# Email Says It Has Your Password and Webcam Video: Is It Real?

> Understand the sextortion email scam that quotes your password, check whether it leaked with Have I Been Pwned, secure your accounts and report it safely.

Source: https://www.epifive.com/blog/sextortion-email-scam-password-in-subject-what-to-do · Published 2026-10-30 · EpiFive

## Key takeaways

- The FTC says the claims of webcam access and hacking in these emails are all talk, and the scammer usually only has an old password from a data breach.
- Do not pay, do not reply and do not click links or open attachments in the message.
- Change the password the email quotes, plus any other account that reuses it, and turn on multi-factor authentication.
- Have I Been Pwned can show which breaches include your email address, but not being found there does not prove you were never breached.
- Report the message to the FTC at ReportFraud.ftc.gov, and to the FBI's IC3 if you have lost money or are being threatened further.

An email that quotes one of your real passwords and says the sender has recorded you through your webcam is a well-known extortion scam, and the video does not exist. The Federal Trade Commission (FTC) calls the hacking and webcam claims "all talk". The scammer most likely bought or downloaded a list of email addresses and passwords exposed in a data breach, then sent the same message to thousands of people. Do not pay, do not reply, change the password it shows, turn on multi-factor authentication and report the email.

## Who this is for and what you will have at the end

This guide is for anyone who received an email, sometimes with a password in the subject line or the first sentence, that says they were filmed, hacked or watched, and demands payment in Bitcoin or other cryptocurrency. At the end you will understand why the password appears, know how to check whether your details leaked, have secured your accounts, and know where to report the message and how to get help if the threats continue. It does not describe how to run the scam.

If your situation is different, for example someone has intimate images of you or the demand follows a real online relationship, see the section "If the threat is real or personal" below, because that needs a different response.

## What the email typically says

The FTC describes the emails like this:

- The sender says they hacked your computer and recorded you visiting adult websites.
- They threaten to send the video to your friends and family within hours unless you pay into a Bitcoin account.
- They may claim access to your computer or webcam, or say they installed software to get around your defenses.

The message often feels personal because it includes a password you recognize. That is the part that frightens people, and it is the part with an explanation.

## Why it contains your password

The FTC's explanation is that your email address was likely exposed in a data breach. The scammers may know an old or recent password, and they include it in the message to make the threat seem credible. Seeing a password in the message is a sign to change it.

This means several things that are worth stating plainly:

- The password came from a breach of a website or service, and not from your computer. Breached credentials circulate in large lists that scammers can obtain.
- The password may be years old and from an account you no longer use.
- The same message goes to a large number of addresses. Nothing in it shows that the sender has watched you.
- The claim of a webcam recording is a bluff. The sender does not need to have any footage to send an email.

A related variation includes your phone number, home address or a photo of your house. These details also come from leaked lists or public records, and they do not show that anyone has access to your devices.

## What to do, in order

1. **Do not pay.** The FTC's advice is not to pay anything.
2. **Do not reply, and do not click links or open attachments.** Replying confirms that the address is live. This is general safe-email practice and is not from the FTC alert. Delete the message after you have reported it.
3. **Change the password the email quotes.** Use the account's own settings page or sign-in page by typing the address yourself, and not a link from any message.
4. **Change it anywhere else you used it.** The FTC says to consider changing your other passwords too.
5. **Check old accounts.** The password may come from an account you no longer use, so think about which service it belonged to.
6. **Turn on multi-factor authentication** for your email, bank and any account that supports it, so a leaked password alone cannot open the account.
7. **Report the message** (see below).

## Check whether your details leaked

Have I Been Pwned (HIBP) is a free service that tracks data breaches. Its FAQ describes two tools.

### Check your email address

1. Go to haveibeenpwned.com and enter your email address.
2. The site lists the known breaches that include it. According to its FAQ, results do not include sensitive or retired breaches, and sensitive breaches are visible only to the verified owner of the address who signs in to the dashboard.
3. If your address is not found, that does not rule out a breach. The FAQ notes that the site holds only a subset of breached records, and that "absence of evidence is not evidence of absence."

You can also subscribe to notifications so you get an email if your address appears in a future breach. Notifications go only to the address being monitored. The messages come from noreply@haveibeenpwned.com, which is worth allow-listing if the verification email does not arrive.

### Check a password

Pwned Passwords is a separate service that checks whether a specific password has appeared in a data breach. According to the FAQ, it records only that a password was exposed and how many times it was seen, not whose it was, and no password is stored alongside personal data such as an email address. If a password is found, it should no longer be used. Do not type a password you currently use anywhere that is not the official site, and do not type a password into any look-alike. Use the real haveibeenpwned.com address.

