{"id":54724,"date":"2025-11-07T09:20:37","date_gmt":"2025-11-07T14:20:37","guid":{"rendered":"https:\/\/www.kaspersky.com\/blog\/?p=54724"},"modified":"2025-11-07T09:20:37","modified_gmt":"2025-11-07T14:20:37","slug":"blackmail-and-scam-in-different-countries","status":"publish","type":"post","link":"https:\/\/www.kaspersky.com\/blog\/blackmail-and-scam-in-different-countries\/54724\/","title":{"rendered":"Email extortion: how scammers use blackmail"},"content":{"rendered":"

\u201cWe\u2019ve hacked your computer! Send money to the specified account, or all your photos will be posted online\u201d. You or someone you know has probably encountered an email with this kind of alarming message.<\/p>\n

We\u2019re here to offer some reassurance: nearly every blackmail email we\u2019ve ever seen has been a run-of-the-mill scam. Such messages, often using identical text, are sent out to a massive number of recipients. The threats described in them typically have absolutely no basis in reality. The attackers send these emails out in a \u201cspray and pray\u201d fashion to leaked email addresses, simply hoping that at least a few recipients will find the threats convincing enough to pay the \u201cransom\u201d.<\/p>\n

This article covers which types of spam emails are currently prevalent in various countries, and explains how to defend yourself against email blackmailers.<\/p>\n

Classic scams: hacks, sextortion, and \u201cyour money or your life\u201d<\/h2>\n

Classic scam emails may vary in their content, but their essence always remains the same: the blackmailer plays the role of a noble villain, allowing the victim to walk away unharmed if they transfer money (usually cryptocurrency). To make the threat more believable, attackers sometimes include some of the victim\u2019s personal data in the email, such as their full name, tax ID, phone number, or even their physical address. This doesn\u2019t mean you\u2019ve actually been hacked \u2014 more often than not, this information is sourced from leaked databases widely available on the dark web.<\/p>\n

The most popular theme among email blackmailers is a \u201chack\u201d where they claim to have gained full access to your devices and data. Within this theme, there are three common scenarios:<\/p>\n

    \n
  1. The attacker is concise and gets straight to the point: they state the exact amount of money you need to transfer to prevent your private information from becoming public.<\/li>\n
  2. Detailed and dramatic emails: these elaborate spam emails contain a wealth of detail about the malware the attacker allegedly used to infect the recipient\u2019s device, and the types of data they\u2019ve accessed. This usually includes everything at once: the PC itself, the mouse, the webcam, and the keyboard. Sometimes, the scammers even graciously advise you to change your passwords regularly and avoid clicking on unknown links in the future to prevent unpleasant situations. On this point we actually agree with their recommendations.<\/li>\n
  3. The specific details of the \u201chacker attack\u201d and the attacker\u2019s demands are omitted from the email body. Instead, the recipient is prompted to find this information by clicking a link to a website. Scammers use this tactic to bypass email spam filters.<\/li>\n<\/ol>\n

    Blackmailers also don\u2019t shy away from the topic of adult content. Typically, they simply intimidate the victim with threats that everyone will find out what kind of explicit content they\u2019ve allegedly been viewing. Some attackers go further \u2014 they claim to have gained access to the person\u2019s webcam and recorded intimate activity while simultaneously screen-recording their PC. The price of their silence starts at several hundred dollars in cryptocurrency. Crucially, these blackmailers intentionally try to isolate the victim by telling them not to report the email to law enforcement or loved ones, and claiming that doing so will immediately trigger the threats. By the way, safe and private viewing of adult content is a challenge unto itself, but we\u2019ve covered that in Watching porn safely: a guide for grown-ups<\/strong><\/a>.<\/p>\n

    \"A<\/a>

    A scammer threatens to publish a victim\u2019s intimate videos and demands cryptocurrency<\/p><\/div>\n

    Perhaps the most extreme form of email blackmail involves death threats. Naturally, such an email would make anyone uneasy, and many people become genuinely worried for their own safety. The noble hitman, however, is always willing to spare the victim\u2019s life if they can \u201coutbid the one who ordered the hit\u201d.<\/p>\n

