Sextortion: the first hours when someone demands money for your intimate images

01The first hour

The demand is built to make you act in minutes. The opposite works, and none of it requires you to answer another message.

02Why paying does not end it

The FBI, in guidance of 22 January 2024, states: Do not send any money or additional content to the blackmailer. In its joint statement of 7 February 2023 with the RCMP, the UK National Crime Agency and NCMEC, it notes that the predator often releases the images anyway.

Australia's eSafety Commissioner tells anyone being blackmailed not to pay or give the blackmailer more money or intimate content, and to stop all contact.

03How the scheme is built

The FBI describes offenders posing as girls of a similar age on platforms the targets already use, asking for gift cards, wire transfers or cryptocurrency, and usually based abroad.

The threat rests on one asset: the visible list of people connected to you.

04Capturing evidence

1. Screenshot the profile: name, handle, photograph, follower counts, URL.
2. Screenshot the conversation in sequence with timestamps, uncropped.
3. Record the wallet address or payment handle and the amount demanded.
4. Note the platforms and times of first contact, the call and the demand.

Australia's ReportCyber process, which Victoria Police directs the public to, asks people to keep screenshots, emails and chat logs and to supply names, numbers, bank details and account names.

05Securing the lists

The threat is credible only while the offender can see who your people are. Treat the lists, not the passwords, as the first job.

• Set friend, follower and following lists to private.
• Turn off contact sync and being found by number or email.
• Remove public phone number and workplace fields.
• Enable two-factor authentication; review devices.

Do not delete your accounts: that destroys your evidence and your view of what gets posted, while the offender keeps every copy.

06Where to report

A report creates a dated official record and puts the payment channel into a system that sees the same account in other cases. One route changed recently, so check the table, not an older article.

In the UK the threat alone is an offence: section 66B of the Sexual Offences Act 2003, inserted on 31 January 2024 by the Online Safety Act 2023, covers threatening to share an intimate image.

07Blocking images before publication

Hashing is the only step that acts before publication: software on your device turns the file into a digital fingerprint and sends only that string. StopNCII.org, run by the Revenge Porn Helpline, part of the UK charity SWGfL, states that it does not download the images from your device.

Take It Down states two limits: it works only on platforms that have agreed to participate, and they may have limited ability to remove content already posted.

08If material is published

The order becomes: the platform's non-consensual imagery flow, then the hash, then every URL recorded with date and time, then the official report.

In the United States the TAKE IT DOWN Act, signed 19 May 2025, requires covered platforms to offer a removal request process and to remove the content and known identical copies within 48 hours. The FTC began enforcing that section on 19 May 2026.

In Australia, report to eSafety immediately if you are not being blackmailed, or use the illegal content route if you are. In the EU the Digital Services Act has applied to all platforms since 17 February 2024.

09If the person is under 18

• Use Take It Down where the image was taken before 18: free, anonymous, only the hash is sent.
• Report to the NCMEC CyberTipline, the centralised US system for online exploitation of children; a young person can self-report.
• In Australia report to the ACCCE; in the UK and EU, to police as urgent.

Between October 2021 and March 2023 the FBI and Homeland Security Investigations received over 13,000 reports of financial sextortion of minors, involving at least 12,600 victims. The FBI is explicit that the offender is to blame.

10Tracing, and the months after

The FBI states that offenders in financially motivated sextortion are usually outside the victim's country, so a cross-border case rarely produces a quickly identified individual. Europol routes people to national police.

• Search your name, handle and any nickname used in the chat periodically.
• Leave hash submissions in place once things go quiet.
• Keep the evidence folder while any report is open.
• On a new site, record the URL and date before anything else.

SARAZIM LLC works through this sequence with clients and handles the monitoring and repeat removal requests that follow.