What is a Sextortion Scam?
Threat actors send extortion scam emails that try to coerce people into making payments by accusing the recipient of engaging in activities of a sensitive nature, such as watching pornography, and threatening to make embarrassing/explicit information about them public.
This is one form of sextortion scam. For information about other types, including those in which threat actors trick a person into providing sensitive, sexually explicit photos, please see Sextortion on FBI.gov.
How it Works
The threat actor often sends a communication email with a document attached that claims they have videos or other information about the recipient that are of a sensitive nature. The threat actor demands payment (often via cryptocurrency like Bitcoin) to keep them from exposing the information to the public.
The senders do not have evidence of pornography viewing or webcam footage of the recipient. They are working from large, publicly available lists of email addresses associated with past data breaches and publicly available information.
What to Watch Out For
Attempts to convince the recipient that the scammer already has their personal information, such as name, address, and email account. For example, the recipient’s name and address may be used as an email subject and within the document.
Messaging that is designed to be frightening and stressful, such as:
- a photo of the target’s home from Google maps or another publicly available site, or
- threats that malware has captured webcam footage of the email recipient engaging in private activities of a sensitive nature, such as viewing pornography.
How to Protect You and U-M
- Do not pay the extortion money.
- Do not respond to suspicious emails, or click any links or documents in the email.
- Report Phishing & Email Abuse.
If You Get Caught
Individuals who have fallen victim to one of these scams, resulting in financial loss, should contact the University of Michigan Police Department at 734-763-1131 or text 377911.
Scam Example
[This scam email often has a subject and elements in the attached document customized to the recipient, such as a name, address, phone number and Google Map image of their home. Do not let the inclusion of this information fool you. See the Information Assurance notice Extortion emails increasing at U-M for additional details about this scam. Actual recipient information, as well as the bitcoin payment address of the scammer, have been redacted in this example.]
The following is an example of the document attached to the email.
[redacted first and last name],
I know that calling [redacted phone number] or visiting [redacted address] would be a effective way to have a word with you in case you don't cooperate. Don't even try to escape from this. You have no idea what I'm capable of in Ann Arbor.
I suggest you read this message carefully. Take a moment to chill, breathe, and analyze it thoroughly. We're talking about something serious here, and I don't play games. You don't know anything about me whereas I know you and right now, you are wondering how, correct?
Well, you've been a bit careless lately, clicking through those girlie videos and venturing into the darker corners of cyberspace. I actually installed a Malware on a porn website and you accessed it to watch(you get my drift). When you were watching videos, your smartphone started out working as a RDP (Remote Device) which allowed me total accessibility to your system. I can peep at everything on your display, switch on your cam and mic, and you wouldn't have a clue. Oh, and I have got access to all your emails, contacts, and social media accounts too.
Been keeping tabs on your pathetic existence for a while now. It is simply your misfortune that I noticed your misdemeanor. I gave in more days than I should have investigating into your life.
Extracted quite a bit of juicy info from your system. and I've seen it all. Yeah, Yeah, I've got footage of you doing embarrassing things in your room (nice setup, by the way). I then developed videos and screenshots where on one side of the screen, there's the videos you had been enjoying, and on the other half, its someone doing filthy things. With simply a single click, I can send this filth to every single of your contacts.
Your confusion is clear, but don't expect sympathy. As a family man, I am willing to wipe the slate clean, and allow you to move on with your regular life and forget you ever existed. I will offer you two alternatives.
Option One is to turn a blind eye to my e mail. Let me tell you what will happen if you select this option. Your video will get sent to your contacts. The video is straight fire, and I can't even fathom the humiliation you'll endure when your colleagues, friends, and fam check it out. But hey, that's life,ain't it? Don't be playing the victim here.
Wiser second option is to pay me, and be confidential about it. We’ll call it my “confidentiality tip”.let me tell you what happens if you opt this path. Your secret will remain your secret. I will wipe everything clean once you send payment. You'll transfer the payment via Bitcoins only. Pay attention, I'm telling you straight: 'We gotta make a deal'. I want you to know I'm coming at you with good intentions. My word is my bond.
Required Amount: USD 2000
BITCOIN ADDRESS: [redacted bitcoin address]
Once you pay up, you'llsleep like a baby. I keep my word.
Notice: You got one day to sort this out and I will only accept Bitcoins (I've a unique pixel in this email, and right now I know that you've read through this mail). My system will catch that Bitcoin payment and wipe out all the dirt I got on you. Don't even think about replying to this or negotiating,it's pointless. The email and wallet are custom-made for you, untraceable. If I notice that you've shared or discussed this message with anyone else, your shitty video will instantly start getting sent to your contacts. And don't even think about turning off your phone or resetting it to factory settings.It's pointless. I don't make mistakes, [first name redacted].
Beautiful neighborhood btw
[redacted photo of home of recipient – Google Maps image]
Honestly, those online tips about covering your camera aren't as useless as they seem. I am waiting for my payment..
Resources
Sextortion Scams Now Include Photos of Your Home (Krebs on Security)