Sextortion and webcam blackmail: what to do immediately

An online encounter, an exchange that turns, then a threat to send everything to the people you know unless you pay within the hour. The panic is part of the method. Here is what actually helps, and in what order.

By the ScamHunter.ch investigation team · Updated 26 August 2026 · Reading time: 9 min

Sextortion means obtaining money by threatening to publish intimate images or videos. It is almost always industrial: accounts created in bulk, well-rehearsed conversation scripts, a countdown and a payment address. You were not targeted because you were careless, but because you were reachable. That distinction matters, because shame is the main lever used against victims — and the main reason these cases go unreported.

What sextortion actually is

The most common script unfolds in four stages: a warm approach from an attractive profile, a quick move to a messaging app, an intimate exchange recorded without your knowledge, then the switch to threats, accompanied by a screenshot of your contact list or professional profile to show that the danger is real.

A frequent variant rests on no images at all: an email claims that spyware filmed your screen, sometimes quoting a password taken from an old data breach to make the threat credible. In this variant there is generally no video. The quoted password should nonetheless be changed everywhere it is still in use.

Why paying almost always makes it worse

Payment deletes no file. What it mainly establishes is that you respond to pressure, which gets the victim contacted again, often for a higher amount, sometimes by another account presenting itself as an "intermediary" or a "deletion service". Payments are requested in cryptocurrency or prepaid cards precisely because they are hard to reverse. If a payment has already been made, it is still worth keeping the transaction identifier: on a public blockchain the flow remains analysable, as described in our guide on crypto scams.

The six actions of the first hour

1. Do not pay and send nothing more, whatever countdown is announced.
2. Stop replying, but do not delete the conversation: it is the primary evidence.
3. Capture the evidence: timestamped screenshots, the profile identifier and link, the payment addresses requested, the file names announced.
4. Report the account to the platform using the blackmail or non-consensual sharing category, which triggers priority handling.
5. Lock down your accounts: profiles set to private, friend and follower lists hidden, two-factor authentication enabled.
6. File a complaint with the cantonal police and report the facts to the Federal Office for Cybersecurity.

Getting already-published content removed

If images have been posted, removal is possible and is handled as a priority by the major platforms, which have dedicated procedures for non-consensual sharing of intimate images. A request succeeds faster when it brings together four elements: the exact URL of the post, the date observed, the reason invoked, and confirmation that the content depicts you and was published without your consent.

Removed content can reappear elsewhere: monitoring over time is part of the work, as is keeping a dated log of every request sent and every response received. That log later serves as an exhibit in the proceedings.

What an investigation can establish

The perpetrator is frequently abroad, which does not make the case unworkable. An open-source investigation reconstructs what is visible and durable: reuse of the profile photographs on other accounts, recurring identifiers, hosting infrastructure, and the path of payments across public ledgers to a regulated service. These elements often link several victims to a single network — see our guide on identification through OSINT.

This work guarantees neither identification, nor permanent deletion, nor recovery of the amounts paid. It produces a dated, sourced file that can be used for filing a complaint and for requests addressed to platforms.

If the victim is a minor

The situation changes in nature and becomes an emergency. Do not pay, do not negotiate and do not delete the exchanges: the facts must be reported to the police without delay, as they have specialised channels. A trusted adult should be informed immediately. Content involving minors falls under distinct and more serious offences, and reports are treated as a priority by the authorities and by platforms alike.

The ScamHunter.ch investigation team

A team specialised in OSINT and digital investigation, based in Geneva. Editorial responsibility: Danilson Ramos. No investigation or recovery outcome is guaranteed.

This article is informational and does not constitute individual legal advice. For any decision, consult a qualified professional with regard to your situation.