Ethan More September 16, 2023

Sextortion is one of those portmanteau words that I loathe both for linguistic and descriptive grounds. Sextortion, which is defined as obtaining money by threatening to make sexual activity proof public, has become a common practice among con artists. Please understand that this article is solely about the types of email sextortion “blackmail” scams, and does not discuss grooming, online predators, or anything similar.

I’d say the “I’m a hacker with your passwords and your porn” and “I’m a hacker and I’ve infected your computer with malware” scammers are currently back with a fury, based on my trash email folder and the sheer volume of help requests I’ve been receiving lately. When in a panic, it’s difficult to think clearly, but my advice is to remain calm and take into account the triple negative: they are not an elite hacker, they do not have access to your passwords or system, and they have not filmed you viewing pornography.

What kind of fraud is sextortion?

Obviously, there is always a potential that a sextortion scam is real, but given my extensive experience with this subgenre, I can’t say that I’ve ever run into one. This is not to deny that extortion with the threat of disclosing sexual behavior occurs; in fact, it happens. However, the threat is most frequently posed by someone you know and trust. However, the con artists use a pre-defined methodology meant to arouse anxiety and a reflexive desire to “pay to make it go away.”

In reality, if they were some sort of criminal hacker who had stolen your password and gained access to your accounts and systems, they would exploit that information for much more beneficial purposes. Consider this: in a volume scam, the con artist hopes that at least one victim would fall for the assertion that their computer has been hacked and they are pornographic viewers. The true criminal would aim higher rather than hoping that someone falls for the trap and pays the $1,000 or whatever is demanded. A significantly bigger potential payoff is available if someone has access to your system and passwords, your email, and your financial accounts.

Where did the ‘hacker’ obtain my password?

The biggest indicator that such frauds are phony should be the lack of evidence, yet con artists frequently succeed in sowing the seed of doubt by disclosing a legitimate password of yours. Without an actual hacker genius, how are they able to do this? Simply said, they use one of them by going to one of the many criminal sites that hold databases of compromised passwords. These also provide the fraudster with the email, which is typically used as the username for sextortion scams. The bait is taken because the recipient, who most likely does not use a password manager to generate unique, random, and lengthy passwords for every site accessed, may be able to guess the password. It doesn’t matter if it’s a password for a service you no longer use or that you were required to change after the breach was revealed. This familiarity alone is enough to plant the seed of suspicion and make what follows plausible, especially if you use similar passwords across accounts. However, isn’t malware infection a possibility? It is, indeed. Malware that can capture screenshots, record keystrokes, or do other things is unlikely to be utilized to commit a crime like this, though. Using malware to gather data other than a recording like this is much more profitable and has a much higher likelihood of success.

absolute absence of proof

Why then do I bring up the absence of proof? simply because none will be claimed because the con artist has none. The emails I’ve recently received all claim to have a split-screen video showing the porn being watched and me ‘enjoying’ watching it. They’ll claim that they have captured you watching porn; they’ll state that they have caught you doing it. They claim that these recordings will be made available to the public. They also advise paying the requested money to a cryptocurrency wallet rather than replying to the email since it is from a “hacked account” and won’t be responded to.

What is missing from this? Yes, proof. If I were to try to blackmail someone, I would at least provide some supporting documentation with my demand. In the case of sextortion, this would be a brief video of the aforementioned kind that unmistakably demonstrates you watching porn. It would probably be much more effective to say “I have much more of this and will send it to all your contacts” rather than “I will send the video I claim, but offer no proof, to have.”

The so-called master hacker may occasionally add to their password claims by asserting that they have gained control of your webcam and have done so for several weeks. But even if this were the case—and there are undoubtedly a lot of inexpensive, unreliable third-party webcams—would you believe that the perpetrator would actually erase the purported video after receiving payment? Again, the existence or absence of proof must be considered.

a three-step strategy to combat sextortion fraud

As a result, here is my three-step advice for avoiding similar sextortion scams:

1. Deep breath, no response, no payment, no opening of attachments.

2. Scan the email with a camera. Declare it. Contact your local FBI field office or the Internet Crime Complaint Center (IC3) in the United States, and your local police station or Action Fraud in the United Kingdom. Additionally, you can send a copy of the email to the UK’s “[email protected]” address.

3. Change any passwords that you know have been used. Everywhere you use it, change it. safer to be safe than sorry. Check the excellent and cost-free Have I Been Pwned database at https://haveibeenpwned.com/ to discover if passwords connected with your email address have been hacked and made public if you know the password but can’t recall where you used it. Then modify it.

If you allow, I’ll add a fourth, which is to check your computer for malware if this assertion has been made. Free internet scanners from companies like ESET and Malwarebytes are excellent places to start.