammer's details, a description of the incident, and any financial loss. Attach your screenshots and documentation.

The IC3 doesn't investigate every individual report, but every report feeds into a national database that helps law enforcement identify large-scale operations. Your complaint might connect to dozens of others targeting the same operator.

If you're a minor or the parent of a minor, the FBI treats sextortion involving children as a priority. The FBI's field offices can provide additional resources and victim support.

You can also file a report with the Federal Trade Commission at ReportFraud.ftc.gov. The FTC tracks consumer fraud and shares data with other agencies. Filing with both IC3 and the FTC ensures your case is logged in multiple systems.

Local police may take a report, but sextortion investigations typically require federal resources because operators work across state and international borders. Start with IC3. Local law enforcement can escalate from there if needed.

Step 5 , Lock down your social media and online presence

The scammer threatened to contact your friends, family, or employer. That threat is almost always a bluff, but you can eliminate the risk by controlling who can reach you and what they can see.

Make everything private. Set your Facebook, Instagram, Twitter, LinkedIn, and TikTok profiles to private. Remove your phone number, email address, and location from public view. Disable the option for strangers to send you messages or friend requests.

Restrict tagging and mentions. Turn on tag review so you approve any post or photo where someone tags you. Disable the setting that lets people find you by phone number or email.

Review your friends list. Remove anyone you don't know personally. Scammers create fake profiles to infiltrate your network and gather information about your contacts. If someone added you recently and you don't recognize them, delete them.

Search for yourself. Google your name, phone number, and email address. Look for profiles, photos, or information you didn't post. If you find anything concerning, contact the site to request removal.

Consider a temporary social media break. If you're worried about the scammer's threats, you can deactivate your accounts for a few weeks. Deactivation hides your profile without deleting it permanently. The scammer can't contact your friends if they can't find your profile.

Step 6 , Tell someone you trust

Sextortion thrives on isolation. The scammer wants you to believe you're alone, that disclosure will destroy your reputation, that paying is the only way out. That's a lie.

Tell a friend, a family member, a partner, or a counselor. You don't need to share every detail, but telling someone breaks the scammer's psychological leverage. Once another person knows, the threat loses its power.

If the scammer threatened to contact your employer, consider telling HR or your manager first. A brief, factual disclosure, "I'm being targeted by an online extortion scam, and the person may attempt to contact the company", removes the scammer's ability to blindside you. Most employers have dealt with similar incidents and will treat it as a security issue, not a personal failing.

If you're a minor, tell a parent, guardian, or trusted adult immediately. Sextortion targeting minors is a federal crime with mandatory reporting requirements. Schools, counselors, and law enforcement have protocols to handle these cases with confidentiality and care.

If you're worried about judgment, remember: you're the victim of a crime. The scammer manipulated you. The shame you feel is the weapon they deployed. Talking to someone neutralizes it.

Step 7 , Understand the scammer's actual leverage

The scammer claims they'll send your photos to everyone you know. They won't.

Broadcasting explicit material takes time, effort, and creates legal risk. Operators run high-volume campaigns. They send hundreds of demands daily. Following through on threats generates no additional revenue and exposes them to law enforcement. It's not worth it.

In cases where material exists, operators occasionally send a preview to one or two contacts to create panic and force payment. But mass distribution is rare. They move to the next target as soon as you stop responding.

In cases where no material exists, the webcam hack bluff, the threat is pure fabrication. They have nothing. They're counting on your fear to prevent you from calling the bluff.

If you're still worried, consider this: even if the scammer does share material, the legal and social consequences fall on them, not you. Distributing explicit images without consent is illegal in most jurisdictions. Platforms like Facebook, Instagram, and Twitter have policies against non-consensual intimate imagery and will remove it when reported.

Your reputation is more resilient than the scammer wants you to believe. People who care about you will support you. People who don't aren't worth protecting.

What happens after you report

The FBI investigates sextortion as part of broader cybercrime operations. Your IC3 complaint gets reviewed by analysts who look for patterns, same usernames, same payment methods, same language in the threats. If your case connects to an active investigation, an agent may contact you for additional information.

Most sextortion cases don't result in immediate arrests. Operators work internationally, often from countries with weak extradition treaties. But federal investigators track these groups over time, and prosecutions do happen. In 2024, the FBI arrested members of several sextortion rings operating from Nigeria and the Philippines.

Your report also helps protect others. Every complaint adds to the data law enforcement uses to identify high-volume operators, disrupt payment channels, and educate the public about emerging tactics.

If you lost money, you probably won't get it back. Gift cards and cryptocurrency are nearly impossible to reverse once transferred. But filing a police report and an IC3 complaint creates a record that may help if you need to dispute charges with your bank or credit card company.

If the scammer contacts you again

They might. Operators sometimes return weeks or months later with new threats, hoping you've forgotten the initial incident or that renewed fear will make you pay.

Do not respond. Block the new account. Report it to the platform. File a supplemental IC3 report noting the repeat contact.

Do not pay. Repeat demands prove the first threat was hollow. If they had material and intended to use it, they would have done so already.

If the scammer escalates, sends material to a contact, posts something online, creates a fake profile impersonating you, document it immediately and report it to the platform and law enforcement. Platforms have dedicated teams for handling non-consensual intimate imagery and will remove content quickly when flagged.

Why sextortion works and how to think about it

Sextortion succeeds because it weaponizes shame and urgency. The scammer gives you no time to think, no space to consult others, no room to recognize the bluff. They want you to act before you realize the threat is hollow.

The antidote is time. Every hour you wait without paying weakens the scammer's position. Every person you tell removes a piece of their leverage. Every report you file increases the chance they'll face consequences.

You didn't do anything wrong by trusting someone online. You didn't do anything wrong by sharing photos in what you thought was a private conversation. The crime is the extortion, not the circumstances that preceded it.

If you're reading this because you're being targeted right now, here's what you do: stop responding, block the scammer, secure your accounts, document the incident, file an IC3 report, lock down your social media, and tell someone you trust. Do those things in that order. The panic will fade. The scammer will move on. You'll be fine.