How to Report Email Blackmail

Alerting Law Enforcement

Save the original email correspondence for the police. The original email has information in the header that law enforcement can potentially use to track down the person who sent it. For this reason, they need the actual digital file, not a screenshot or print-out. If you got more than one email from the same individual, save all of them.

Contact your local police to report the blackmail. Blackmail and extortion are crimes, so you can file a police report with your local police department. Call the non-emergency number or go to the precinct in person. Don't call an emergency number regarding email blackmail unless you know the person who sent the email and are concerned for your immediate personal safety. If you have a smartphone, show them the email on your smartphone. They may ask you to forward it to a police email address for further evaluation. When you file your police report, insist on getting a written copy of the report. You may have to go back to the precinct the next day to pick it up. Don't expect local police to do much more than take your report. Most local police departments aren't equipped to investigate internet crime unless you know the sender and they're also local.Tip: Some local police departments accept online reports. Check on your local police department's website. If offered, this is typically the most convenient way to report email blackmail.

File a report with federal law enforcement. Your national or federal law enforcement agency typically has more robust resources to go after internet crime than your local police department. Usually, you can file your complaint online. They may not pursue individual cases, but the information you provide can help them track down online fraudsters. Use your favorite search engine to search for the name of your country and the words "report internet crime" or "report internet fraud." Look for an official government site that accepts reports. In the US, you can report email blackmail to the FBI's Internet Crime Complaint Center at https://www.ic3.gov/complaint/default.aspx. If you live in Europe, visit https://www.europol.europa.eu/report-a-crime/report-cybercrime-online to find the link for your country's reporting website.

Responding to the Threat

Take a deep breath and avoid panicking. Getting a blackmail email can be terrifying, especially if they seem to have information about you that you know to be accurate. However, keep in mind that they probably don't have all the information they claim they do. You're looking at a mass-produced email that was sent to thousands of people — it just happens to have your email and perhaps some personal details gleaned from a data breach. The email may claim that your system has been infected with spyware or malware so the blackmailer can spy on you and track your online activities. This is not likely to be the case. Take note of any personal information included in the email, such as a password or username, that happens to be correct. You'll want to do what you can to change those.

Avoid replying to the email and block the scammer. Mark the email as spam and block the email address that sent the email. That way, you likely won't get any further emails from them. If you have additional email addresses, you may want to block the address on those as well, just in case. Resist the urge to respond to the email, even if you're simply tempted to engage with the blackmailer and try to waste their time. You're better off not spending any of your own time messing with them. Do not pay the blackmailer money under any circumstances.

Change the password included in the blackmail email if there was one. If the blackmail email includes your password, and it happens to be correct, change it immediately. If you happen to use the same password for any other websites or accounts, change it there too. You may not be able to change your username if that was included in the email. However, you may be able to change the email address associated with that account. Do whatever you can to change the profile of the account mentioned in the blackmail email so that the blackmailer can't find that account again if they try.Tip: Avoid re-using the same password for multiple accounts, even if you think there's nothing important on a particular account. You'd be surprised how much information about you someone can get if they only have access.

Report the blackmail attempt to any company mentioned in the email. If the blackmail email refers to your account information on a particular website, look up the customer service number for that website. Call and let them know about the blackmail email so they can take steps to warn other customers of the potential threat. If the company had a data breach, they may not be aware of it yet. Alerting them to the email gives them the opportunity to take protective measures to secure their customers' information. If the company already knows about the data breach, they may be able to give you additional information or assistance that can help you keep your information safe.

Deactivate your social media profiles temporarily. If the scammer can view or access your social media profiles, they'll know who your friends and family are. If you fail to respond appropriately to the blackmail email, they may start harassing your friends and family as well. Even though it's unlikely that they have anything on you that they could use against you, assume it's possible that they do. Deactivating your social media profiles means they won't have any way to contact your friends and family. Let your friends and family know about the email. You don't have to go into detail about the subject matter if you find it embarrassing or shameful. Simply say that you were the victim of a data breach and you're trying to prevent further damage until the situation is resolved.

Find out if you've been compromised in any major data leaks. Even if there was no specific website mentioned in the email, it's still likely that the blackmailer got your personal information, including your name and email address, through a data leak. Enter your email address at https://haveibeenpwned.com/ to find out if you have an account that's been compromised. Regardless of the information on the email, change your passwords and other information for any account that comes up attached to your email that was compromised in a data breach.

Check your computer for malware. Often, blackmailers will claim that they've installed malware or spyware on your computer to track your online activities or film you through your webcam while you're using your computer. Usually, these claims are false. However, it's still good practice to run a malware scan. Your computer's antivirus software should be able to run a malware scan. You can also use online services, some of which are free. However, check the credentials carefully — some sites that claim to check your computer for malware actually install malware themselves. Some malware programs only detect the malware but don't remove it. Make sure you use a program that will remove the files completely rather than simply quarantining them. The best programs will give you a free trial and charge a yearly or monthly subscription after that.

Protecting Your Data

Set unique passwords through your browser's password manager. To keep your account information secure, avoid reusing passwords on multiple sites. That way, if one site is compromised, you don't run the risk of having other accounts compromised as well. Your browser's password manager can set complex and unique passwords for all of your accounts. Because your passwords are saved in an encrypted file, you don't have to worry about hackers gaining access to the passwords themselves. If your information is compromised in a data breach, you only have to worry about changing one password. The rest of your information should be secure. With most browsers, the password manager is automatically enabled. When you are on a screen to set a password, a dialog box will appear to ask you if you want to use a smart password or something similar. Click yes and your new password will be stored in the browser's password manager. If this box doesn't appear, check the settings on your browser to enable the password manager.Tip: When you use a password manager, you don't have to worry about remembering the password because the password manager will auto-fill it for you. Just make sure you have a strong password on your computer.

Enable two-factor authentication on sites that offer it. With two-factor authentication, the website sends a code using email or text that you have to enter before you can gain access to your account. This ensures that no one else can access your account, even if they have your username and password. Each site has a slightly different process. Log into your account and access the security features to find out if two-factor authentication is available. Then you'll choose whether you want to receive your code through text or email. Text is typically more secure because if someone else had access to your email, they could also get the code. With text, on the other hand, they'd need to have physical control of your actual phone.

Keep your antivirus software up to date. If hackers or blackmailers try to install spyware or malware on your system, your antivirus software will typically catch it and block it or remove it. However, you have to install the updates regularly so your antivirus software recognizes the latest bugs. Set up automatic updates so you don't have to worry about whether your antivirus software is up to date. Then the updates will automatically run and install the next time you turn your computer on.

Turn off your computer when you're not using it. Leaving your computer on leaves it open to hackers and makes it more likely that someone will try to infect it with malicious spyware. Shutting it down completely takes it off the internet and keeps others from accessing it. If you have your own WiFi network, make sure it has a secure password. It's a good idea to change that password at least once or twice a year. You might also shut down your network while you're sleeping.

Enter personal information only on secure sites. If a site is secure, the address will start "https" rather than "http." With most browsers, you'll also see a lock icon in the address bar. This tells you that the site is secure. If these features aren't present on the address bar, don't enter any payment information. It may be vulnerable to hackers. You should also avoid entering personal details, such as your full name and address. Be wary of social media quizzes that require you to provide a lot of personal information. Many of these are data-mining apps that will sell your information to hackers.