The Email That Knows Your Old Password — How Sextortion Scams Work
An email claims your computer was hacked and your webcam recorded you. It proves it knows you by including a real password you used. Here's what's actually going on.
The Email
You receive an email claiming the sender has installed malware on your device. They say they've recorded you through your webcam. They have video of you visiting adult websites. They will send the recording to your contacts unless you pay $1,400 (or some similar amount) in Bitcoin within 48 hours.
To prove they're not bluffing, they include a password in the email body. It's a password you recognize. You definitely used it at some point.
Your heart rate increases. You think: they must have had access to my computer.
They didn't.
Where the Password Came From
The password in the email almost certainly did not come from your computer. It came from a public data breach database.
Billions of username/password combinations are available in breach databases, collected from hacks of LinkedIn, Adobe, MySpace, RockYou, and hundreds of other services over the past fifteen years. These databases are freely available on hacker forums.
Scammers purchase or download these databases and run automated campaigns. For each email address in the database, they find an associated password and include it in the threat email. The email is then sent to millions of people — most of whom recognize the password because it is, in fact, a real password they used at some point.
The psychological effect is powerful. Seeing a real password convinces recipients that the threat is real.
What the Scammer Actually Has
Almost always: nothing. No malware, no video, no access to your computer.
This attack is pure social engineering based on publicly available breach data. The "evidence" — your password — proves only that your credentials appeared in a breach, which is a matter of public record.
Signs that no webcam access occurred:
What to Do
Do not pay. Payment confirms you're susceptible and often leads to more demands.
Do not reply. Replying confirms the email address is active.
Check the password against known breaches. If the password appeared in a breach database, that's where it came from. Use our Email Breach Checker to see which breaches have exposed your data.
Change the password everywhere it's still in use. Even though the threat is fake, if that password is still in use anywhere, it should be replaced immediately.
Report the email to the FBI's IC3 at ic3.gov — sextortion scam reporting helps law enforcement track and disrupt the operations running these campaigns.
A Caution About Real Sextortion
While the mass-campaign "password in the email" version is almost always fake, real sextortion (threats based on actual compromising material) does exist. If you believe you are being threatened with real material that exists, contact the Cyber Civil Rights Initiative at cybercivilrights.org for guidance specific to your situation.
Bottom Line
The password in a sextortion email came from a data breach, not your computer. No recording exists. Do not pay, do not reply, and change any passwords that are still in use that match what was sent.
Protect Yourself Today
The #1-rated antivirus covers all the threats mentioned in this article.
Get TotalAV — $1.99/month →