Crypto blackmail scams are emails claiming the sender has compromising information about you and demands payment in crypto. They are almost always fake.
How They Work
| Stage | Content |
|---|---|
| Subject | ”You need to read this immediately” |
| Claim | ”I have footage of you visiting adult websites" |
| "Evidence" | "I installed malware on your computer and recorded you” |
| Demand | ”Send $2,000 in Bitcoin to this address” |
| Threat | ”I’ll send the video to all your contacts” |
| Deadline | ”You have 48 hours” |
Why It’s a Scam
| Claim | Reality |
|---|---|
| ”I hacked your webcam” | Most people cover their webcam |
| ”I have your passwords” | Password from an old data breach (not your current one) |
| “I recorded you” | No footage exists |
| ”I’ll send to your contacts” | Empty threat |
| ”I’ve been watching you for months” | No evidence of this ever happening |
How They Get Your Password
Data breaches. Your email and an old password were leaked in a breach. They paste the old password into the email to make it look real.
| What It Means | What to Do |
|---|---|
| They have an old password | Don’t panic — it’s from a breach |
| They don’t have your current password | Change passwords if worried |
| They don’t have access to your accounts | No breach of your current security |
What to Do
| Step | Action |
|---|---|
| 1 | Don’t respond |
| 2 | Don’t send crypto |
| 3 | Don’t click any links in the email |
| 4 | Mark as spam/phishing |
| 5 | Change your email password if it’s the leaked one |
Other Variations
| Variation | What They Claim |
|---|---|
| Hitman scam | ”I’ve been hired to kill you, pay me £5K to cancel” |
| Fake court order | ”You missed jury duty, pay this fine in crypto” |
| Tax scam | ”HMRC is about to arrest you, pay in Bitcoin” |
| Romance extortion | ”I have our private messages, pay or I’ll share them” |
| Deepfake threat | ”I have AI-generated video of you, pay or I’ll release it” |
The Common Thread
All of these rely on fear and urgency. The scammer creates panic so you don’t think clearly. The threat is always fake.
When to Actually Worry
It’s almost never real. But if:
- They reference something specific only a real hacker would know
- They have access to an account you use
- The threat is personalised in a way that can’t come from a data breach
Then take it seriously, but still don’t pay. Contact the police.
What matters most
If you take only one thing away, let it be this: a genuine hacker who had compromised your machine, recorded you, and wanted money would have far more to gain by cleaning out your bank accounts or holding your actual files for ransom than by sending a mass-market email about a webcam. Blackmail emails are built on the cheapest possible illusion — a pasted-in password from an old breach — and they rely purely on panic. Never pay, never reply, never click a link, and treat every demand as the automated spam it almost certainly is. Your private keys, your seed phrase, and your wallet are never part of any legitimate demand, so anyone who asks for those while threatening you is confirming they are a scammer.
Caring for your accounts afterward
Even after you have correctly identified the email as a scam, it is worth using the moment to tidy up your security. Start by changing the password on the account that appeared in the email, and make sure it is not the same password you use anywhere else. Turn on two-factor authentication for your email, your crypto exchange, and your wallet. Check whether your email address has appeared in a known breach using a service such as Have I Been Pwned, and consider a password manager so you are never reusing old credentials again.
What to avoid
The most common mistakes are emotional, not technical. Do not respond to the scammer to “ask questions” — responding proves your account is active and invites a follow-up, often with a lower ransom or a “proof I really have you” video. Do not pay, on the theory that a smaller amount will make them go away; paying confirms you are a willing victim and virtually guarantees a second, larger demand. And do not click any attachment or link while you are still trying to work out whether the email is real — that is the one action that could actually hand the scammer access to your machine. Report the message, delete it, and move on rather than letting it sit in your inbox nagging at you.
Common questions
Q: What if the email contains one of my real passwords? A: That is almost always a password from an old data breach, not proof of a live hack. It in no way means the scammer has access to your accounts or recorded footage of you. Change that password if you still use it, then treat the email as the mass-market scam it is.
Q: Can the scammer actually send the video to my contacts? A: No. To send material to your contacts they would need to have control of your accounts or harvested your contact list — which would mean a much more serious breach than the automated email suggests. When these threats are investigated, no footage ever exists to leak.
Q: Should I contact the police? A: Yes, you can report it, and you should if the email references something uniquely personal that could not come from a breach. In most jurisdictions you can forward phishing and blackmail emails to a reporting service, such as report@phishing.gov.uk in the UK or Action Fraud. The police do not normally pursue a lone spam blast, but a report creates an official record if the campaign escalates against you personally.
Q: When should I actually worry? A: Only if the scammer demonstrates access to an account you currently use, or references a specific, non-public detail about you that cannot be explained by a data breach. Even then, do not pay — secure your accounts, record the evidence, and contact law enforcement directly rather than replying to the threat.
Keeping yourself ahead of the scammers
Where the blackmail email is heading with AI, your defence needs to keep pace. Deepfake blackmail — the email that includes a short AI-generated video claiming to show you — is becoming more common, and the first time you see your own face it is genuinely unsettling. The logic does not change: the video is fabricated, no one has real footage of you, and paying still funds the next victim. The strongest shield is a clean digital footprint: unique passwords behind a password manager, two-factor authentication everywhere it matters, and a habit of never clicking unsolicited links. If you can trace how each threatening detail could have leaked from a public breach or a recycled password, the fear evaporates and the demand falls apart on its own. There is no footage of you. There is no hacker in your webcam. There is only an automated email trying to cash in on a moment of panic.