Hacker Extortion Email Scam: I Got One, So I Investigated
Someone claims they've hacked your computer, accessed your webcam, stolen your personal information, and recorded embarrassing videos. Now they're demanding thousands of dollars in Bitcoin. I recently received a hacker extortion email scam threatening to expose embarrassing videos unless I paid $2,330 in Bitcoin.
Sound familiar?
These threatening emails are circulating, and they're designed to make you panic before you have a chance to think.
Recently, one of these messages landed in my own business inbox at NPS Design Studio. The sender claimed to have accessed my email, installed malware on my devices, and collected private information. They demanded $2,330 in Bitcoin and gave me less than 50 hours to pay.
There were just a couple of problems with their plan.
First, I don't own Bitcoin.
Second, I haven't dated in awhile. So the idea that someone had secretly recorded all sorts of scandalous activity was pretty amusing. If they've got exciting footage of my life, I'd be curious to see it myself!
The truth is, I wasn't particularly worried. I've been working with websites and digital technology for decades, and I've always taken security seriously. My accounts already had important protections in place, and the email had all the hallmarks of a scam.
But I was curious.
What if one of my clients received this same email? Would they recognize it as a scam, or would they panic?
So instead of deleting it, I decided to investigate. And what we uncovered is something every business owner should understand.
Before we get into it, you'll see a few technical terms like SPF, DKIM, DMARC, and DNSSEC. Don't worry if they sound like alphabet soup. I'll explain what they mean in plain English as we go.
First, What Is a Sextortion Email Scam?
Sextortion email scams are a form of online extortion in which criminals claim to possess intimate images, videos, or other embarrassing information about you.
They often claim they've:
Hacked your email account or computer.
Installed spyware or a Trojan virus.
Activated your webcam and microphone.
Recorded your internet activity.
Stolen your personal contacts and information.
Prepared embarrassing material to send to your family, friends, or coworkers.
Then comes the demand: Pay a ransom, usually in cryptocurrency, or they'll release everything.
In many mass-email scams, these claims are completely fabricated.
The attackers rely on fear, embarrassment, and urgency to convince recipients to pay without investigating.
This type of message is often part of a larger phishing campaign.
What's a phishing campaign?
Phishing is when criminals use deceptive emails, text messages, or websites to trick people into sharing information, sending money, or giving access to accounts.
A phishing campaign simply means the criminals are targeting multiple people, often sending hundreds or thousands of similar messages rather than targeting one specific person.
However, genuine account compromises and extortion attempts also occur, so suspicious messages should be evaluated rather than automatically dismissed.
But the Email Came From My Own Address!
Here's where things get interesting.
The threatening email appeared to come from the exact same business email address it was sent to. At first glance, that might seem convincing. After all, how could someone send an email from your address without having access to your account?
The answer is email spoofing.
Email spoofing allows someone to manipulate the sender information so a message appears to originate from an address or domain they don't control. It's similar to receiving a telephone call where the caller ID displays a familiar number, even though the call came from somewhere else.
And that's exactly the kind of deception we found when examining my message.
Investigating a Hacker Extortion Email Scam
My old business email address is configured to forward incoming messages through GoDaddy, my domain registrar and email forwarding provider, to my current business inbox.
What's a domain registrar?
A domain registrar is the company where you register and manage your website's domain name, such as yourbusiness.com.
Companies like GoDaddy help you manage domain ownership, renewals, and other settings. They may also provide additional services such as website hosting, DNS management, and email forwarding.
Think of your domain name as your business's street address on the internet. Your registrar helps you maintain control of that address. By examining the original email headers and reviewing my domain settings, we identified some important clues.
1. The original message failed email authentication checks.
The original sending server failed SPF and DMARC checks, which strongly supported the conclusion that someone was impersonating my email address.
What are email authentication checks?
They're security tests that email providers use to help determine whether a message was sent by an authorized sender. Think of them as an electronic ID check for incoming email.
These checks help identify suspicious messages, but they aren't foolproof. I'll explain SPF, DKIM, and DMARC individually in a moment.
