Part of our Scam Spotlight series — plain-language breakdowns of specific phishing and scam patterns we see, building on our Understanding Spam and Phishing Emails (Basics) article.
You receive a threatening email claiming the sender has hacked your computer or email account, sometimes including an old, real password of yours (usually pulled from a past, unrelated data breach) to make the threat feel credible. It claims to have compromising photos, videos, or browsing history, and demands payment — almost always in cryptocurrency — or the material will be sent to your contacts. In reality, the sender almost never has any actual access to your device; they're relying on the old password alone to scare you.
Subject: Your password is [an old password of yours]
From: unknown <random-address@protonmail.com>I have full access to your device and email account. I've been monitoring you for weeks and have recordings I don't think you'd want your contacts to see. Send $1,500 in Bitcoin to the wallet below within 48 hours or I will send everything to everyone in your contact list.
An old, possibly-changed password shown as proof — this is almost always from a past, unrelated breach of some other website, not evidence of a current hack.
Payment demanded only in cryptocurrency, chosen specifically because it's hard to trace or reverse.
Vague claims with no actual proof attached — no real screenshot, no real file, just a description.
A countdown timer designed to trigger panic before you have time to think it through or ask someone for help.
These messages are sent in mass batches to huge numbers of people at once — you receiving one says nothing about whether you were specifically targeted.
Don't pay anything and don't reply.
If the password shown is one you still use anywhere, change it immediately — on that other site and anywhere else you reused it. See How Do I Change My Email Password? for your email account specifically.
Check whether that old password appeared in a known data breach using a reputable breach-checking tool, to understand where it likely came from.
Mark the message as spam/junk and delete it — there's no need to keep engaging with it.
If you've already sent payment:
Unfortunately, cryptocurrency payments are typically not recoverable — but you should still report it to your local police department and, in the US, to the FBI's IC3 (ic3.gov) or the FTC (reportfraud.ftc.gov).
Don't send any additional payments — scammers frequently come back asking for more once they know someone paid once.
Change any passwords referenced in the email, everywhere you've used them.
Understanding Spam and Phishing Emails (Basics)
How Do I Change My Email Password?
My Mailbox Was Hacked — What Happens Next?