How it works
A mass email claims malware on your device recorded you through the webcam, and demands payment in Bitcoin within 48 hours. To prove it, the sender quotes an old password of yours — lifted from a public data breach, not from your computer. There is no footage, and no malware.
Red flags
- A password you used years ago quoted as 'proof'
- Bitcoin wallet address and a countdown
- Email appears to come from your own address (spoofed)
- No specific detail about you beyond the leaked password
Real-world example
"I placed malware on an adult site you visited. I have your contacts and the recording. Send $1,450 in BTC within 48 hours or everyone sees it."
What to do
- 01Don't pay and don't reply — a reply confirms your address is live.
- 02Change any account still using the quoted password, and enable 2FA.
- 03Check your email on Have I Been Pwned to see which breach exposed it.
- 04Report it and delete the email. Cover your webcam if it puts your mind at ease.
Related scams
Got a message that looks like this?
Paste it into the detector for a personalised analysis and next steps.
Open the detector