Sextortion: what to do in the first hour

What should you do if you are being sextorted?

Five things, in this order. None of them requires you to work out who is on the other end.

• Do not pay, and do not send anything else. Not money, not gift card codes, not another image.
• Screenshot first. The profile, the handle, the whole conversation, and whatever account or wallet they told you to pay.
• Do not delete anything. Not the messages, not your account, not the app.
• Then block, and report the profile to the platform. Blocking comes after the screenshots.
• Then report it. The routes, by country and by age, are set out below.

That order is not ours. The US Treasury's notice of 8 September 2025 lists the same steps for anyone being exploited: block them, save the profile, messages and images, ask for help from a trusted adult or law enforcement, and send no money.

Does paying make the threats stop?

Usually not. What the reporting records is a further demand rather than an ending.

The Treasury's Financial Crimes Enforcement Network put it plainly in its notice of 8 September 2025: despite receiving an initial payment, the perpetrator will often continue to demand more payments. The same document records that the sums are usually small — $10 to $50 from minors, $500 to $2,500 from adults — because a negotiation runs until it reaches what somebody can actually pay.

The FBI reaches the same conclusion from the other side. Its announcement of 5 June 2023 says complying does not guarantee that the content will not be shared anyway, and FinCEN's summary is that cooperating rarely stops the blackmail and harassment.

So a payment buys nothing anybody can rely on. That is the reason not to make one, and it holds whether or not the amount is affordable.

What should you save before you block?

Everything that identifies the account, and the conversation itself. The FBI asks for it in those terms.

• The profile: handle, display name, profile photo, the URL, and the join date where a platform shows one.
• The messages in full, including the threat and anything they claimed to hold.
• The payment details: the number, email, tag, wallet address or card codes they gave you.
• Any other accounts they contacted you from, and any they named.

The 5 June 2023 announcement asks people to retain all information regarding the incident: usernames, email addresses, the websites or platforms used, photos and videos. A screenshot of the report confirmation is not a substitute, because a blocked profile stops loading.

Where the person threatened is a minor, FinCEN's notice adds one step: put the phone into aeroplane mode and leave it until law enforcement can look at it.

Where do you report sextortion?

To the national route for the offence, and to the child protection body as well if anyone in the images was under 18. Both at once is normal.

None of these need you to know who the account belongs to, and none of them ask you to have resolved anything first. The FBI's 2 September 2021 announcement puts it in two lines: stop all interaction, and file the complaint.

How do you get the image taken down?

Through a hash service, and which one depends on your age when the image was taken.

Take It Down, run by NCMEC, covers images taken of you while you were under 18. StopNCII is the equivalent for images taken at 18 or over. Neither uploads your file: your own device computes a hash, a fingerprint of the image, and only the hash goes to the participating platforms, which match it and remove copies.

There is a legal route in the United States as well. The TAKE IT DOWN Act, Public Law 119-12, requires a covered platform to remove a non-consensual intimate image within 48 hours of a valid request, and to have that request process running within a year of the Act being signed in May 2025.

The limit is worth knowing before you lean on it. A hash reaches participating platforms and nowhere else, and a cropped or re-encoded copy can hash differently. It cuts the spread. It is not an erase button.

If the person in the images is under 18

Then it is a child exploitation case, and there are routes built for nothing else.

In the United States, NCMEC's CyberTipline takes the report and Take It Down takes the removal; NCMEC also answers on 1-800-THE-LOST. In the UK it is CEOP for the report and Report Remove, run by the Internet Watch Foundation with Childline, for the removal. In Canada it is Cybertip.ca.

FinCEN's September 2025 notice describes who is being targeted, and it is specific: minors, and boys aged 14 to 17 in particular. IC3 referred more than 5,700 submissions involving minors to NCMEC during 2025.

Every one of those agencies puts the same step first, which is telling an adult. It is also the step the threat is built to prevent.

What the reported numbers actually show

A large category, counted only through the people who reported it.

The FBI's 2025 Internet Crime Report records more than 75,000 submissions about sextortion during 2025. FinCEN's notice gives the year before it for scale: nearly 55,000 reports of sextortion and extortion reached the FBI in 2024, a 59 per cent rise on 2023. The complaints are spread across every age band rather than sitting in one.

The under-20 band files more than 11,000 complaints and still reports the smallest total loss of any group, which matches FinCEN's finding on the size of the payments minors are asked for. Treat every row as a floor rather than a count: IC3 writes that shame and fear stop people reporting at all.

What can a lookup tell you here, and what can it not?

It can date an account and show whether an identifier has any history behind it. It cannot tell you who is typing, and it cannot take an image off a website.

The first of those is narrower and more useful than it sounds. An account opened three weeks ago, on one platform, under a handle that appears nowhere else, is a throwaway. Run whatever they have already given you: an address through the email lookup, which reaches 71 sources, a handle through the username lookup and its 71 platforms, a number through the phone lookup, which reaches 8. A name answers against 13 registers.

Sources that came back empty are printed beside the ones that answered, so a thin result looks thin rather than looking like a finding. The sample report shows the layout.

None of it names a person. A stolen photograph does not carry the name of whoever posted it, and no lookup removes anything. The services in the section above are the only route to that.

After the first day

Two things follow, and one of them is another scam.

The FBI issued an announcement on 7 April 2023 about for-profit companies charging fees for sextortion assistance. It records one juvenile paying $5,000 after being told he would not get into college, and another paying $2,000 and then $3,200 more. Some of those companies discourage people from going to law enforcement, and the FBI notes limited reporting that some are involved in the sextortion itself.

Law enforcement and every agency named on this page charge nothing. Anybody who contacts you first, offering to make it go away for a fee, is the second approach.

The other thing is to reduce what the threat can reach. The June 2023 announcement recommends setting profiles and friends lists to private; what can be found about you is the wider version of the same check.

Common questions