Extortion email: how to tell, what to do.
The password in the email is real, and it came from an old breach, not from your webcam.
Try it
Here is what Check says about one.
Example message
I have been watching you for months through your own camera. Your password is hunter2 and I know you live on Oak Street. Send 0.05 BTC to the address below within 48 hours or the recording goes to all your contacts.
These are examples. To check a message you received, create a free account: five checks a day, only the text you paste is sent.
Check my own message, freeMass extortion email using a leaked password as proof
Why we think so
- The password appears in known breach lists, which is where the sender got it
- A deadline and a crypto address, sent to many people with the same text
- No real evidence is ever shown
The short answer
Updated 23 October 2026 · Reviewed by the Sigrel team, Texas
An email claims your device was hacked, shows a real password or address as proof, and demands Bitcoin. Where the “proof” came from and what to do.
- An email, sometimes from “your own” address, that quotes an old password, your phone number or a street address.
- A claim about your webcam or browsing history with no actual recording.
- A Bitcoin address and a countdown.
- Follow-up emails that lower the price.
What to do
In this order.
- 01Do not reply and do not payThe email went to thousands of addresses from a leaked list. Nothing was recorded.
- 02Change the quoted password wherever you still use itIt is in a breach list, so it will be tried on your accounts. Turn on two-step sign-in while you are there.
- 03See which breach leaked itSigrel’s breach view shows every known breach that includes your email, what leaked in each, and the fix in order.
- 04Report and deleteReport to the FBI at ic3.gov and to the FTC at ReportFraud.ftc.gov, then delete the email.
Behind every scan
What is checked, how often, and what you get back. The details, in plain words.
Sources
3 breach-intelligence partners and public leak lists
Each one named in Help with what it covers.
What we watch
6 kinds of identifier
Email, phone, username, gaming handle, email alias and your own domain. Hashed on your device first.
Schedule
Rechecked on a schedule you can see
Every result shows when it last ran. Daily on Pro.
What you get
A fix for every finding
The minutes it takes and the points it gets back. Broker removal across 200+ sites on Pro.
How Sigrel helps
A verdict in the moment, the fix after.
Check the message you received
Paste it; the verdict says why in two lines. Five free checks a day; the text is not kept.
See it reported in your county
The Wire lists the scams reported near you this week, dated and sourced.
If it already happened
The recovery playbooks: who to call first, what to say, what to report.
Questions
Plain answers.
How did they get my real password?
From a data breach of a site where you used it, often years ago. Breach lists with emails and passwords circulate widely; the scam just mail-merges them.
The email came from my own address. Were they inside my account?
Almost never. The sender address on an email can be forged. Check your account’s recent sign-ins to be sure, and change the password if it is the one they quoted.
Got one of these right now?
Paste it into Check. Five free checks a day; the text you paste is not kept.