Sextortion by email: a complete guide

Informatec Digital » Resources » Sextortion by email: a complete guide

In recent years , sextortion scams via email have proliferated . These messages attempt to scare you by claiming to have intimate videos of you and threatening to send them to all your contacts if you don't pay. Many of these emails appear very convincing: they mention hacking, webcams left on without your knowledge, stolen passwords, and even include real personal information.

Although they sound terrifying, the vast majority of these mass sextortion emails are pure fraud : they don't have any videos of you, they haven't taken control of your computer, and they only play on fear, shame, and a sense of urgency to get you to pay in cryptocurrency. Even so, the psychological impact can be enormous, and some people, out of panic, end up paying very large sums or suffer in silence for months.

What is sextortion and how does it relate to email?

Sextortion is a form of sexual blackmail in which a perpetrator threatens to distribute intimate material (photos, videos, erotic conversations, screenshots, etc.) if the victim does not comply with certain demands. These demands can range from paying money to requesting new sexual content or even in-person sexual favors.

In many cases, the intimate content was provided by the victim, who trusted someone who seemed like a partner or a fling on social media, dating apps, or private chats. Other blackmailers, however, don't even have real material: they take advantage of fear and lack of knowledge to convince you that they've recorded you or that they control your camera when, in reality, it's all fabricated.

An extreme case illustrating the impact of these situations was that of a Galician couple and their son, who suffered continuous sexual blackmail for almost a year . They were threatened with having posters with their son's intimate photos plastered all over the city, and they ended up paying around €60.000 before daring to report it due to shame and fear of public exposure.

Sextortion can take place through various channels: social networks, instant messaging, account hacking, illegal access to devices, or, very frequently, massive email campaigns in which criminals send out millions of messages hoping that a small percentage of victims will pay.

Most common types of sextortion blackmail via email

Sextortion emails have become more sophisticated over time, but they essentially follow a few generic templates or scripts that are reused repeatedly. The National Cybersecurity Institute (INCIBE) and law enforcement agencies have detected massive campaigns with nearly identical texts sent to millions of addresses leaked in past data breaches.

In these emails, the scammer usually presents himself as a hacker who has taken total control of your computer or mobile phone: he claims to have installed undetectable spyware, accessed your camera and microphone, recorded what you were watching on adult content pages, and now has an intimate video of you along with your complete contact list.

The blackmailer sets a very short deadline, usually 48 to 72 hours , for you to pay an amount in Bitcoin, often between $700 and $950, and stresses that if you go to the police or tell anyone, he will publish the alleged video on social media or send it to your family, coworkers, and friends.

Another variation of these emails directly threatens physical violence or even death : they claim a hitman has been hired to kill you, but that the sender is willing to cancel the contract if you pay a certain amount. Sometimes, they claim to know where you live or your daily routines, all to increase your fear.

Scams where the fraudster impersonates police or judicial authorities are also very common : they send you a supposed "summons" from Europol, the Ministry of the Interior, Interpol, or a public prosecutor's office, accusing you of very serious crimes such as distribution of child pornography, human trafficking, or indecent exposure. The fake documents tell you that if you cooperate and pay a "fine" or reach an "out-of-court settlement," the charges can be dropped.

How cybercriminals operate: scripts, leaked databases, and cryptocurrencies

Behind most of these emails, there isn't a cybercriminal targeting you, but rather large-scale automated campaigns . Criminal groups buy or download databases containing millions of email addresses and, often, leaked passwords from services that have suffered breaches (social networks, online stores, forums, etc.), making it comparable to other common online scams.

With this information, they create standard scripts that are then sent out via spam: the emails are sent en masse, often from free accounts or compromised servers , and are frequently not even personalized. Sometimes they simply say "Dear customer" or don't include your name at all, but other times they insert details like your old password or phone number to appear more credible.

When a sextortion email includes one of your passwords, it's usually a password that was leaked in a previous data breach. This doesn't mean the scammer has hacked your computer or account ; it simply means that this email/password combination is being resold on criminal networks. If you continue to use that password on other services, then you have a security problem that you should fix by changing the password on all the sites where you've reused it.

Another very common trick is spoofing or sender impersonation : the message appears to come from your own email address, giving the impression that the attacker has gained access to your account. In reality, what they have done is falsify the "From" field of the email, something technically possible if the domain does not have systems like SPF, DKIM, or DMARC properly configured and if the receiving server does not check them.

Regarding payment, they almost always require cryptocurrencies, especially Bitcoin . The reason is simple: the transactions are irreversible, and although they aren't 100% anonymous, tracing the money and linking it to a specific person is difficult and requires a complex investigation. That's why you'll never see them ask for a traditional bank transfer with a clear account holder and IBAN.

