Sextortion Scams Targeting Seniors: What They Are and How to Respond

An email arrives in your parent's inbox. The subject line contains a password your parent actually uses — or used to use. The body of the email claims that someone has installed spyware on their computer, recorded them watching "adult content" through their webcam, and captured their entire contacts list. The email demands payment in Bitcoin, typically between $1,000 and $2,500, within 48 hours. If they don't pay, the video will be sent to everyone they know.

This is a sextortion scam. It is not real. No video was taken. No spyware exists. But it is one of the most psychologically brutal scams in operation today, specifically because of the shame it manufactures.

Understanding exactly how this scam works — and why the password appears in the email — is the fastest way to defuse the panic it causes.

How the Scam Works

Where the Password Comes From

The scammer obtained your parent's password from a data breach database — collections of billions of stolen credentials that are bought and sold on criminal marketplaces for a few dollars. Breaches at LinkedIn, Adobe, MySpace, and hundreds of other services over the past 15 years have exposed enormous volumes of email addresses paired with passwords.

Scammers purchase these databases and write automated scripts that send personalized emails using a specific formula: start with the email address, find an associated password from the breach data, paste that password into the email to appear credible, then make the extortion demand.

The password is not evidence that spyware exists. It is evidence that a breach occurred years ago at some website. Sites like HaveIBeenPwned.com (run by security researcher Troy Hunt) allow anyone to check whether a specific email address has appeared in known breach datasets — your parent's address is almost certainly in several of them, as are most email addresses that have been active for more than five years.

The Fake Technical Claims

The email will typically include detailed-sounding technical language about the supposed infection: a "Trojan virus," a "pixel tag," a "zero-day exploit" that allowed access to the webcam and microphone. None of these details are specific to your parent's device — they are template language copied into thousands of identical emails sent simultaneously.

If the scammer had genuine spyware on a specific device, they would demonstrate it with something unique: a screenshot of a file on the desktop, a recent email received, a specific photo from the device. They never do this, because no such evidence exists.

The Bitcoin Demand

Payment is demanded in cryptocurrency, almost always Bitcoin, because:

• Bitcoin transfers are irreversible
• They are difficult to trace without specialized investigation tools
• They can be made without the sender's identity being verified

The email will include a Bitcoin wallet address and a countdown timer. The timer is fake. Paying does not guarantee the scammer won't send further demands — in fact, paying signals that the target is susceptible and can result in repeated extortion attempts.

Why Seniors Are Targeted

Older adults are targeted by sextortion at high rates for several specific reasons.

The shame factor is more powerful. Many older adults have stronger concerns about reputation and social standing — how they appear to their church, their neighbors, their adult children. The specific threat of a humiliating video being sent to a contact list is more terrifying to someone for whom community standing has been built over decades.

Lower familiarity with data breaches. A younger adult who has been told dozens of times that their data has been breached somewhere is less shocked by seeing an old password in an email. An older adult who is less plugged into cybersecurity news may not know that breach databases exist and that the password is a simple lookup, not evidence of real compromise.

Higher likelihood of the email reaching them directly. Younger adults often have spam filters and security software that catches sextortion emails before they arrive. An older adult with fewer protections in place is more likely to actually read and respond to the message.

Signs That an Email Is a Sextortion Scam

The following are near-universal features of template sextortion emails. If your parent receives an email that matches these characteristics, it is definitively a scam:

• The email mentions a password your parent recognizes but may not currently use
• The email claims to have installed a "dual camera" or "pixel" to record both the screen and webcam simultaneously
• It gives a deadline of 24 to 72 hours
• It demands payment in Bitcoin with a specific wallet address
• It threatens to send a video to "all your contacts" if payment is not received
• It claims to have access to your email, phone, and contacts list
• The writing contains minor grammatical errors or slightly awkward phrasing (a result of automated translation or template imperfection)

The email will often include this specific detail: "I sent this email from your own email address" or "I can see you read this email." Neither is meaningful — the first uses email spoofing, which is trivially easy, and the second uses a standard read-receipt pixel that cannot actually confirm the recipient's identity.

What to Do When a Parent Receives One

Step 1: Don't Pay

Paying achieves nothing except confirming that the email address belongs to a real person who responds to threats. It does not stop further emails; it encourages them.

Step 2: Don't Respond

Do not reply to the email, do not click any links in it, and do not open attachments. The email itself, in most cases, is not dangerous — it is spam. Responding or clicking confirms activity on the account.

Step 3: Explain What the Password Means

This is the single most important step for reducing your parent's distress. Show them HaveIBeenPwned.com, enter their email address, and show them the list of breaches where their data appeared. Explain: "The scammer bought your email and old password from this list. They sent the same email to millions of people. There is no video."

Seeing the breach data — a specific website name and a date from years ago — makes the scam's mechanism concrete and understandable. It removes the ambiguity that the scammer is relying on.

Step 4: Change the Referenced Password

If the password in the email is still in use anywhere, change it immediately. Use a unique, strong password for each account going forward. A password manager (1Password or Bitwarden are both appropriate for seniors) makes this sustainable.

Step 5: Report It

Report the email to:

• The FBI's Internet Crime Complaint Center at ic3.gov
• The FTC at reportfraud.ftc.gov
• Mark the email as spam/phishing in the email client to help train filters

Step 6: Check the Device if Your Parent Is Still Worried

If your parent remains anxious about the possibility that real spyware exists, the easiest reassurance is to run a malware scan with Malwarebytes (free tier available at malwarebytes.com). This will either confirm the device is clean or detect any actual threats. For most sextortion cases, the scan will come back clean, which provides concrete confirmation that the email was empty.

The Variant That Is Actually Dangerous: Image-Based Sextortion

There is a different, more serious variant of sextortion scam that requires a different response.

In this version, the scammer has obtained real intimate images — often from a romance scam, an online relationship, or a photo-sharing platform — and uses actual evidence to make the threat. This occurs less commonly with older adults but is increasing as romance scams proliferate.

If your parent:

• Has been in an online romantic relationship
• Shared personal photos or had video calls with someone they've never met in person
• Has received a sextortion threat that references specific details only a real contact would know

...then treat this as a genuine threat rather than a template email. In this case:

• Do not pay — payment almost never ends the threat
• Contact the FBI (ic3.gov) immediately; they have a specific team for sextortion cases
• Contact the National Center for Missing and Exploited Children's CyberTipline at cybertipline.org if intimate images of an adult have been shared without consent
• In the UK, contact the Revenge Porn Helpline at revengepornhelpline.org.uk

The Emotional Toll and How to Approach It

Sextortion emails are designed to produce shame, and shame is an effective silencer — many targets never tell anyone about the email precisely because they are humiliated that it found them. An older adult who receives one may be too embarrassed to mention it to their adult children.

Watch for signs that a parent has received one and is dealing with it alone: unusual anxiety, reluctance to use the computer, questions about Bitcoin ATMs or gift cards, or unusual secretiveness about emails.

If your parent discloses they received one, lead with the technical explanation, not with judgment. The email is not an indication of what the parent was doing online. It is a mass-produced scam that hit millions of inboxes. The shame it manufactures is the product — don't let the scammer win that part.

Sextortion is one of several intimidation-based scams that work by making seniors too ashamed to ask for help. The Elder Scam Shield guide covers the full range of scams that use fear and shame as levers — including tech support scams, government impersonation fraud, and grandparent scams — with scripts for raising these conversations with your parent before a scam arrives. Get the guide here.