How a sextortion email gets built
They don't know you. They know a list you were on.
Don't pay, reply, click or scan the payment code. Save the message, and if it names a password you still use, change it. Report it at ic3.gov. Then read Sextortion Scam Emails, which covers what the details in the email mean and what to do next.
A sextortion email reads like a personal attack: your name, an old password, maybe your street address and a photo of your house, and a claim that someone recorded you through your webcam. It is almost always a form letter. The same message, with different details merged in, went to thousands or millions of other people the same day.
This page takes the operation apart from the scammer's side, stage by stage. Each stage leaves marks, and once you can see them, the email stops looking like surveillance and starts looking like what it is: a mail merge with a threat attached.
Seven stages, from a breach to a bitcoin address
None of the stages requires knowing anything intimate about you. Most of the work is buying, matching and sending.
| Stage | What they do | What it tells you |
|---|---|---|
| 1. Source the list | Buy or download breach compilations: email addresses, often with passwords. | A password in the email shows credential exposure, not webcam surveillance. |
| 2. Enrich the record | Match emails to names, addresses and phone numbers from people-search sites and broker files; pull a street photo of the address. | Your address and house photo most likely came from listings and a mapping service, not surveillance. |
| 3. Assemble the message | Merge each record into a template with a threat, a payment address and a deadline, varying the wording. | Thousands of people received the same letter with their own details in it. |
| 4. Disguise the sender | Forge the sender line, sometimes as your own address; hide the text in an image or PDF. | A message from your own address is not proof of access. |
| 5. Send at scale | Push millions of messages through rented botnets or hijacked servers. | You were picked by a list, not by a person. |
| 6. Apply pressure | Short deadlines, invented spyware, threats to reach family and colleagues. | The deadline is a pressure tactic, not evidence that the sender has access to anything. |
| 7. Collect | Take bitcoin through an address or QR code, then move it on. | Payment marks you as someone who pays. |
The details are real. The access is invented.
What each stage gives them, and what it gives away
Source the list
Every campaign starts with addresses, and the most useful ones come with a password attached. Huge compilations of old breaches circulate on criminal forums and file-sharing sites, and newer password sets come from infostealer malware that harvests saved logins from infected computers.
The marketplaces change. The ones named in older write-ups of this scam, including ours, have been taken down: the FBI seized RaidForums in 2022. Successors appear within months, and the old data never expires.
What it tells you. A password in the email shows that the password was exposed, not that anyone watched you. If you stopped using it years ago, it most likely came from an old breach. If you still use it, it may also have come from malware on a device: change it everywhere, turn on multi-factor authentication, and check the devices you use it on.
Enrich the record
A bare email address makes a weak threat. So the list is matched against people-search sites and data broker files, which tie an email to a name, a phone number, relatives and a home address. With an address, an online mapping service supplies a street-level photo of the house.
In 2024 a long-running campaign began adding exactly that: the recipient's full name, street address and a photo of the home, delivered as a PDF attachment. It reads as surveillance. It is a lookup.
The scammer does not need a complete record from any single source. An email address from one dataset, a home address from another and a photograph from a mapping service can be joined into a convincing accusation. None of the sources contains evidence of anything. The threat becomes credible through the combination.
What it tells you. Personal details in the email show what is listed about you, not what anyone has watched.
Assemble the message
The letters are templates passed around and reused for years: a claim of hacked devices and webcam recordings, a demand, a payment address and a deadline. Mail-merge scripts drop each record's details into place, and text-variation tools change the wording slightly from copy to copy so filters do not see the same message twice.
What it tells you. Search a distinctive sentence from the email. It will usually turn up in other people's posts about the same scam.
Disguise the sender
The sender line of an email can be forged without any access to the account it names. Showing your own address as the sender is a favorite, because it suggests the scammer is inside your mailbox. Major mail services check whether a message really came from the domain it claims and have tightened those checks since 2024, so more forgeries land in spam, but some still get through.
The text is often put in an image or a PDF, which spam filters read less reliably than plain text.
What it tells you. Check your account's sign-in activity directly, not through the email. A forged sender line leaves nothing there.
Send at scale
Volume does the work. A study of 4.3 million sextortion emails sent in 2018 and 2019 traced campaigns through rented botnets, networks of infected computers sold as a service. Older research on spam botnets put the price of that service at $100 to $500 per million messages. Whatever today's price, the logic holds: a campaign pays for itself if a handful of recipients out of a million pay.
What it tells you. The email is not a sign that anyone chose you. It is a sign your address was on a list.
Apply pressure
The message is engineered for panic: a claim of recorded video, a named piece of spyware, a threat to send the footage to family and colleagues, and a deadline of a day or two. Shame keeps people from asking anyone, and the deadline keeps them from thinking. Chatbots marketed to criminals for writing scam and phishing emails, such as FraudGPT in 2023, make the letters more fluent and easier to vary, but the playbook is the same.
