'I Know Your Password' Breach-Data Extortion
An email includes one of your old passwords (from a data breach) as 'proof' of a hack and demands crypto to not release embarrassing footage that doesn't exist.
Think a message like this reached you? You can check it right now.
What this scam is
You get an email claiming a hacker has recorded you through your webcam or has compromising material, and to prove it they show a password you recognize — actually just an old password leaked in a past data breach. They demand payment in crypto within days or they'll 'send the video to your contacts.' There is no video; the leaked password is the only real thing, and it's public breach data, not evidence of a hack. These are sent en masse.
What it usually looks like
- An email showing an old password of yours as 'proof.'
- A claim of webcam footage or compromising material.
- A crypto demand with a countdown.
- A threat to email your contacts.
Common warning signs
- An old (often long-unused) password used to scare you.
- Crypto demanded to prevent 'release.'
- Generic, mass-mailed wording.
- No actual proof of any footage.
Example wording scammers use
“I know your password is ******. I recorded you through your camera. Send $1,500 in Bitcoin in 48 hours or I send the video to everyone.”
“This is your last warning — pay to keep your secret safe.”
These are illustrative examples written by ScamSplain, not real messages.
What the scammers want
- A crypto payment out of fear.
- To exploit a real (leaked) password.
- Volume payments from mass emails.
This is general safety information, not professional advice. It is not legal, financial, medical, or immigration advice, and it does not create a professional relationship. For your own situation, speak with a qualified professional or the official organisation involved. If you are in immediate danger, contact your local emergency number.
What to do
- Do not pay; there is no video — it's leaked breach data.
- Change any account still using that password and make passwords unique.
- Cover your webcam if it eases your mind, and enable 2FA.
- Delete the email.
What to do if you already responded
- If you are overwhelmed or thinking about harming yourself, call or text 988 (Suicide & Crisis Lifeline, US) — it is free, 24/7, and confidential.
- Crypto sent is usually unrecoverable; stop any further payments.
- Change reused passwords and enable two-factor everywhere.
- Report at reportfraud.ftc.gov and ic3.gov.