### What the result means

| Result | What it means | What to do |
|---|---|---|
| Your address appears in a breach | A service you used was exposed | Change the password for that service and any account that shares it |
| The quoted password is in Pwned Passwords | The password is publicly known | Stop using it everywhere |
| Nothing found | Not proof you were never breached | Still change the quoted password and use unique passwords |

## Secure your accounts properly

A leaked password is only a problem if the same password still opens something. A short routine closes that gap.

1. **Use a password manager** to generate and store a different password for every account. A manager also flags reused passwords.
2. **Change the quoted password first,** then work through the accounts that matter most: email, bank and card accounts, your phone carrier, and cloud storage.
3. **Turn on multi-factor authentication.** An authenticator app or a passkey is stronger than a text message where the service offers it.
4. **Review recent sign-in activity** on your email and main accounts. Look for sign-ins you do not recognize, and sign out of unknown devices.
5. **Check your email forwarding and filter rules.** An attacker who has really gained access may add a forwarding rule. If you find a rule you did not create, remove it and change the password.

## What not to do

- Do not pay, even a small amount. There is no video to delete.
- Do not contact the sender to negotiate or to "ask for proof".
- Do not buy a service that promises to identify or stop the sender. Be cautious of any company that offers to fix the problem for a fee.
- Do not install software because an email, or a person offering help, told you that you were hacked.

## Report it

- **FTC:** report the message at ReportFraud.ftc.gov, as the FTC's alert advises.
- **FBI IC3:** the FBI's Internet Crime Complaint Center takes reports of cyber-enabled crime at complaint.ic3.gov, including cases where someone has actually paid or keeps contacting you. Its page notes that it cannot respond to every submission, but reports help the FBI track trends. It also states that it will never directly contact you for information or money.
- **Your email provider:** use the report phishing or report spam button so the sender is filtered for others.

## If the threat is real or personal

The mass-mailed password email is a bluff, but some extortion is not. If the person contacting you knows you, has actual images, or is a person you have been talking to online, treat it differently:

- Stop communicating, but keep the messages, usernames and payment details as evidence.
- Do not pay, since payment often leads to more demands.
- If you or someone involved is under 18, report to the National Center for Missing and Exploited Children, which the IC3 page lists for crimes against children. If you are in immediate danger, call 911 or local police.
- Report it to the platform where the contact took place and to the IC3.
- If someone has shared intimate images and a platform does not remove them, the FTC points to TakeItDown.ftc.gov to report the platform.

Rely on law enforcement and the platform's own reporting tools first, not on paid "sextortion assistance" services.

## If you already paid

1. Stop sending money.
2. Contact the exchange, ATM operator or payment provider you used, tell them the transaction was fraudulent and ask them to reverse it. The FTC's page "What To Do if You Were Scammed" gives this step for cryptocurrency.
3. Report it to the FTC and to the IC3.
4. Change your passwords and turn on multi-factor authentication, as above.

Payment will not make the scammer stop. Expect more messages and do not respond to them.

## Summary checklist

1. The webcam and hacking claims are a bluff, and the password came from an old data breach.
2. Do not pay, reply, click or open attachments.
3. Change the quoted password and any account that shares it.
4. Check haveibeenpwned.com for your email, and check any suspect password in Pwned Passwords.
5. Use a password manager, unique passwords and multi-factor authentication.
6. Report to ReportFraud.ftc.gov, and to complaint.ic3.gov if money was lost or threats continue.
7. If the contact is personal or involves images, keep the evidence and report it to the platform and law enforcement.

## References

- FTC Consumer Alert, Scam emails demand Bitcoin, threaten blackmail: https://consumer.ftc.gov/consumer-alerts/2020/04/scam-emails-demand-bitcoin-threaten-blackmail
- FTC, What To Do if You Were Scammed: https://consumer.ftc.gov/articles/what-do-if-you-were-scammed
- FTC Consumer Alert, Did an online platform fail to quickly take down your intimate images? Report it to the FTC: https://consumer.ftc.gov/consumer-alerts/2026/09/did-online-platform-fail-quickly-take-down-your-intimate-images-report-it-ftc
- Have I Been Pwned, FAQs: https://haveibeenpwned.com/FAQs
- FBI Internet Crime Complaint Center (IC3): https://www.ic3.gov/

## Frequently asked questions

### Does the sender really have video of me?

The FTC describes the claims of hacked computers and webcam recordings in these emails as "all talk". The scammers usually got your email address and an old or recent password from a data breach and use the password to make the threat look credible.

### Should I pay to make it go away?

No. The FTC's advice is not to pay anything and to delete the message. Paying marks you as someone who responds and does not remove a risk that was never real.

### How do I check whether my password leaked?

Search your email address at haveibeenpwned.com to see known breaches that include it, and use its Pwned Passwords service to check whether a specific password has appeared in a breach. If a password is found, stop using it everywhere.

### Should I change my password even if the email is a scam?

Yes. If the email quotes a password, change it on the account where you use it and on any other account that shares it. Turn on multi-factor authentication so a leaked password alone is not enough to sign in.