Sextortion: What to Do If Someone Threatens to Leak Your Photos

A message arrives late at night. Someone says they have intimate photos or video of you, and they will send them to your family, your employer, and your followers unless you pay within a few hours. Sometimes they include a list of your contacts to prove they can. Sometimes they attach an image that genuinely is you. Sometimes it is a convincing fake generated from your public photos.

This is sextortion, and it has become one of the most damaging crimes on the internet — not because of the money, which is often a few hundred, but because of what the panic does to people in the first hour. Law enforcement agencies across the US, UK, Canada, and Australia have issued repeated warnings about a sharp rise in cases targeting teenagers and young men, and about the tragic outcomes when victims believe they have no way out.

There is a way out. It is the same in almost every case, and it starts with one instruction: do not pay, and do not delete anything.

The Two Kinds of Sextortion

The bluff

The most common version by volume. A mass email claims malware on your device recorded you through your webcam. It often includes a real password of yours as "proof" — lifted from an old data breach, not from your computer. There is no video. There never was. The sender has no idea who you are beyond a leaked email and password pair.

Tell-tale signs: the message is generic, addressed to nobody by name, demands cryptocurrency, and gives a short deadline. No actual content is ever shown, because none exists.

The real one

Here the attacker genuinely has material, obtained through a fake romantic or friendly relationship built over days or weeks — often on Instagram, Snapchat, a dating app, or a gaming platform. The account is stolen or fabricated. Conversation moves quickly to private messaging, then to intimate images "exchanged" — the attacker sends stolen photos of someone else first to build trust.

The moment they have something, the tone changes instantly. Screenshots of your follower list appear. Deadlines shorten. Payment demands escalate after each payment, never stop.

The newer variant: synthetic images

Increasingly, attackers do not need any real intimate material. They take ordinary public photos from your social profiles and generate fabricated explicit images. The threat is identical, and the response below is identical too.

Warning Signs During the Setup Phase

• A new follower or match who is unusually attractive, unusually attentive, and moves very fast.
• Pressure to switch from the platform you met on to a private messaging app quickly.
• They send intimate content first, unprompted, and ask for something back.
• Video calls that are "broken", pre-recorded, or where they can see you but you only see a loop.
• Interest in who your family and colleagues are, or requests to follow your friends.
• Reverse image search on their profile pictures finds them on other accounts under other names.
• The account is new, has few posts, or a follower list of accounts that all look similar.

What To Do In The First Hour

The order matters.

1. Stop responding

Do not reply, do not negotiate, do not explain. Any response confirms the account is live and increases pressure. Silence is the strongest move available to you.

2. Do not pay

Payment does not end it. In documented cases it is followed by further demands, because paying proves you will pay. There is no version of this where money buys safety.

3. Do not delete the evidence

This is the instinct that hurts victims most. Screenshot everything before blocking: the profile, the username and profile URL, the full conversation, the payment address or account details, the threats and deadlines. Save it somewhere outside the app. Platforms and police need this, and it disappears when the account is deleted or you block first.

4. Then block and report on the platform

Every major platform has a dedicated reporting category for sexual extortion or blackmail, and these reports are escalated faster than routine ones. Report from the platform's own menu rather than only blocking.

5. Lock down your accounts

Set social profiles to private. Restrict who can message you to friends or followers only. Temporarily hide or remove your follower and friend lists where the platform allows. The threat depends on the attacker being able to reach the people you care about; take that reach away.

6. Tell one person

The isolation is the weapon. Tell a parent, a partner, a friend, anyone. The threat loses most of its power the moment someone else knows, because the worst outcome the attacker is selling — that people find out — has already partly happened on your terms instead of theirs.

7. Report to law enforcement

This is a serious criminal offence in nearly every jurisdiction. In the US, report to the FBI at ic3.gov, and if the victim is under 18, to the National Center for Missing & Exploited Children's CyberTipline. In the UK, report to the police on 101 and to the Internet Watch Foundation. In Canada, Cybertip.ca. In Australia, the eSafety Commissioner. Being a minor does not mean you will be in trouble — every one of these agencies states explicitly that the victim is not the one being investigated.

Getting Images Taken Down

Two free services exist specifically for this, and they work by hashing the image on your own device — you never upload the picture itself.

• StopNCII.org — for adults. You create a hash of the image locally; participating platforms including Meta, TikTok, Reddit, Bumble, and others block matching uploads.
• Take It Down, operated by NCMEC — the equivalent service for anyone who was under 18 in the image, including adults reporting images taken when they were minors.

Both work pre-emptively. You do not need the image to have been posted yet.

Separately, search engines will de-index non-consensual intimate imagery on request — search for "Google remove personal images" and use the removal request form. Legal routes exist too: many jurisdictions now have specific non-consensual intimate imagery laws, and the UK's Online Safety Act and several US state laws place obligations on platforms to act.

Handling the Bluff Version

If the email is generic, cites a password, shows no actual content, and demands crypto:

1. Ignore it. Do not reply. Mark as spam.
2. Check the quoted password at a breach-notification service, and change it anywhere it is still in use.
3. Move to a password manager so no password is ever reused again.
4. Enable two-factor authentication on your email account first, then everything else.
5. Cover your webcam if it makes you feel better — it costs nothing and closes one real attack path.

Protecting Teenagers

Most reported cases involving minors follow the same pattern: a new online "friend" of similar apparent age, rapid escalation, and then catastrophic pressure. Three things reduce the risk materially:

• The conversation before the crisis. Make it explicit and unconditional: if this ever happens, come to me, you will not be in trouble, and we will fix it. A teenager who believes they will be punished will pay instead of asking for help. That belief is the single greatest predictor of harm.
• Private accounts with restricted messaging, and follower lists hidden where possible.
• Naming the tactic in advance. Teenagers who have heard how the script works recognise it in real time far more reliably than those hearing only "be careful online".

If It Already Happened

1. Preserve evidence, then block and report on the platform.
2. Submit hashes to StopNCII.org or Take It Down so the images are blocked across major platforms.
3. File a police report and keep the reference number — you will need it for platform escalations.
4. Warn close contacts if you fear direct outreach to them. A short "someone is impersonating me and may send you something, ignore it" removes the weapon entirely.
5. Request search engine removal for any content that surfaces.
6. Get support. This is genuinely traumatic, and helplines exist in most countries specifically for image-based abuse. Talking to someone trained in it helps more than people expect.

The Bottom Line

Sextortion is built on a lie: that you are alone, that the deadline is real, and that paying makes it stop. All three are false. The people running these operations work at volume, move on quickly when a target goes silent, and have no interest in following through on threats that stop being profitable.

Do not pay. Do not delete. Tell someone. Report it. Those four steps end the overwhelming majority of cases — and if you are reading this on behalf of someone frightened right now, tell them that first.

If you or someone you know is in crisis, please reach out to a local support line or someone you trust — this is a situation people recover from, and help is available.