IT Insights
Bitcoin Extortion Emails: What’s Real, What’s Bluff, and What to Do
An email claims someone hacked your computer, recorded you through the camera, or stole private information. It includes an old password, demands Bitcoin, and sets a short deadline. The message feels personal because it is designed to make you act before you think.
Most of these emails are mass-produced scams. The password often came from an old breach involving another website. It proves the sender obtained a list; it does not prove the sender controls your computer.
Do not reply and do not pay just to make it go away
Replying confirms that the address is monitored. Paying identifies someone willing to pay and does not buy silence or prove that any stolen material was deleted. Save the message, including the full headers if possible, and report it through your email provider.
Check the claim instead of arguing with the sender
Change the exposed password anywhere it is still used. If that password was reused, each account needs a different replacement. Turn on multifactor authentication. Review recent sign-ins and forwarding rules for your email account. Run an endpoint scan and make sure the device is receiving security updates.
The situation deserves faster escalation if the sender includes current files, recent screenshots, specific internal information, or evidence of access to an active account. The same is true if you notice unfamiliar logins, sent messages you did not send, disabled security software, or financial activity.
What about the Bitcoin address?
Keep it with the original message. It may help an email provider, investigator, or incident-response team connect the demand with other reports. Do not visit random “recovery” services that promise to identify the sender or retrieve cryptocurrency; extortion victims are frequently targeted a second time.
A sensible response
- Preserve the email and do not engage.
- Replace any exposed or reused passwords.
- Enable multifactor authentication and review account activity.
- Check the device and email account for independent signs of compromise.
- Escalate credible evidence to IT, legal counsel, law enforcement, or insurance as appropriate.
The threatening language is meant to create panic. A short, methodical check tells you far more than the sender’s claims.