Skip to content
FIN-CSIRT
RS

FIN-CSIRT / Search

What are you looking for?

Start typing to see results.
    Report an incident

    FIN-CSIRT / Practical lesson

    Stop the pressure and make room for a safe response

    Do not negotiate or pay under pressure. Preserve the message, secure accounts and involve a trusted person or authority.

    People who have received a threatening or extortion messageAbout 6 minutes of reading + 3 questions
    Go to response steps Is the threat active, or have you already paid?

    What you will learn

    • Separate the sender's claim from verifiable evidence of compromise.
    • Preserve evidence without continuing to engage.
    • Secure accounts and involve appropriate support.

    Why does the message feel personal?

    A criminal can use an email address, old password or other information from an earlier breach to make a generic threat look like proof of device access. A claim about a recording, conversation or private material may be entirely fabricated.

    Do not assume every threat is harmless, either. If the message contains real private material, involves a child, threatens immediate physical harm or includes current non-public information, seek police and specialist help without confronting the sender directly.

    Do not negotiate under pressure

    1. Do not reply, follow links or open attachments.
    2. Do not send money, identification or more private material.
    3. Preserve screenshots, available message headers, the sender’s account, time and payment details.
    4. Tell somebody you trust. Secrecy is part of the pressure, and support helps prevent panic decisions.
    5. After preserving evidence, block and report the account to the platform.

    Secure accounts and devices

    If the message contains a password you still use, change it immediately everywhere it was reused. Start with email, enable an additional authentication factor and review active sessions, forwarding rules and recovery details.

    If there are real signs of device access — an unknown program, camera activity, new administrator permission or an unknown session — stop sensitive activity on that device and request a technical review.

    When urgent help is needed

    Contact the police or an appropriate specialist service immediately if there is a threat to physical safety, stalking, non-consensual sharing of intimate material or any content involving a child. Do not forward sensitive material yourself as “evidence”; ask the relevant authority how to provide it safely.

    If you already replied or paid

    1. Stop further communication and preserve the whole conversation.
    2. Contact the bank, exchange or other payment provider through an official channel and report the extortion.
    3. Secure accounts and devices according to the evidence you actually have.
    4. Report the event to the police and the platform where the message arrived.
    5. If a work account or device is involved, notify your organisation immediately.

    Practice example

    A message claims there is a private recording

    Unknown sender
    Today, 09:41

    I know one of your old passwords and have a camera recording. Send cryptocurrency within 24 hours or I publish everything.

    Fictional example for practice.
    Show the example explanation
    Emotional pressure and a short deadline
    Fear, shame and secrecy are used to prevent verification and discussion with someone you trust.
    An old password is presented as proof
    The password may come from an earlier data breach and does not confirm the recording claim.
    Payment by a hard-to-reverse method
    Payment does not guarantee deletion and may lead to further demands.

    Check your knowledge · 3

    Your turn to choose the next step.

    Choose one answer for each question shown. More complex lessons select three questions from a wider question bank when the lesson loads.

    Questions and explanations are also available without JavaScript.

    A message includes an old password and claims there is a recording. What does the password prove?

    Why does this matter? Passwords from older breaches are often used to make a generic threat feel personal.

    1. That the sender certainly controls the camera.

      Knowing an old password is not proof of current camera or device access.

    2. That the password may once have been exposed, not that every other claim is true.Correct answer

      Separate the claims: protect an affected account and assess other evidence independently.

    3. That paying guarantees deletion of the recording.

      The sender provides no enforceable guarantee and may continue demanding money.

    What should you preserve before blocking the sender?

    Why does this matter? Evidence supports reporting and later assessment of the account, pattern and payment route.

    1. The message, sender account or address, time and payment details.Correct answer

      These details preserve content and technical context without further engagement.

    2. Only my replies to the sender.

      Replying can prolong the pressure and is not the only relevant evidence.

    3. Nothing; permanently delete the message immediately.

      Immediate deletion may remove information needed for a report.

    You already paid and a new demand arrives. What do you do?

    Why does this matter? The first payment does not bind the criminal and may signal that further pressure could produce more money.

    1. Pay again because the first payment has already been sent.

      Another payment increases the loss without any guarantee the pressure will stop.

    2. Stop communicating, contact the payment provider and report the event with preserved evidence.Correct answer

      Prompt financial contact and reporting create an opportunity for assistance and documentation.

    3. Send more private information to verify my identity.

      More content gives the criminal additional material to misuse.

    No registration. Your answers are not sent; the result is just for you.

    Do not face the threat alone

    Do not send money or more content. Preserve evidence, secure accounts and contact a trusted person or authority.

    Review accounts after a data breach

    References

    Sources and further reading

    The pattern of threats using old passwords and the recommendation not to engage or pay are based on the UK National Cyber Security Centre guidance on sextortion emails (United Kingdom). UK-specific reporting contacts have not been copied into this Serbia-focused lesson.

    Content last reviewed