The message lands like a nightmare script: someone says they hacked your device, recorded private browsing, and will send the file to everyone you know unless you pay — often a few hundred dollars in Bitcoin, with a short countdown. That pattern is called sextortion. It thrives on shame, not on proof.
Most of these letters give you nothing you can check. No password snippet, no real screenshot of your inbox, no device name, no fragment of a chat that only you would recognise. Technical-sounding talk about “driver trojans” that rewrite themselves every few hours is theatre. So is the claim that opening the email starts a timer the sender can see; ordinary mail does not work that way when images and trackers are blocked. A From address that matches your own is just spoofing — it does not mean your account was taken over.
If you have no other signs of a breach — unknown logins, odd sent mail, new forwarding rules, a changed recovery phone — you usually do not need to panic-pay. Mark the message as spam, delete it, and do not reply. Still worth doing on a calm day: turn on two-factor authentication, review recent sign-ins, and use a unique password for email. Paying rarely ends contact; it can mark you as someone who responds under pressure.
You are not alone in receiving this. The same template goes to thousands of people. If the fear sticks, talk to someone you trust and use the routes on Get help. If a later message offers to “wipe the files” for another fee, treat that as a second scam — the same caution applies on Fake recovery.
This article is for general information only. It is not legal or financial advice. Details change. If you have lost money, contact your bank or card issuer and use the routes on the help pages.