Clear signs to recognize a fake sextortion email

Although some messages are increasingly better written thanks to the use of artificial intelligence tools, there are a number of very clear clues that usually reveal that you are dealing with a fraud and not a real threat based on an effective hack.

The first sign is the tone of the message itself: you'll see language laden with fear, urgency, and threats . They talk about very short deadlines—48 or 50 hours—describe catastrophic scenarios, order you not to speak to anyone, and emphasize that if you don't pay on time, they will execute their plan and ruin your social or professional life.

Another key clue is that the message is usually a generic, poorly adapted script . Many emails are sloppily translated, with grammatical errors, strange expressions, or meaningless capitalization. They often mix languages, cite nonexistent laws, or mention organizations that don't actually exist (such as "Russian Interpol" or departments with absurd names).

It's also important to pay attention to the sender's address and contact method: if the email claims to be from a police force or official institution, but the address is from a free service like Gmail, Outlook, or similar , or includes a reply email address that doesn't match the official domain, it's a textbook scam. No reputable agency will contact you from a free account demanding urgent payment.

A very relevant detail is the complete lack of evidence . If someone truly had an intimate video of you and wanted to convince you, the logical thing would be to include at least a screenshot or a blurry frame as proof. Instead, these emails simply describe the alleged video but show nothing. They also rarely include specific names of your contacts or personalized references beyond a leaked password.

Finally, be wary of highly alarming email subject lines such as "Your personal data has been leaked due to your activity on suspicious websites," "Awaiting your payment," or "Important notice regarding your account." Their aim is to get you to open the email as quickly as possible and make impulsive decisions, without taking the time to calmly analyze the situation.

Mass campaigns detected by INCIBE and security forces

In Spain, the National Cybersecurity Institute (INCIBE) and agencies such as the National Police and the Civil Guard have issued several alerts regarding mass sextortion campaigns distributed via email. These alerts explain in detail that these are automated messages based on old data leaks.

According to these institutions, fraudulent emails typically claim that they have infected your devices with undetectable spyware and recorded everything you do on your screen, especially if you visit adult content websites. They claim to have captured both your webcam feed and your monitor activity and combined both elements into a single compromising video.

Technical analysis of these messages demonstrates that these supposed infections are pure fantasy: what is observed is standard text reused in thousands of emails, with no evidence of an actual intrusion. Furthermore, from a technical standpoint, maintaining a continuous stream of video and audio from millions of victims without being detected in network traffic is extremely unlikely for a campaign of this kind.

Authorities also highlight the economic contradiction : if the attacker truly had complete control over your computer, your passwords, and your bank accounts, the most logical thing would be to empty your accounts or steal valuable information, not ask you for a relatively modest sum in Bitcoin and cross your fingers that you agree to pay.

INCIBE also emphasizes that these emails rely on very tight time limits (48-50 hours) and explicitly recommend against going to the police, precisely to try to prevent the victim from seeking advice and paying impulsively. That's why they insist that no payment should ever be made and that the case should be reported if money has already been transferred.

Other forms of digital sextortion: social media, grooming, and real-world hacking

Although this article focuses on emails, it's important to remember that sextortion can also originate on social media and dating apps . In many cases, the perpetrator starts a friendly conversation, pretending to be attractive or approachable, gradually gaining the victim's trust, and eventually asking for intimate photos or videos.

Once the victim sends erotic content, the scammer abruptly changes tactics and begins direct blackmail : demanding more content, money, or sexual favors while threatening to send the images to family members, classmates, or work contacts. This pattern is especially common among children and teenagers, where grooming and the corruption of minors also come into play.

There's also the issue of accounts that have actually been hacked: if you sent intimate photos via chat, social media, or a messaging app, and someone illegally gains access to your account , they can download that material and use it to blackmail you. In that case, there is a real risk, and it's crucial to change your passwords, enable two-step verification, and report the incident as soon as possible.

Another possibility, much less common but still possible, is that a cybercriminal could exploit malware to control a device's camera and microphone . While technically feasible in targeted scenarios, it's not the typical modus operandi of mass sextortion campaigns via email, which rely on volume and psychological manipulation rather than advanced intrusions on each victim.

In all these contexts, the key is to understand that the responsibility never lies with the victim for having trusted or shared intimate content, but with the perpetrator who exploits that vulnerability to coerce and cause harm. Emotional and legal support is just as important as the technical response.

Legal framework in Spain and obligation to report

In the Spanish Penal Code there is still no specific criminal offense called "sextortion", but the behaviors that comprise it fit into several crimes already included in the law : blackmail, extortion, crimes against privacy and honor, disclosure of secrets, corruption of minors, sexual abuse, sexual exploitation, distribution of child pornography, interception of communications, among others.