2. The message traveled through unrelated email infrastructure.
The technical headers showed that the message originated outside my normal email setup.
What is email infrastructure?
It's simply the network of servers and services responsible for sending, receiving, filtering, and delivering email. When you send a message, it doesn't magically jump from your computer into someone else's inbox. Email servers handle the delivery, and those servers can leave a technical trail.
That trail helped us understand where this particular message came from.
3. GoDaddy forwarded the message to my actual inbox.
Because my old email address is still active as a forwarding address, GoDaddy delivered the message to my current email.
The forwarding service also applied its own authentication signatures. That explains why Gmail displayed the message as signed by my domain even though the original message failed authentication.
In plain English, the email appeared more legitimate after passing through the forwarding service, even though the original sender wasn't properly authenticated.
A valid signature from a forwarding service does not necessarily mean the original sender was legitimate.
4. We found no evidence supporting the attacker's claims.
There was no proof of stolen files, camera access, installed spyware, or unauthorized account access. The evidence pointed toward a familiar email spoofing and extortion campaign.
Of course, reviewing an email's technical information isn't the same as conducting a full forensic examination of a computer. But nothing we found supported the attacker's story.
5. My existing security protections were already in place.
This was particularly reassuring.
When we reviewed the domain, we confirmed that it already had SPF, DKIM, and DMARC configured, including a strict DMARC rejection policy.
My GoDaddy account also had two-factor authentication enabled, Domain Lock was turned on, and my forwarding settings were correct.
What is two-factor authentication?
Two-factor authentication, often called 2FA, adds a second step when signing into an account. Instead of relying only on a password, you also confirm your identity through something like an authenticator app or security key.
Think of it as having two locks on your front door instead of one.
Even if someone steals your password, they still have another security requirement to get past. It's one of the most valuable protections you can enable for your business accounts.
In other words, this wasn't a situation where I suddenly realized I'd neglected security.
I'd already taken precautions long before this email arrived.
But our investigation revealed one additional protection I could enable.
6. We added DNSSEC as another layer of protection.
DNSSEC stands for Domain Name System Security Extensions.
Yes, another acronym!
What is DNSSEC, and why does it matter?
When someone enters a website address, the Domain Name System (DNS) helps their device find the correct server. Think of DNS as the internet's address book.
DNSSEC adds a way to verify that certain DNS responses are authentic and haven't been tampered with. It can help protect against attacks that try to redirect visitors to the wrong website by providing forged DNS information. My domain provider offered managed DNSSEC, so I enabled it.
DNSSEC doesn't prevent sextortion scams or email spoofing directly. It protects a different part of the domain infrastructure. But that was the point.
Even when your existing security is in good shape, there's often something you can improve.
What Are SPF, DKIM, and DMARC?
Now, let's revisit those three confusing acronyms.
These technologies work together to help protect businesses against email impersonation.
SPF — Sender Policy Framework
SPF identifies which mail servers are authorized to send email on behalf of your domain.
Think of it as a guest list. If an email comes from a server that isn't on the approved list, receiving systems can flag that as suspicious.
DKIM — DomainKeys Identified Mail
DKIM attaches a cryptographic signature to email messages.
Think of it as a tamper-evident digital seal that helps confirm the message was signed by a domain and hasn't been altered in ways covered by the signature.
DMARC — Domain-based Message Authentication, Reporting & Conformance
DMARC uses SPF and DKIM results, along with checks that the authenticated domains align with the visible sender's domain, to help identify impersonation. It also lets domain owners tell receiving servers what to do with messages that fail these checks.
For example, a DMARC policy can ask receiving servers to reject suspicious messages rather than deliver them.
Together, these technologies make it harder for criminals to impersonate your business domain. They're particularly important if your business uses professional email addresses, email marketing platforms, online forms, or customer communications.
One important thing to remember:
Even properly configured SPF, DKIM, and DMARC cannot guarantee that every fraudulent email will be blocked. Email forwarding, provider configurations, and attackers using other legitimate domains can complicate detection.
