Sextortion: image blackmail

Two kinds of blackmail: bluff and real

Telling them apart matters, because the actions differ. The first kind is a mass mailing. An email arrives: “I have hacked your camera, I have a recording, pay up.” Sometimes an old password of yours from some long-ago breach is attached, for credibility.

In the overwhelming majority of such cases the sender has nothing. They sent the same email to tens of thousands of addresses and are waiting to see who takes fright. The Finnish cyber security centre devoted a page to this with an unambiguous title: do not believe the blackmailers’ claims.

The second kind is targeted. Here the person really did send photographs in a conversation, most often after several weeks of contact that was heading there. That is genuine material in someone else’s hands, and the conversation is a different one.

How to tell whether a blackmailer is bluffing

A simple sign: have they shown the material itself, or only described it in words? A real blackmailer sends a fragment — they need you to believe. A mass mailing sticks to descriptions and threats, because there is nothing to show.

The second sign is the salutation. An email without your name, starting with “Hello”, sent to your email address, is almost certainly a bluff.

The third is an old password in the message. It looks convincing, but it is usually taken from a breach three to five years old and does not mean anyone was inside your device. Whether your email address has appeared in breaches can be checked on services like Have I Been Pwned.

What to do in the first fifteen minutes

This is the order, and it is not worth departing from it.

Do not answer at all. Any answer confirms that the address is live and the person is frightened. Silence moves you into the unpromising category.

Take screenshots: the messages, the profile, the links, any payment details. The account usually disappears as soon as the victim stops answering.

Block the sender and close your social media profiles to outsiders. Blackmailers look first at your friends list — they need you to be afraid of those particular people.

File a police report. This can be done electronically at poliisi.fi, and the service is open around the clock except between 22:45 and 06:00.

Why paying makes it worse

The victim’s logic is understandable: pay and close the matter. The blackmailer’s logic is different. Payment is confirmation of ability to pay and of willingness. After it comes a second request, then a third.

The material, meanwhile, goes nowhere. No guarantee of deletion exists, the file may already have been copied, and the blackmailer’s promises are part of the manipulation, not a bargain.

A word on cryptocurrency. It is almost always what is asked for, and for the same reason that gift cards are asked for in romance schemes: such a transfer cannot be reversed and is very hard to trace.

How this starts on dating sites

Targeted blackmail almost never starts with a threat. It starts with meeting someone, and that is the stage at which it is easiest to recognise, while nothing has yet been sent.

The first scenario is a fake profile on a dating platform. The other person quickly moves the conversation into private messengers: there the messages are invisible to the platform, and there is nothing to show it afterwards. Take the screenshots yourself.

The second is the hacked account of a real person. Someone you know writes, the conversation flows naturally because the earlier messages have been read. This is the most unpleasant variety, because the familiar check of “but I know them” does not work.

The third is a “chance” acquaintance on Instagram or Snapchat that moves to explicit subjects within a day or two.

What all three have in common is the pace. An insistent move to the intimate on the second day of acquaintance is not passion, it is a script, and it works on speed: the faster it goes, the less time there is to think.

And a characteristic move: “you show me first”. Reciprocity here is imitated with someone else’s material sent in advance. No exchange actually takes place — the other side risks nothing, because what they are showing is not themselves.

Where to turn in Finland

The official sequence is set out by Traficom and is simple: the bank, but only if money has already gone, then the police, then a report to Kyberturvallisuuskeskus, and separately, victim support.

Rikosuhripäivystys takes calls on 116 006, free of charge. There is a separate legal line as well. This is not a formality: blackmail of this kind hits a person harder than a financial loss, and it needs to be talked about with someone.

If the person affected is under eighteen or the offender is threatening physical harm, this is not a matter for an electronic report but for 112. That is a different category of urgency.

What to attach to a police report

In Finland a report is filed electronically through poliisi.fi, and what you attach determines whether the case stays an isolated episode or joins up with others.

A timeline in a few lines: when you met, where, when the threats started, what is being demanded. Without emotion and without justifications — just the sequence.

Screenshots showing the username, the date and the time. A screenshot of text alone with no surrounding context is nearly useless: it has to be clear who wrote it and when.