This means that if someone threatens to distribute your intimate photos or videos, or publishes them without your consent, they are committing crimes punishable by law . That's why the authorities emphasize the importance of reporting it, even if you initially feel ashamed or afraid of the case becoming public.

When reporting, it is essential to provide all possible evidence of the blackmail : complete emails (with headers if possible), screenshots of the messages, links to profiles from which you have been contacted, cryptocurrency wallet addresses to which you have been asked to pay, receipts or proof if you have already made any payment, etc.

It's normal to worry about the privacy of intimate material, but law enforcement agencies and courts treat this evidence with the utmost confidentiality . It is neither published nor used beyond what is strictly necessary for the investigation and legal proceedings.

In addition to official channels, there are specialized associations and services, such as websites that help victims of sextortion, offering both legal guidance and psychological support . Asking for help doesn't make you weak; on the contrary, it's a key step in regaining control of the situation.

What to do if you receive a sextortion email

If you receive an email threatening to release intimate videos of you and demanding a ransom, the first thing to do is not to panic . Take a deep breath, take your time, and keep in mind that, according to analyses by organizations like INCIBE, the vast majority of these messages are part of massive, baseless scams.

Do not reply to the email or pay anything at all. Replying only confirms to the scammer that your email address is active and that you read what they send, which could lead to further blackmail attempts. Paying also doesn't guarantee they'll leave you alone; on the contrary, it shows you're a victim willing to give in, and they can demand more money.

If the email contains a password you still use for any account, immediately change that password on all services where it's used. Take this opportunity to implement strong, unique passwords and, if possible, enable two-factor authentication (2FA) for an extra layer of protection.

It's recommended that you run a full scan with a good antivirus program on your devices, not because the email proves you're infected, but as a general preventative measure. Keeping your operating system, browser, and applications up to date greatly reduces the likelihood of malware successfully infecting your computer.

Once you've verified all of this, you can delete the message or move it to your spam folder. If you have any doubts about whether to report it, you can contact INCIBE's Cybersecurity Helpline 017, where specialized professionals can advise you on the next steps and whether filing a formal complaint is appropriate in your specific case.

Preventive measures to reduce the risk of sextortion

The best defense against this type of blackmail is a combination of digital hygiene, common sense, and educating everyone around you, especially children and teenagers. While zero risk is impossible, you can significantly reduce the chances of becoming a victim of sextortion.

First and foremost, it's wise to be very careful about sharing intimate content . Everyone is free to decide what they share and with whom, but it's important to remember that once a photo or video leaves your device, you lose complete control over it. Be wary of anyone who pressures you to send sexual content or make explicit video calls from the outset.

It's also crucial to frequently review privacy settings on social media and online services, limiting who can see your personal information, contact lists, or posts. The less public data there is about you, the harder it will be for a scammer to personalize threats or impersonate others to approach you or your family.

Always use different passwords for each service and use a password manager if you find them difficult to remember. This way, even if one platform suffers a data breach, the impact will be limited to that specific account and won't affect your other profiles.

On a technical level, it's worthwhile to properly configure records like SPF, DKIM, and DMARC on your domains (if you have email associated with your own domain) and activate the spam and antivirus filters offered by your email provider. This helps prevent many of these emails from even reaching your main inbox.

Special case: emails that appear to be sent from your own account

One of the most unsettling tricks scammers use is to make the message appear as if you sent it yourself , with your address listed as both sender and recipient. This creates the impression that they've taken control of your inbox and are sending emails in your name.

This technique is known as spoofing and involves falsifying the "From" field of an email. In practice, it's like someone writing your name and address in the return address field of a traditional letter: it doesn't mean they've entered your home, only that they've altered the outer label. Unfortunately, the email protocol was designed decades ago and allows this type of manipulation if it isn't reinforced with modern security measures.

To reduce the impact of spoofing, it's recommended to configure an SPF record for the domain (and, if possible, DKIM and DMARC). These records indicate which servers are authorized to send emails on behalf of that domain. If a receiving server checks these records and sees that the message is coming from an unauthorized server, it can mark it as suspicious or reject it outright.

Not all servers perform these checks, so some forged messages can still slip through. If you receive a sextortion email that appears to be sent from your account, carefully analyze the content, check the message's technical headers, and if you have any doubts, consult your email provider or a security professional before becoming alarmed.

In the meantime, follow the same recommendations: don't reply, don't pay, double-check your passwords just in case, and run a scan with your security software. In the vast majority of these cases, there's no real access to your inbox, just a superficial trick.

Ultimately, sextortion scams via email rely more on fear, shame, and urgency than on actual technical skills, and understanding how they work, recognizing their signs, and knowing how to react—by not paying, protecting your accounts, and reporting when necessary—is the best way to clip the wings of these cybercriminals and minimize both the financial and emotional damage.