Email Says It Has Your Password and Webcam Video: Is It Real?

An email that quotes one of your real passwords and says the sender has recorded you through your webcam is a well-known extortion scam, and the video does not exist. The Federal Trade Commission (FTC) calls the hacking and webcam claims "all talk". The scammer most likely bought or downloaded a list of email addresses and passwords exposed in a data breach, then sent the same message to thousands of people. Do not pay, do not reply, change the password it shows, turn on multi-factor authentication and report the email.

Who this is for and what you will have at the end

This guide is for anyone who received an email, sometimes with a password in the subject line or the first sentence, that says they were filmed, hacked or watched, and demands payment in Bitcoin or other cryptocurrency. At the end you will understand why the password appears, know how to check whether your details leaked, have secured your accounts, and know where to report the message and how to get help if the threats continue. It does not describe how to run the scam.

If your situation is different, for example someone has intimate images of you or the demand follows a real online relationship, see the section "If the threat is real or personal" below, because that needs a different response.

What the email typically says

The FTC describes the emails like this:

• The sender says they hacked your computer and recorded you visiting adult websites.
• They threaten to send the video to your friends and family within hours unless you pay into a Bitcoin account.
• They may claim access to your computer or webcam, or say they installed software to get around your defenses.

The message often feels personal because it includes a password you recognize. That is the part that frightens people, and it is the part with an explanation.

Why it contains your password

The FTC's explanation is that your email address was likely exposed in a data breach. The scammers may know an old or recent password, and they include it in the message to make the threat seem credible. Seeing a password in the message is a sign to change it.

This means several things that are worth stating plainly:

• The password came from a breach of a website or service, and not from your computer. Breached credentials circulate in large lists that scammers can obtain.
• The password may be years old and from an account you no longer use.
• The same message goes to a large number of addresses. Nothing in it shows that the sender has watched you.
• The claim of a webcam recording is a bluff. The sender does not need to have any footage to send an email.

A related variation includes your phone number, home address or a photo of your house. These details also come from leaked lists or public records, and they do not show that anyone has access to your devices.

What to do, in order

1. Do not pay. The FTC's advice is not to pay anything.
2. Do not reply, and do not click links or open attachments. Replying confirms that the address is live. This is general safe-email practice and is not from the FTC alert. Delete the message after you have reported it.
3. Change the password the email quotes. Use the account's own settings page or sign-in page by typing the address yourself, and not a link from any message.
4. Change it anywhere else you used it. The FTC says to consider changing your other passwords too.
5. Check old accounts. The password may come from an account you no longer use, so think about which service it belonged to.
6. Turn on multi-factor authentication for your email, bank and any account that supports it, so a leaked password alone cannot open the account.
7. Report the message (see below).

Check whether your details leaked

Have I Been Pwned (HIBP) is a free service that tracks data breaches. Its FAQ describes two tools.

Check your email address

1. Go to haveibeenpwned.com and enter your email address.
2. The site lists the known breaches that include it. According to its FAQ, results do not include sensitive or retired breaches, and sensitive breaches are visible only to the verified owner of the address who signs in to the dashboard.
3. If your address is not found, that does not rule out a breach. The FAQ notes that the site holds only a subset of breached records, and that "absence of evidence is not evidence of absence."

You can also subscribe to notifications so you get an email if your address appears in a future breach. Notifications go only to the address being monitored. The messages come from [email protected], which is worth allow-listing if the verification email does not arrive.

Check a password

Pwned Passwords is a separate service that checks whether a specific password has appeared in a data breach. According to the FAQ, it records only that a password was exposed and how many times it was seen, not whose it was, and no password is stored alongside personal data such as an email address. If a password is found, it should no longer be used. Do not type a password you currently use anywhere that is not the official site, and do not type a password into any look-alike. Use the real haveibeenpwned.com address.

What the result means

Secure your accounts properly

A leaked password is only a problem if the same password still opens something. A short routine closes that gap.

1. Use a password manager to generate and store a different password for every account. A manager also flags reused passwords.
2. Change the quoted password first, then work through the accounts that matter most: email, bank and card accounts, your phone carrier, and cloud storage.
3. Turn on multi-factor authentication. An authenticator app or a passkey is stronger than a text message where the service offers it.
4. Review recent sign-in activity on your email and main accounts. Look for sign-ins you do not recognize, and sign out of unknown devices.
5. Check your email forwarding and filter rules. An attacker who has really gained access may add a forwarding rule. If you find a rule you did not create, remove it and change the password.

What not to do

• Do not pay, even a small amount. There is no video to delete.
• Do not contact the sender to negotiate or to "ask for proof".
• Do not buy a service that promises to identify or stop the sender. Be cautious of any company that offers to fix the problem for a fee.
• Do not install software because an email, or a person offering help, told you that you were hacked.

Report it

• FTC: report the message at ReportFraud.ftc.gov, as the FTC's alert advises.
• FBI IC3: the FBI's Internet Crime Complaint Center takes reports of cyber-enabled crime at complaint.ic3.gov, including cases where someone has actually paid or keeps contacting you. Its page notes that it cannot respond to every submission, but reports help the FBI track trends. It also states that it will never directly contact you for information or money.
• Your email provider: use the report phishing or report spam button so the sender is filtered for others.

If the threat is real or personal

The mass-mailed password email is a bluff, but some extortion is not. If the person contacting you knows you, has actual images, or is a person you have been talking to online, treat it differently:

• Stop communicating, but keep the messages, usernames and payment details as evidence.
• Do not pay, since payment often leads to more demands.
• If you or someone involved is under 18, report to the National Center for Missing and Exploited Children, which the IC3 page lists for crimes against children. If you are in immediate danger, call 911 or local police.
• Report it to the platform where the contact took place and to the IC3.
• If someone has shared intimate images and a platform does not remove them, the FTC points to TakeItDown.ftc.gov to report the platform.

Rely on law enforcement and the platform's own reporting tools first, not on paid "sextortion assistance" services.

If you already paid

1. Stop sending money.
2. Contact the exchange, ATM operator or payment provider you used, tell them the transaction was fraudulent and ask them to reverse it. The FTC's page "What To Do if You Were Scammed" gives this step for cryptocurrency.
3. Report it to the FTC and to the IC3.
4. Change your passwords and turn on multi-factor authentication, as above.

Payment will not make the scammer stop. Expect more messages and do not respond to them.

Summary checklist

1. The webcam and hacking claims are a bluff, and the password came from an old data breach.
2. Do not pay, reply, click or open attachments.
3. Change the quoted password and any account that shares it.
4. Check haveibeenpwned.com for your email, and check any suspect password in Pwned Passwords.
5. Use a password manager, unique passwords and multi-factor authentication.
6. Report to ReportFraud.ftc.gov, and to complaint.ic3.gov if money was lost or threats continue.
7. If the contact is personal or involves images, keep the evidence and report it to the platform and law enforcement.

References

• FTC Consumer Alert, Scam emails demand Bitcoin, threaten blackmail: https://consumer.ftc.gov/consumer-alerts/2020/04/scam-emails-demand-bitcoin-threaten-blackmail
• FTC, What To Do if You Were Scammed: https://consumer.ftc.gov/articles/what-do-if-you-were-scammed
• FTC Consumer Alert, Did an online platform fail to quickly take down your intimate images? Report it to the FTC: https://consumer.ftc.gov/consumer-alerts/2026/09/did-online-platform-fail-quickly-take-down-your-intimate-images-report-it-ftc
• Have I Been Pwned, FAQs: https://haveibeenpwned.com/FAQs
• FBI Internet Crime Complaint Center (IC3): https://www.ic3.gov/