Sextortion scams – don't believe the scammers' claims

In a sextortion message, the scammer usually claims to have hacked your device or email account. They may claim to have recorded you while you were visiting an adult website and threaten to send the recording to your contacts unless you pay the amount they demand.

These claims are intended to make you feel ashamed, afraid and under pressure to act quickly. The scammer is trying to get you to pay before you have time to consider whether the claims are true.

How to recognise a sextortion message

A sextortion message may, for example:

• claim that malware has been installed on your device
• claim that your device’s camera has been used to record you
• threaten to send the recording to your family, friends or colleagues
• demand payment in cryptocurrency
• set a short deadline for payment
• mention an old password or a password exposed in a data leak
• name a known vulnerability or type of malware
• make it look as though the message was sent from your own email address.

None of this proves that the scammer has accessed your device or recorded you. The sender address can be spoofed and the scammer may have obtained an old password from an earlier data leak.

What to do if you receive a sextortion message

Do not pay or reply to the message

Do not pay the amount demanded by the scammer. Paying does not guarantee that they will stop contacting you. Do not reply to the message or open any links or attachments in it.

You can mark the message as spam and delete it.

Change any password that you still use

If the message mentions a password that you still use, change it immediately in every service where you use the same password.

Use a different password for each service. This means that if one password is exposed, your other accounts will not be put at risk.

H3 Check the security of your accounts

Enable multi-factor authentication in services that support it. If you suspect that someone else has used your account, also check its sign-in activity and recovery details.

Keep your devices up to date

Install updates for your operating system, browser and other software. Only download software from trusted sources.

Simply receiving a sextortion message does not mean that your device contains malware.

Why can the message seem convincing?

Scammers combine genuine and fabricated information in their messages. Their aim is to make you believe that they have access to your device or accounts.

The message includes a real password

The password may come from an old data breach or data leak. Knowing your password does not in itself prove that the scammer has accessed your email account or device.

Change the password immediately if you still use it.

The message appears to come from your own address

The sender information in an email can be spoofed. A message that appears to come from your own address therefore does not mean that your email account has been hacked.

The message mentions a vulnerability or malware

The scammer may use technical terms, malware names or identifiers for real vulnerabilities to make the message seem more convincing.

Mentioning a technical term or vulnerability does not prove that the vulnerability has been exploited on your device.

Protect your accounts and devices

You can reduce the risk of your accounts and devices being misused by taking the following steps:

• use a different password for each service
• use long passwords that are difficult to guess
• use a password manager
• enable multi-factor authentication
• install software and device updates
• only download applications from trusted sources
• regularly check the sign-in activity and details of your most important accounts
• be suspicious of urgency, threats and unexpected demands for payment.

Report the scam if necessary

You can report a scam message you have received to the NCSC-FI.

Do not include more personal data in your report than is necessary to handle the matter. You can attach the message or a screenshot of it after hiding any unnecessary personal data.