That's why good technical protection and employee awareness need to work together.
What Should You Do If You Receive a Threatening Email?
Don't pay the ransom. Sending cryptocurrency doesn't guarantee that an attacker will delete anything or stop contacting you.
Don't reply. Responding can confirm that your address is active.
Don't click suspicious links or open unexpected attachments. If the message includes them, avoid interacting with them.
Check your account security. Review recent sign-ins, unfamiliar devices, forwarding rules, and connected applications. Enable two-factor authentication wherever possible.
If you're comfortable using AI tools, they can help you understand unfamiliar technical terms or evaluate suspicious wording. Just remember that AI isn't a substitute for a cybersecurity professional, and you should avoid sharing passwords or sensitive personal information.
Look for actual evidence. Generic threats aren't proof of a hack. If the sender includes genuine private information, recent screenshots, or other credible evidence, investigate further.
Report the message. Both Gmail and Microsoft Outlook offer features for reporting suspicious emails. Here's how.
How to Report a Phishing Email in Gmail
If you use Gmail on a computer:
Open Gmail and locate the suspicious message.
Open the email, but don't click any links or download attachments.
Find the three vertical dots (More) near the Reply button in the message.
Click Report phishing.
Follow any confirmation prompts Gmail displays.
Reporting suspicious messages helps Google identify potential threats and improve its filtering systems.
For additional guidance, visit Google's official phishing help page.
How to Report a Phishing Email in Microsoft Outlook
If you use Outlook.com, Outlook on the web, or the new Outlook desktop application:
Open Outlook and select the suspicious email.
Look for Report in the toolbar above the message or in the message's options menu.
Select Report phishing.
Confirm the report if prompted.
If you're using classic Outlook on your computer, look for the Report or Report Message option on the ribbon. Depending on your version and your organization's settings, you may see a separate phishing-reporting command or add-in.
Using Outlook on your phone?
Open the suspicious message in the Outlook mobile app.
Tap the three dots near the top of the message.
Select Report Junk or Report, depending on the version.
Choose Phishing and confirm.
The exact buttons may vary depending on your Outlook version and whether your email is managed by your employer.
For more information, visit Microsoft's official Outlook phishing guidance.
Should You Report the Email Anywhere Else?
If the threat appears credible or involves actual extortion, you can also submit a report to the FBI's Internet Crime Complaint Center at IC3.gov.
Ask a qualified professional to review it if you're unsure. Email headers and authentication records can often reveal whether someone is impersonating your domain.
Could This Happen to Your Business?
Absolutely.
Business email addresses are frequently published on websites, social media pages, business directories, and online listings. That makes them easy targets for automated phishing campaigns.
And the risk isn't limited to embarrassing scam emails. Other forms of impersonation can involve fake invoices, fraudulent payment instructions, password-reset scams, and messages pretending to come from company executives.
These attacks can cause real financial damage if someone trusts a forged message.
How NPS Design Studio Can Help
At NPS Design Studio, we believe website and digital security should be understandable, practical, and proactive. We help businesses strengthen their online presence through website management, technical SEO, analytics, and digital infrastructure reviews.
For email and domain-related concerns, we can help review and set up:
Public DNS and domain configurations.
SPF, DKIM, and DMARC records.
Domain forwarding and email authentication settings.
Website and domain security considerations.
Suspicious email headers and potential impersonation attempts.
When an issue requires specialized incident response or forensic investigation, we recommend involving an appropriate cybersecurity professional.
Don't Let a Scammer Scare You Into Paying.
I investigated this email because I wanted to understand exactly what happened, even though I was already confident it was a scam. And while the investigation confirmed that the message was almost certainly fraudulent, it also gave me an opportunity to strengthen an already well-protected domain.
That's the approach I believe every business should take.
Be prepared. Stay informed. And keep improving.
If you've received a suspicious email or aren't sure whether your business domain is properly protected, contact NPS Design Studio.
We'll help you understand what you're looking at, what can be verified, and what steps make sense for your business.
NPS Design Studio — Strategic Digital Design & Web Consulting.
Comments