"I hacked your camera" email: real, bluff, how to check

The message arrives, often at night, and the first line makes your stomach drop. The sender says they took control of your computer, switched on your camera and recorded you. They may quote a password of yours. They give a deadline and an amount to send in cryptocurrency, or the video goes to everyone in your contacts.

This page is for the person who just read that message. It explains what is real and what is a bluff, how to check your own computer in about half an hour, and what to do next. It also covers the rare cases that are real.

What the message says, and why it frightens almost anyone

These e-mails follow a script. The sender claims to have planted malware on an adult website, or on your own machine, and says it gave them your screen, your webcam and your contacts. The Federal Trade Commission described the pattern in a consumer alert: the e-mails say the sender hacked into your computer and recorded you visiting adult websites, and threaten to send the video to friends and family within hours unless you pay into a Bitcoin account.

The detail that shakes people most is the password. Seeing one of your own in the first line feels like proof. It is real, and it proves very little, as we explain below.

What the agencies say: a bluff built from old leaks

The UK National Cyber Security Centre has published guidance on exactly this e-mail. It calls these messages a type of phishing attack. It says they are made to look credible by giving plausible technical details about how the video was supposedly made, and that the message can include the person's password. Then it states the point that matters most: the sender does not know if you have a webcam, whether you visited adult websites, or how you communicate with people. In its words, they are guessing.

The FTC reached the same conclusion. Its alert says the scammers may claim access to your computer or webcam, or software that defeats you, and that this is all talk. It adds that they may really know one of your old or recent passwords, and include it to prove their claim. The agency's reading, based on the timing of a spike in reports, was that people receive these messages because their e-mail address was exposed in a data breach.

The NCSC says the password in the message has most likely come from historic breaches of personal data. Websites get breached, their user lists are copied and traded, and a sender can buy a file with millions of addresses and old passwords and mail all of them the same text. Nobody looked at your computer. You were a line in a spreadsheet.

The NCSC's practical advice is short. Do not engage with the sender. Forward the e-mail to [email protected], the Suspicious Email Reporting Service, and then delete it. Do not worry if the message includes your password. If it is a password you still use, change it immediately.

How the scam works technically

1. A breach list. The sender holds a file of e-mail addresses with passwords from old data breaches.
2. A template. The text is written once and sent in bulk. Only the address, the password and sometimes the ransom amount change.
3. A deadline. A short one, such as hours, stops you from thinking, checking or asking anyone. The NCSC notes that phishing plays on emotions so that people behave out of character.
4. A payment route. Cryptocurrency is requested because it is hard to reverse. The NCSC warns that if you pay, you will likely invite more scams, because the sender now knows they have a willing customer.

When it is real: the Jared Abrahams case

According to the U.S. Justice Department, Jared James Abrahams, a college student from Temecula, California, hacked into as many as 150 online accounts to extort young women. He used hacking software to take control of victims' e-mail accounts, social media accounts and even their computers, which let him turn on webcams remotely and occasionally take pictures of victims who were naked. He chose women he knew, and found others by hacking Facebook pages. The BBC reported that more than two dozen women in several countries had their computers hacked.

He then threatened to post the pictures publicly unless the victim sent more images or took part in a Skype session and did what he said for five minutes. The Justice Department said he posted nude photos to the social media accounts of several teens and young women. The FBI identified him quickly after a victim reported him. He pleaded guilty to one count of computer hacking and three of extortion, and on 17 March 2014 was sentenced to 18 months in federal prison.

The difference from the bulk e-mail is plain: he held actual pictures and used them, and he knew his victims. Prosecutors wrote that this crime can be life-changing for vulnerable victims who feel they cannot rebuild a damaged reputation.

What you see	Bulk bluff e-mail	Real compromise or real sextortion
How it reached you	Same text sent to many addresses from a breach list	Aimed at you, often after contact on an app, dating site or social media, or after your accounts were taken over
What the sender shows	An old password and a story, usually nothing from your camera	Actual images, video or messages, sometimes posted to one of your accounts
Proof offered	Technical claims you cannot check	Material you recognise as yours
What the sender wants	Cryptocurrency, quickly, with a short deadline	More images, more money, or contact on another platform
What to do	Do not reply or pay, change the password, report, delete	Do not pay, keep evidence, stop contact, report to police or the FBI, use image removal services

What happened to real people

Two people who were blackmailed with real images spoke to the BBC. Their cases differ from a bulk e-mail, but they show what the fear can do.

In 2016, a Northern Ireland man called Jimmy, in his twenties, told the BBC he had exchanged photos, including sexual images, with a woman he met on a dating app. Ten minutes after he sent his profile, he said, she asked what he would do if she sent his photos to his friends and family. She demanded money, messaging him every few minutes. He sent 150 pounds. When she asked for 300, he said no, deactivated his social media account, and went to the police. He had told his mother, he said, but still could not talk to anyone else. The BBC reported that police in Northern Ireland had received 100 webcam blackmail reports that year, and that police linked four deaths by suicide in the UK in the previous year to sextortion.

