“I have your password” email scam: hacked camera and Bitcoin threats explained

Why it shows a real (old) password

When a website or app is hacked, its customers’ email addresses and passwords can end up in lists that get traded online. Scammers buy or download those lists and mail-merge them into thousands of threatening emails. The UK’s National Cyber Security Centre says a password in one of these emails has in all likelihood come from historic breaches of personal data (NCSC). Australia’s Cyber Security Centre says the same (ACSC).

That’s why the password is often one you stopped using years ago. It shows the scammer has a leaked list, not access to your device.

Why it’s a bluff

The NCSC puts it plainly: the sender doesn’t know if you have a webcam, what sites you’ve visited or how you talk to people. They are guessing, and gambling that enough frightened people will pay (NCSC). That’s why there is never a single real screenshot in the email, and why the same message is sent to people who don’t even own a webcam.

These emails are a big business for criminals. In 2025, the FBI’s IC3 received 89,129 complaints about extortion, a category that includes threats of public exposure, with reported losses of US$122.5 million (FBI IC3 2025 Internet Crime Report).

What to do now

1. Don’t pay, and don’t reply. The NCSC warns that paying will likely encourage more scams, because the sender now knows you’re a willing target (NCSC). Replying, even to say you know it’s fake, confirms your address is live.
2. Don’t click links or open attachments in the email (FBI IC3).
3. Change that password everywhere you still use it. If you recognise the password, change it on every account that uses it, starting with your email account, which can reset everything else (NCSC, ACSC).
4. Use a password manager. It creates and remembers a different strong password for every site, so one leak can’t unlock the rest. The NCSC recommends them (NCSC).
5. Turn on two-factor authentication (2FA) for email, banking and social media. Then a leaked password alone isn’t enough to get in. The NCSC recommends turning on two-step verification to help protect you if your password gets stolen (NCSC).
6. Check which breaches your email was in. Search your address on Have I Been Pwned to see where the old password probably leaked from. Our guide on how to check if your email has been in a data breach walks through it step by step.
7. Report it, then delete it (see below). Mark it as spam or junk too, so your inbox learns to filter the next one.

If you already paid

Don’t feel ashamed: these emails are designed to panic people. Report it to the police (details below) and include the email and the Bitcoin wallet address you paid. The NCSC advises UK victims who paid to report it to their local police on 101 (NCSC). Then watch out for a second scam: people who have lost money are often contacted by fake “recovery” services that ask for an upfront fee (FTC). Don’t send any more money.

Where to report a sextortion email

• United States: file a complaint with the FBI’s Internet Crime Complaint Center (IC3), including the email with its headers and any Bitcoin address (IC3). You can also report it to the FTC at ReportFraud.ftc.gov.
• Australia: report it to Scamwatch. If you paid or were threatened, report it to police through ReportCyber. Scamwatch’s advice on threat scams also covers sextortion.
• United Kingdom: forward the email to report@phishing.gov.uk, the NCSC’s Suspicious Email Reporting Service (NCSC), then delete it. If you paid, report it to Report Fraud (the service formerly called Action Fraud) in England, Wales and Northern Ireland, or to Police Scotland on 101.
• New Zealand: get advice and report it to Netsafe, and contact the police if you paid or feel unsafe.

If someone really does have intimate images of you, or is threatening someone under 18, that’s a different and serious crime: contact the police straight away.

Stay ahead of the next one

The real risk from these emails isn’t the fake video. It’s the leaked password, if you still use it anywhere. Free tools like Have I Been Pwned’s “Notify me” alerts help. If you want ongoing monitoring, our Personal plan (US$9/month) watches up to three personal email addresses for new data breaches and dark web leaks, so you can change a password before a scammer uses it. It also includes account recovery help if someone does get into an account. Related: how to check if an email is really from a company, romance scam warning signs and how to tell if a call is a scam.

Questions