“I Have Your Password”: The Scary Extortion Email That’s Usually a Bluff

You open your email and your stomach drops. A message is waiting that says a hacker has been watching you. It claims to have your password, and, chillingly, it shows a real password you actually recognize. It says it recorded you through your webcam, that it has embarrassing footage, and that it will send that footage to all your contacts unless you pay, usually in cryptocurrency, within a day or two. It is designed to make your heart race, and it works, because seeing a real password of yours in a threatening email is genuinely frightening.

So let me get you to the reassuring truth as quickly as possible: this kind of email is almost always a bluff. The criminal behind it very likely does not have any footage of you, has not been in your computer, and is not watching you. They are running a numbers game, betting that a scary email with a real-looking detail will frighten enough people into paying. Understanding exactly how this scam works takes away nearly all of its power, and it points you to the one small, real thing you should actually do. Let me walk you through it calmly.

What this scam actually is

This is called a sextortion or extortion email scam, and it is sent out in enormous volumes, to millions of people at once, not targeted at you personally. The criminal writes one frightening template, threatening to expose embarrassing webcam footage or activity, and blasts it to huge lists of email addresses, demanding a payment to make the supposed problem go away. It relies entirely on fear and shame to get a small percentage of recipients to pay before they stop and think.

The genius of it, and the part that makes it so convincing, is the "proof." The email often includes a real password of yours, or sometimes a phone number, to make you believe the criminal truly has access to your private life. When you see a password you actually used, your instinct is to conclude the threat must be real. That is precisely the reaction the scammer is counting on. But that password is not proof of anything they claim.

Why the "proof" is not what it seems

Here is where the whole thing falls apart once you understand it. That real password the criminal showed you almost certainly came from an old data breach at some completely unrelated company, one of the countless breaches over the years in which millions of email addresses and passwords were exposed and ended up circulating among criminals. These stolen lists are bought and traded cheaply, and scammers simply mail-merge a password from the list into a threatening email next to each address, automatically, for millions of people at once.

In other words, the criminal did not hack your computer, break into your webcam, or watch you. They bought an old leaked password and used it as a prop to make a mass-produced threat feel personal and real. The footage they claim to have does not exist. Notice that these emails never actually show you any footage, because there is none, and they cannot describe anything specific about you beyond that recycled password or number. It is theater, built on a single real detail pulled from a breach that had nothing to do with the frightening story they are telling.

That recycled password is also the clue to the one real, and very manageable, issue hiding inside all this fear.

The one real thing to do

Strip away the scary story, and what this email actually reveals is simply that a password of yours leaked in a data breach somewhere, at some point. That is worth addressing, but it is a routine, fixable thing, not the nightmare the email describes. So here is what to actually do, calmly.

Do not pay. There is nothing to pay for, and paying only funds the criminals and marks you as someone who pays, which invites more attempts. Do not reply, and do not panic. Then handle the one genuine issue: if the password shown in the email is one you still use anywhere, change it right away, everywhere you use it, and stop reusing it across accounts, because a leaked, reused password is the actual (modest) risk here. Turn on multi-factor authentication on your important accounts, so that even a leaked password is not enough for anyone to get in. And it is worth checking whether your email and passwords have appeared in known breaches, which tells you what to update, using the safe, free method we describe in how to check if your password was stolen. Finally, delete the email or report it as spam or phishing, and move on with your day.

If it gives you peace of mind, covering your webcam with a small cover or a piece of tape is a harmless, sensible habit anyway, not because this particular email is real, but because it is simply good practice. The key takeaway: the frightening threat is hollow, and the only real action is the ordinary one of updating a leaked password and switching on multi-factor authentication.

Why this matters for your team

Here is why this is worth raising in a business, not just for yourself. Your employees receive these same terrifying emails, and because the emails invoke fear and embarrassment, some people panic, believe the threat, and quietly pay, or suffer real distress, without ever telling anyone. That silence is exactly what the scam relies on.

So let your team know, plainly and without embarrassment, that these emails go around, that they are a bluff, that no one should ever pay, and that the right response is simply to report the email and change any password that shows up in it if it is still in use. Making it a known, openly discussed thing means that when one of your people receives it, they recognize it for the empty threat it is instead of being frightened into paying or feeling ashamed. Removing the fear and the secrecy defeats the entire scam.

How we think about it

This scam is a pure play on fear, which is exactly why understanding it, and having the fundamentals in place, defuses it, and that is how we think about security at Red Door Shield, through a simple framework we call KIT: Keep, Inspect, Trust. Keep what is valuable secure, with multi-factor authentication and strong, unique passwords, so that a leaked password, the only real thread in this whole scary email, cannot actually hurt you. Inspect what is coming in, so threats are met with understanding rather than panic. And trust through validation, which here means recognizing an empty threat for what it is rather than trusting a fear-driven story. We help businesses and their people replace fear with clear understanding, so a hollow threat lands as the nuisance it is, not the crisis it pretends to be.

What ready looks like

Picture the scary email arriving, complete with a real old password of yours, and instead of your heart racing and your mind spinning, you recognize it instantly: an empty bluff built from a breach, nothing more. You do not pay, you do not panic, you simply change that password if you still use it anywhere, confirm your multi-factor authentication is on, delete the email, and get on with your day. Your team reacts the same way, calmly and without shame. The scam that depends entirely on fear finds none to work with.

That is what ready feels like against extortion emails. Not being frightened by a hollow threat, but understanding it so completely that it loses all its power.

The "I have your password" email is engineered to terrify you, but it is almost always a bluff, a mass-produced threat propped up by an old leaked password. Do not pay, change any password it reveals if you still use it, keep multi-factor authentication on, and move on. Share the truth with your team so no one is frightened into paying in silence. And if you want help making sure a leaked password, or anything else, cannot actually hurt your business, our free Business Security Assessment is the place to start, and it is a conversation worth having today.

Note: extortion and blackmail scams can be genuinely distressing, and while these mass emails are almost always empty threats, if you ever receive a threat that appears specific and personally targeted, or you feel unsafe, it is reasonable to contact law enforcement.