A message claims it recorded you visiting adult websites, includes a familiar password and demands payment before a deadline. That combination is a documented blackmail-email scam. Receiving it is not proof that someone recorded you. Separate the sender’s claims from anything you can independently verify, and handle account security through the real provider.
Your quick checklist
- Do not pay, reply or open a file offered as “proof.”
- Change an exposed password wherever you still use it.
- Check account activity through the provider’s own app or website.
- Use official reporting channels; seek personal help for ongoing threats.
In this guide
Step 01
Recognize the claim without accepting it as evidence
The FTC describes messages that claim a webcam recording, threaten disclosure to contacts and demand Bitcoin. An email address or password from a breach can make the message feel personal. Those details do not establish that its story about browsing or recording is true.
Treat the payment deadline as pressure from the sender, not an instruction you must follow. Do not reply to ask for proof. This article concerns the common unsolicited email pattern; it cannot rule out a separate account compromise or a threat from someone who actually has private material.
Step 02
Deal with the password separately
The NCSC notes that a password in this type of email may come from an older data breach. If you still use it, change it on that account and anywhere else you reused it. An old password should not become a current password again.
Open account settings independently instead of using the message’s links. Work through affected accounts one at a time. Keep a simple completion note if that helps, but do not copy passwords into the note or send them to anyone offering to investigate the email.
Step 03
Look for account activity you can verify
Google’s compromised-account guidance recommends checking recent security events, signed-in devices and recovery details. For Gmail, it also covers unfamiliar forwarding rules and filters. Use the equivalent official security controls if your email provider is different. Enable available additional sign-in protection.
If you find an unfamiliar device, changed recovery details or activity you did not perform, follow the provider’s recovery process. If you cannot sign in, use its official account-recovery page. These findings need action even when the threatening email itself follows a familiar scam template.
Step 04
If you clicked or downloaded something
The FTC advises updating security software and scanning the device if a suspicious link or attachment may have downloaded malware. Do not install another program recommended by the sender. If you entered a password into a suspicious page, use the real provider’s security process to change it.
A clean scan cannot settle every question about an account. Keep account checks and device checks separate so that completing one does not cause you to overlook the other.
Step 05
Report the message and get support
For the bulk-email scam, the NCSC advises forwarding suspicious messages to report@phishing.gov.uk and then deleting them. In the US, the FTC accepts reports at ReportFraud.ftc.gov. Use your email provider’s report-phishing control as well.
If you paid, face continuing personal threats or know that someone has private material, contact local police and preserve relevant messages and payment references for their instructions. The NCSC also links to Victim Support for emotional support. You can ask a trusted person to sit with you while you report it; you do not have to manage the stress alone.
A threatening email is a claim, not a device diagnosis. Stop engaging with the sender, secure any exposed accounts and use the official reporting or support route that fits your situation.
Common questions
Does knowing my password prove the sender used my webcam?
No. A leaked password does not establish webcam access. Change it if it is still used and check your account independently.
Does this mean my adult-site account was breached?
The message alone does not identify the source of exposed information. Check official account notices and security activity rather than blaming a particular service without evidence.
What if someone has actually sent me private material?
Do not assume this is only a bulk-email bluff. Preserve the relevant messages privately and ask local authorities for individual guidance.
Sources and scope
Prepared from official scam-response and account-security guidance. This describes a common bulk-email scam; it cannot establish whether your device or account is compromised. Personal threats or known stolen images need individual help from local authorities.