In 2024 the BBC told the story of John, who asked to stay anonymous and who has a learning disability. A woman who said she was a teacher was kind at first, then sent intimate photos and persuaded him to send one back. Her tone changed, and he received as many as 50 messages a day. He lost more than 3,000 pounds trying to stop the blackmailer sharing the image. When he had no money left, fearing there was no way out, he thought about taking his own life. He then told someone he trusted, a charity worker at SeeAbility, who helped him report the messages. He told the BBC he now lives with constant anxiety and is in therapy. He said the police made him feel like a criminal; the National Crime Agency told the BBC that should not have happened.

What a message like this does to your body and mind

If you are reading this with a racing heart, the first thing to know is that the fear the message set off is real even when the threat behind it is not, and that fear has a name and a way down.

Research gives that feeling a shape. A scoping review of studies on sextortion, available through PubMed Central, reports that victims often experience fear, humiliation, shame and self-blame. These can show up as depression, anxiety, suicidal thoughts and self-harm. One study it describes found that being a victim was related to symptoms of depression and anxiety, and its authors noted that more research is needed to know whether poor mental health came before the experience or after. Participants in another study described being constantly nervous, having panic attacks, and not being able to eat.

Most of that research is about people who really were blackmailed with real images. A bulk e-mail is milder. But your body does not know the message is a form letter. It reads the first lines as a threat to your safety and reputation, and it responds with a surge of alarm: a pounding heart, a tight chest, shaking, a feeling of unreality. That is the same alarm response seen in a panic attack, and it is not evidence that the threat is real.

Shame is the second effect, and it is the one scammers rely on. The FBI says shame, fear and confusion often stop young victims from asking for help. James Babbage of the National Crime Agency said many victims feel responsible and that this is absolutely not the case: you are not to blame, and help is available. Telling even one person you trust breaks the isolation, as it did for John.

What to do now, step by step

Do these in order. None needs you to spend money.

1. Do not reply and do not pay. The NCSC says paying will likely encourage more scams. The NCA says that once an offender has shown you can pay, they will likely ask for more.
2. Keep a copy of the message before you delete it, if you want to report it. The NCA advises victims of real blackmail not to delete messages, images, numbers or bank details that could be evidence.
3. Check if the password is one you still use. If it is, change it now, on that site and anywhere else you used it. Use a different, long password for each important account, and start with your e-mail account.
4. Turn on two-step verification (2FA) for your e-mail, bank, social media and cloud storage. The NCSC points to its Cyber Aware guidance for creating suitable passwords and enabling other factors of authentication.
5. Check whether your address appears in known breaches at haveibeenpwned.com, which the NCSC recommends for this purpose.
6. Report the message. In the UK, forward it to [email protected]. In the US, report it at ReportFraud.ftc.gov or ic3.gov. Then delete it.
7. Tell one person you trust. You do not have to give details. Saying "I got a scary scam e-mail" is enough.

Check your Windows PC in half an hour

These steps follow Microsoft's support pages for Windows 11 and Windows 10. Microsoft ended support for Windows 10 on 14 October 2025, so consider moving to Windows 11.

Step 1: look at the camera light. Microsoft says that if your device has a camera light, it turns on when the camera is active. If your device has no light, Windows shows a notification when the camera turns on or off. Watch for a light or notification that comes on when you are not using a video app.

Step 2: look at which apps can use the camera. On Windows 11, go to Start, then Settings, then Privacy & security, then Camera. Under Let apps access your camera, you can turn the camera off for each listed Microsoft Store app. Below that is Let desktop apps access your camera. On Windows 10, go to Start, then Settings, then Privacy, then Camera, and look for Allow apps to access your camera and Allow desktop apps to access your camera.

Microsoft explains that the list of desktop apps shows apps Windows has detected that have interacted with the camera, and that you can select any of them to see details about the specific file on your device. Look for anything you do not recognise. Desktop apps cannot be switched off one by one, so if you do not need the camera, you can turn the desktop setting off for a while. Covering the lens with a sliding cover or tape also helps, as the Justice Department advises.

Step 3: look at what starts with Windows. Right-click Start and choose Task Manager, then open the Startup apps tab. Microsoft says the same list is in Settings, under Apps, then Startup. Look for programs you did not install or do not recognise. Look up a name before you disable it, and select Disable only on programs you are sure you do not need.

