Blackmail Emails Claiming to Know Your Password

An email quotes a password you once used and threatens to expose you. Here is how to respond.

By Siddharth ShankarUpdated October 24, 2026

Seeing your own password in a threatening email is frightening, and that is the point. This guide follows the FTC’s consumer alert on blackmail emails of this kind.

What the email says

The message usually claims that the sender has hacked your device, recorded you or gained access to private material. To make the claim look real, it includes a password you have used. It then demands payment, typically in cryptocurrency, and threatens to share the material with your contacts if you do not pay.

What the FTC advises

The FTC’s alert gives clear steps:

• Do not pay. Paying does not guarantee silence and can lead to more demands.
• Delete the email. Do not reply or click any links.
• Change the password shown in the email, if you still use it, and change it anywhere else you have used it.
• Report the scam to the FTC.

Why the scammer knows your password

The sender usually does not need to have hacked you. Passwords leaked in past data breaches circulate widely, and scammers can pair them with email addresses. If an old password appears in the message, it may come from a service that was breached years ago. Check with our guides on how to check if your password has been leaked and how to check if your email has been exposed.

Signs it is a mass scam

• The message is generic and sent to many people.
• It gives no specific proof of the material it claims to hold.
• It sets a deadline and demands payment in cryptocurrency.
• The sender’s address is spoofed or unrelated.

Scammers rely on fear. Take a breath before you act.

What to do next

1. Change the password everywhere you used it, with a unique new one for each account.
2. Use a password manager to create and store unique passwords.
3. Turn on two-factor authentication, preferably with an authenticator app.
4. Check your exposure. A dark web or breach scan shows where your details have appeared. See dark web scan and checking whether your email address is public.
5. Cover your webcam if it makes you feel better, but know that the typical email makes false claims.
6. Tell someone you trust if you feel threatened.
7. Keep a copy of the message and report it.

If the threat is real

If the sender names specific material that you recognise, or threatens violence, treat it more seriously. Contact local police, keep evidence and do not send money. Reporting to the authorities helps.

Related threats

Breach data can also lead to extortion by text or phone; see the Optus data blackmail case. Scammers who demand payment may ask for crypto machines or gift cards; see Bitcoin ATM scams. To learn how scammers find your contact details, read this guide, and for scale see scam loss statistics.