I know your password is Summer2019!. I installed malware on an adult site you visited and recorded you through your webcam. I have the video and all your contacts. Send $1,450 in Bitcoin to the address below within 48 hours or I send it to everyone you know.
It's crude, it's threatening, and it contains a password you really used.
Short answer: it is a bluff sent to millions of people. There is no video, no malware and no access to your contacts. The password comes from an old data breach - a website you used years ago leaked its user list, and that list is sold to scammers who mail-merge it into this template. The password is the only true thing in the email, and it's there to scare you.
How you can be sure
- The password is old. Usually one you changed years ago, from a site you barely remember.
- No proof. A real blackmailer with a video would send a frame of it. These emails never do, because it doesn't exist.
- Everyone gets the same text. Search a distinctive sentence from the email in quotes - you'll find thousands of identical copies with different passwords and Bitcoin addresses.
- Your webcam. Most laptops have an indicator light; phones don't get "webcam malware from a website".
Other versions
- "I hacked your device and have photos" with your phone number or home address instead of a password (also from breaches).
- A version that includes a photo of your street from Google Street View, printed as a PDF, to look personal.
- The same threat sent as a Telegram or Instagram DM.
What to do
- Don't pay and don't reply. Replying marks your address as live.
- If you still use that password anywhere, change it now and turn on two-factor authentication. Check haveibeenpwned.com to see which breach it came from.
- Mark the email as spam. You may get a few more with other old passwords; ignore them.
- If you're a teenager and someone you actually chatted with is threatening you with real images: that is a different, real crime. Don't pay, stop contact, and tell a trusted adult or use takeitdown.ncmec.org (works internationally) - they can get images blocked.
Not sure? Paste it
Paste the email into Scamed. The "old password + Bitcoin + 48 hours" template is one it recognises immediately.