Anything pointing to an identity or a channel: a link to the profile, an email address, a phone number, messenger usernames, account names.

Payment details if any were given: a crypto wallet address, bank details, a payment link. For an investigation this is often the most valuable part — the same wallet turns up in other people’s cases.

And one limit worth knowing in advance: the material itself does not need to be attached to the report. Describing in words what the blackmailer has is enough. If the investigation needs it, they will ask separately and explain the procedure.

A report is worth filing even when you transferred no money and are sure it is a bluff. Such cases are built out of episodes, and yours may be the one that was missing.

If the material has been published after all

The situation is hard but not hopeless. Large platforms remove such material on the request of the person affected, and you should go straight to that platform’s support rather than wait for the police to react.

A police report is still needed: distributing such material without consent is an offence in its own right, not merely part of the blackmail.

And something worth saying plainly. Shame works for the offender here: the longer a person stays silent, the freer they are to act. Asking for help is not an admission of guilt but a way of stopping what is happening.

If this has happened to a teenager

Here the urgency and the channels are different, and an adult needs to know them before they are needed.

The first and hardest thing is the reaction. A child stays silent not out of distrust but because they expect to be punished for having sent a picture at all. Every hour of that silence works for the offender. The first sentence needed is that they have done nothing they will be told off for, and that this can be sorted out.

Do not pay and do not answer — the same rule as for adults, and it applies here even more strictly.

Save screenshots, block the sender, close the profiles to outsiders.

Then a police report. If there is a threat of physical harm or the situation is unfolding right now, this is not a matter for an electronic report but for 112.

A channel of its own: Nettivihje, a service run by Pelastakaa Lapset (Save the Children Finland) since 2002, which receives reports of sexual material and conduct involving children online, at nettivihje.fi. Reports can be made anonymously, and this does not replace a police report but adds to it.

Rikosuhripäivystys on 116 006 also advises adults who do not know what to do about their child’s situation. You can contact them before taking any formal steps.

How long this usually lasts

The question asked most often and answered least often: when will it end.

With a mass mailing, almost immediately. The sender is working through an enormous list and does not spend time on those who stay silent. If you have not replied once, the emails usually stop within a week or two, sometimes with one or two more attempts in more menacing wording. That is not a sign that you are being watched but a standard mailing template.

With targeted blackmail it is longer and less even. The first days are the most intense: pressure, deadlines, a countdown. The deadline given is almost always fictitious — it is there so that you do not have time to think or to ask anyone.

If you do not reply and do not pay, the intensity falls: it is more profitable for the person to switch to someone who reacts. But a return weeks or months later is possible, especially if you replied once.

What lengthens the story: any reply, even a refusal; any attempt to negotiate; and paying most of all. Those who have paid are milked again, because they have already proved that they pay.

What shortens it: complete silence, blocking, closed profiles and a police report. The last does not always produce a quick result in your own case, but such cases are built out of episodes, and your wallet address or account may be the one that was missing from somebody else’s investigation.

And the thing that matters more than the timescale: the feeling that this will never end is part of the pressure, not a reflection of reality. It passes sooner if you tell at least one person what is happening.

How to reduce the risk in future

Complete safety is impossible, but both the likelihood and the consequences can be reduced.

The most effective step is not to send material by which you can be identified. Your face, tattoos, a recognisable interior, a clock on the wall. This is not about caution in inverted commas; it is about the fact that without identification blackmail loses its force.

The second is a closed friends list on social media. The scheme is built on the offender being able to see exactly who the material could be sent to.

The third is being wary when a conversation turns suspiciously quickly in that direction. Insistence on the second day of acquaintance is not passion but a script.

Bluff or a real threat: how to tell

Classification based on Kyberturvallisuuskeskus and Traficom material.

Frequently asked

Sources

• Traficom: Pornokiristykset — älä usko huijarien väitteitä
• Traficom: Toimi näin, jos tulit huijatuksi — the official sequence of steps
• Kyberturvallisuuskeskus: report an incident
• Poliisi: filing a report
• Rikosuhripäivystys (RIKU) — support for victims, 116 006
• Nettivihje, Pelastakaa Lapset — reports about material involving children