What it tells you. An unsupported claim of surveillance is not evidence that surveillance occurred. The deadline is there to stop you checking.
Collect
Payment is demanded in bitcoin, with a wallet address or a QR code so the victim needs no technical skill. The same addresses often appear across many languages and campaigns; in the 2018 to 2019 sample, most of the revenue the researchers could trace likely went to a single operation. Funds are then moved through mixing services and exchanges, which are themselves periodically seized, as ChipMixer was in 2023.
Paying does not end anything. It confirms that the address belongs to someone who pays, which makes it worth targeting again.
What it tells you. Never pay, reply or scan the code. Report the email and the wallet address to the FBI's Internet Crime Complaint Center at ic3.gov.
The cases this pipeline does not describe
Everything above describes spam: a claim with nothing behind it. Two situations are different, and they need a different response.
The sender shows real private material, or there are signs someone has been inside your accounts. Possession and access are separate questions, and either one turns a bluff into an incident. Sextortion Scam Emails sets out how to tell and what to do.
The target is a teenager. Financially motivated sextortion of young people usually starts on social media or gaming apps. The offender may hold real images obtained by deception, but may also use stolen images or sexual imagery fabricated from ordinary photos, so a child does not have to have shared anything for the threat to be serious. NCMEC received more than 50,000 reports of financially motivated sextortion in 2025, up from more than 36,000 in 2024; the FBI separately referred more than 5,700 of its own reports involving minors to NCMEC. Act at once: here is what to do.
Take away the inputs
You cannot stop a scammer inventing an accusation. You can make the email less convincing and keep a bluff from becoming a real compromise, because every stage above runs on material you can shrink.
- Passwords. Stop reusing them, use a password manager, and turn on multi-factor authentication, starting with email. A leaked password may still create account risk, but it does not prove anyone has compromising material.
- Listings. People-search and data broker listings are how an email gets matched to an address and a house photo. Removing a listing breaks one matching path. It does not erase an old breach, a public property record or a street-level photo, and listings return as brokers refresh, so the work is partial and ongoing. That is exposure reduction.
- Breach exposure. Know which of your accounts appear in circulating breach data. Our circulating data breaches index tracks them.
- Your own domain. Organizations should publish strict email authentication records (SPF, DKIM and DMARC), which help receiving mail services spot and reject mail forged in their name. They reduce spoofing; they do not end it.
Common questions about how sextortion scams work
How did the scammer get my address and a photo of my house?
From a people-search listing or data broker file that ties your email to your address, then a street-level photo from an online mapping service. It is a lookup, not surveillance.
Did the scammer send the email from my own account?
Usually not. The sender line can be forged without access to the account. Check your account's recent sign-in activity by going to it directly.
Do sextortion emails actually make money?
Enough to keep going. A study of 4.3 million emails from 2018 and 2019 traced at least $1.3 million in payments over 11 months, most of it likely to one operation. That is a historical sample, not a current revenue estimate, but the pattern holds: a tiny share of recipients pays.
Will replying or paying make it stop?
No. Replying confirms a live address, and paying marks you as someone who pays. Don't engage; save the email and report it.
Our research on sextortion
Anatomy of a sextortion email
Mass, targeted, or real.
How the campaigns are produced, what each personal detail does and does not establish, and the signs that separate a form letter from a real threat.
Read the Command Brief → GUIDEPublicSextortion Scam Emails: Is the Threat Real?
What the details mean, and what to do.
The companion to this page: an immediate-action checklist, how to tell a bluff from a real incident, removal tools, and help for families.
Read the guide →- FBI Internet Crime Complaint Center, 2025 Internet Crime Report: extortion complaints and losses; sextortion submissions. Source
- MIT Technology Review, The anatomy of a sextortion spam campaign, 19 Aug 2019, on the study below. Source
- Paquet-Clouston, Romiti, Haslhofer and Charvat, Spams meet cryptocurrencies: sextortion in the bitcoin ecosystem, 2019. The $100 to $500 per million figure is the paper's citation of earlier botnet research (Stone-Gross et al., on the Cutwail botnet). Source
- Krebs on Security, Sextortion scams now include photos of your home, 3 Sept 2024. Source
- Lawfare, law enforcement seizure and takedown of two major cybercrime forums (RaidForums), 2022. Source
- CyberScoop, police shut down cryptocurrency mixer ChipMixer, March 2023. Source
- The Hacker News, New AI tool FraudGPT emerges, tailored for sophisticated attacks, 26 July 2023 (Netenrich research). Source
- NCMEC, NCMEC releases new sextortion data for 2025, 25 June 2026. Source
- NCMEC, sextortion: what it is and where to report. Source
Earlier versions of this page and its 2024 PDF named specific marketplaces and tools; many have since been taken down, and this edition describes the method instead. Nothing here is legal advice.