Step 4: run Microsoft Defender scans. Open the Windows Security app, choose Virus & threat protection, and use Protection updates, then Check for updates, so the scan uses the latest definitions. Then open Scan options and choose Full scan, which Microsoft says scans every file and program on your device. Afterwards, run Microsoft Defender Antivirus (offline scan). Microsoft says this restarts the device and scans without loading Windows, so persistent malware has a harder time hiding. Save your work first. To see the results of the offline scan, open the Windows Security app and select Protection history.

If the scans find nothing, the light behaves normally, and no unknown apps start with Windows, the most likely explanation is the one the agencies give: you received a bulk scam message built from an old data breach. If something does turn up, disconnect the PC from the internet, let Defender quarantine what it found, change your passwords from a different, clean device, and consider asking a trusted technician for help.

If you already paid, or the threat is real

If you sent money, you did not fail a test. People pay because they are frightened, and the message is designed for that. Do not send more. The NCSC advises that anyone who paid the ransom should report it to their local police force by calling 101 in the UK. In the US, contact local law enforcement or report at tips.fbi.gov, ic3.gov or by calling 1-800-CALL-FBI.

If the sender shows you an actual image or video of you, or has posted something, the situation is different, and these steps apply.

• Stop contact and block the account, but keep the messages, usernames, wallet or payment details as evidence.
• Do not pay. The FBI notes that in financial sextortion cases, offenders often release the material whether or not they receive payment.
• Report to the police or the FBI at tips.fbi.gov. In the UK, you can also use the CEOP Safety Centre if the person involved is under 18.
• Ask for the images to be removed. For adults, stopncii.org helps remove non-consensual intimate images. For anyone under 18, use takeitdown.ncmec.org. The FBI warns against companies that charge sextortion victims for help.
• If you think accounts or your identity may have been misused, identitytheft.gov (US) and Report Fraud in the UK (reportfraud.police.uk, which the NCSC links to for sextortion information) are the places to report.
• If you need emotional support in the UK, the NCSC points to Victim Support on 0808 168 9111.

How to make it harder next time

• Use a different password for every important account. A password manager makes this practical.
• Turn on two-step verification everywhere it is offered, starting with e-mail.
• Check haveibeenpwned.com now and then, and sign up for alerts.
• Keep Windows and your browser up to date, and keep Microsoft Defender or another well-known security product switched on.
• Avoid opening unexpected attachments, as the Justice Department advises.
• Cover your webcam when it is not in use.
• Do not get lured into compromising situations online, advises the Police Service of Northern Ireland as quoted by the BBC, and block and report nuisance and fraudulent users. The FBI lists a quick move to another platform as a warning sign.

If you need to talk to someone now

If this message, or anything else, has left you feeling hopeless, or thinking about ending your life, please talk to someone right now. You do not have to carry it alone, and the feeling of being trapped can ease with support.

• In the US, call or text 988, the 988 Suicide & Crisis Lifeline.
• In the UK and Ireland, call Samaritans free on 116 123.
• Anywhere else, call your local emergency number.
• If you are in the UK and were blackmailed, Victim Support is on 0808 168 9111.

John told the BBC that he wanted people to know you can survive this, and that you just need to reach out for help.

Frequently asked questions

Is the "I hacked your camera" e-mail real?

In almost every case it is a bulk scam. The UK NCSC says the sender does not know whether you have a webcam or visited any site, and is guessing. The FTC says the claims of access to your computer or webcam are all talk. The password in the message most likely came from an old data breach.

How did they get my password?

The NCSC says it was most likely obtained from historic breaches of personal data. A website you used was breached and its user list was copied and traded. You can check your address at haveibeenpwned.com, as the NCSC suggests, and change any password you still use.

Should I pay or reply to a sextortion e-mail?

No. The NCSC warns that paying will likely bring more scams because the sender sees a willing customer. Do not reply either. Forward the message to [email protected] in the UK or report at ReportFraud.ftc.gov in the US, then delete it.

How can I tell if my webcam has really been hacked?

Watch for the camera light turning on by itself, or the Windows notification if your device has no light. Check Settings, Privacy & security, Camera for apps you do not recognise, review Startup apps in Task Manager, and run a Microsoft Defender full scan and an offline scan.

What if the e-mail shows my real password?

It proves only that the password was exposed somewhere at some point. Change it on every site where you used it, turn on 2FA, and make sure your e-mail account has its own strong password.

What should I do if I already paid?

Do not pay again. Report it to the police: in the UK call 101, in the US use tips.fbi.gov or ic3.gov. Change your passwords and turn on 2FA. Paying does not mean you did anything wrong; the message is designed to make people pay.

I feel panicked and can't stop thinking about it. Is that normal?

Yes. Fear, shame and anxiety are common reactions even to messages that turn out to be empty. Tell someone you trust and take the checks one at a time. If the feeling becomes overwhelming or you have thoughts of ending your life, call or text 988 in the US or call Samaritans on 116 123 in the UK and Ireland.