The rule that defeats sextortion

Do not pay. The criminals running sextortion operations are professionals working at scale. Payment doesn’t make the threat disappear — it marks you as a paying victim and almost always triggers further demands. Report Fraud data shows victims who pay typically face escalating demands and at most a brief pause before the threat resumes. The criminals also share their target lists, so a paying victim becomes a multi-target across organisations.

Common scenarios

Adult victim, real intimate content shared

You met someone online (dating app, social media, gaming platform). The relationship escalated to intimate video / images. Once the content was sent, the criminal threatened to share with your contacts unless payment.

Adult victim, claimed but fake content

An email claims to have hacked your webcam and recorded intimate content during private moments. The email often includes one of your old leaked passwords (from a long-ago breach) as “proof of access”. There is no content. This is a mass-mailed scam relying on plausibility, not actual material.

Public-figure / professional target

The criminal specifically targets you for your professional or public position. Threats reference your employer, LinkedIn network, or family. Sometimes initiated through a fake romance scenario, sometimes through targeted social-engineering.

Under-18 victim

If the victim is under 18, this is child sexual exploitation. Contact the police via 999 if there’s an active threat, or 101 otherwise. Contact the IWF (Internet Watch Foundation) at iwf.org.uk for image-takedown. NSPCC’s Childline at childline.org.uk or 0800 1111 offers free confidential support.

The 24-hour playbook (adult victims)

  1. Don’t pay. Don’t reply to the threats. Don’t engage. Engagement opens further pressure tactics.
  2. Preserve evidence: take screenshots of every threat message, the criminal’s profile, any intimate content they claim to have, any payment demand. Preserve metadata. Don’t delete the conversation; block AFTER capturing evidence.
  3. Use StopNCII.org: stopncii.org. The site allows you to hash intimate images on your own device (the image never leaves your device) and submit the hash. Major platforms (Facebook, Instagram, TikTok, Reddit, OnlyFans, Snapchat, X/Twitter, Bumble, more) check uploads against the hash database and block matching content from being shared.
  4. Lock down your social media: set every account to private; remove or hide friends / family lists; revoke third-party app access. The criminal’s most powerful threat is reaching your contacts, so cutting that surface preempts the threat.
  5. Report to police via 101 (non-emergency) or 999 if there’s an imminent threat. Sextortion is a criminal offence in England and Wales under the Criminal Justice and Courts Act 2015 (s33) and Online Safety Act 2023.
  6. Contact the Revenge Porn Helpline: 0345 6000 459 (Monday-Friday 10am-4pm), or revengepornhelpline.org.uk. Free, confidential, specialist support including legal advice and image removal assistance.
  7. Report the originating account: the dating app / social media / gaming platform where the criminal first contacted you. Use their report functions.
  8. If you’ve already paid: file with your bank as APP fraud. See our PSR guide. If by card, see chargeback / Section 75.
  9. Tell someone you trust. The criminal’s leverage is your fear of exposure. Removing the secret deflates the threat. People you trust will be far more understanding than you fear.
  10. Speak to your GP if distress is significant: sextortion victims are at materially higher risk of clinical depression and suicidal ideation. This is recognised and there’s no judgement.

What about the “I’ve hacked your webcam” emails?

These are mass-produced and almost always bluff. The email typically includes one of your old leaked passwords (from a years-ago breach you’ll see at haveibeenpwned.com) as “proof of access”. There is no content. The criminal sends the same email to millions; profitable at a tiny conversion rate. Standard response: don’t pay, don’t reply, report to NCSC SERS by forwarding to report@phishing.gov.uk. Change any password that appears in the threat.

If the criminal has actually shared the content

Some sextortion threats are carried out regardless of payment. If content has been shared online:

Long-term aftermath

Open StopNCII.org (image hash-block) →