Fake hacking blackmail
In plain terms
An email claims your webcam was hacked and that you were filmed. It sometimes quotes one of your old passwords to seem credible. Yet the message contains nothing that actually identifies you: it's sent unchanged to thousands of recipients.
Definition
Fake hacking blackmail is a mass-sent extortion message claiming that spyware filmed the victim, demanding payment to prevent a distribution that has no real basis.
How it works
The message is identical for thousands of recipients: it contains nothing specific to you, only claims worded to sound personal. Its credibility rests on a single trick: quoting a password you recognize. That password comes from a data breach at some other service, bought in bulk — it proves a site was compromised at some point, not that your device is compromised today. The rest of the message is designed to prevent verification: a short deadline, an instruction not to tell anyone, a claim that replying would trigger the send. Payment is demanded in cryptocurrency, letting the sender collect without ever having to prove anything.
Warning signs
- A message claiming to hold a recording, without ever showing an excerpt
- An old password quoted as proof of compromise
- Nothing genuinely personal: no name of someone close to you, no verifiable detail
- Payment demanded in cryptocurrency within 24 or 48 hours
- A claim that the message is undetectable or that replying would be detected
- A message that appears to come from your own address, presented as proof of a hack
How to verify
A blackmailer who genuinely holds a recording shows an excerpt of it: that's what gives the threat weight. A message that claims without ever showing has nothing. If a password is quoted, note which one: that's useful information — it should be changed everywhere it's still used — but it isn't proof of access to your device.
What to do
Don't pay, don't reply. Change the quoted password, along with any account where it was reused, and enable two-factor authentication. Mark the message as spam and delete it.
If it already happened
If a payment was made, keep the transaction reference and file a police report: it's usable evidence. When the message contains nothing genuinely personal, there is nothing to distribute, and refusing to pay carries no consequence. If, on the other hand, content was actually shown to you, or you had an intimate exchange with the sender, the situation is sextortion and that fiche's guidance applies instead. If doubt remains, have the device checked: that will settle a concern that is, this time, real.
Frequently asked questions
- The message quotes a password I actually used.
- It comes from a data breach at a service you used, resold in bulk. That means it should be changed everywhere it's still used — that's the only useful action — but it doesn't mean your webcam or computer were compromised.
- The message appears to come from my own email address.
- The displayed sender address is a field the sender fills in themselves: writing yours there requires no access to your account. Check your sent folder — the message isn't there, because it never left from it. That isn't proof of hacking, only staging.
- Should I cover my webcam?
- It's a simple precaution with no downside, addressing a real but separate risk. It changes nothing about this particular message, which is based on no actual recording.
Related attacks
Official sources
Also known as: webcam blackmail scam, fake blackmail, blackmail email, "I hacked your computer" scam.
This article is part of the Blackmail, harassment and personal harm family. Last updated: 2026-09-02.