    \"Email<\/a>

    \u201cYou have 72 hours left to live.\u201d The blackmailer suggests not involving the police and simply paying off \u201cthe one who ordered the hit\u201d instead<\/p><\/div>\n

    You\u2019ve been served: law enforcement impersonation scams in Europe<\/h2>\n

    Besides legends of \u201cnoble hackers\u201d and \u201chitmen\u201d who immediately offer a way out for a hefty fee, there are longer, more elaborate scams.<\/p>\n

    In these attacks, scammers pose as law enforcement officers. They don\u2019t ask for money right away, as that would arouse suspicion. Instead, the victim receives a \u201csummons\u201d accusing them of committing a serious, often highly delicate crime. This typically involves allegations of distributing pornography (including child pornography), of pedophilia, human trafficking, or even indecent exposure. The \u201cevidence\u201d isn\u2019t pulled out of thin air, but supposedly taken directly from the victim\u2019s computer, to which the \u201cspecial services\u201d have gained \u201cremote access\u201d.<\/p>\n

    \"Spam<\/a>

    Spam blackmail targeting users in France<\/p><\/div>\n

    The document is designed to instill absolute terror: it includes a threat of arrest and a large fine, a signature with a seal, an official address, and names of high-ranking prosecutors. The scammers demand that the victim promptly makes contact via the email address provided in the message to offer an explanation \u2014 then, perhaps, the charges will be dropped. If the victim fails to respond, they\u2019re threatened with arrest, registration on a list of sex offenders, and having their \u201cfile\u201d passed to the media.<\/p>\n

    When the terrified victim contacts the attackers, the scammers then offer to \u201cpay a fine\u201d for an \u201cout-of-court settlement of the criminal case\u201d \u2014 a case that, of course, doesn\u2019t exist.<\/p>\n

    \"Scammers<\/a>

    Scammers once again accuse victims of viewing child pornography<\/p><\/div>\n

    These types of emails are sent under the guise of coming from major law enforcement organizations like Europol. They\u2019re most frequently addressed to residents of France, Spain, the Czech Republic, Portugal, and other European countries. They also share a curious feature: typically, the subject line and the body of the email are quite brief, with the entire fraudulent case being laid out in attached documents. Reminder: we can\u2019t stress this enough \u2014 never open email attachments if you don\u2019t know or trust the sender! And to ensure that malicious and phishing emails don\u2019t even reach your inbox, use a reliable protective solution<\/a>.<\/p>\n

    Authority scams in CIS countries<\/h2>\n

    The \u201claw enforcement theme\u201d is also prevalent in CIS (former-Soviet-Union) countries. In 2025, scammers circulated \u201cSummons for Criminal Investigation\u201d alleging the initiation of a criminal case. This was supposedly issued by the Russian Ministry of Internal Affairs in collaboration with such fantastic units as \u201cRussian Interpol\u201d and the \u201cBureau of Investigation Against Organized Crime\u201d.<\/p>\n

    According to the fictional narrative, a certain \u201cNational Center for the Analysis of Child Pornography and Exhibitionism Images\u201d had seized computers somewhere and determined that the recipient\u2019s IP address was used to \u201caccess inappropriate and pornographic websites\u201d. Of course, a quick online search will reveal that none of the organizations mentioned in that email have ever officially existed in Russia.<\/p>\n

    \"Scam<\/a>

    The \u201cDirector of the Police Criminal Investigation Department\u201d will, for added persuasiveness, write in ALL CAPS, and sign their name with an English transliteration<\/p><\/div>\n

    In another similar email, the recipient, at the behest of the head of the \u201cRussian Federal Bureau of Investigation (FBI)\u201d, supposedly became a person of interest to a certain \u201cInternational Criminal Police Organization \u2014 Interpol of the Federal Police of Russia\u201d. (We should clarify that no law enforcement agencies with even remotely similar names have ever existed in Russia.) In the email, the attackers refer to a \u201cCybercrime Act in accordance with the Crimes Act of 1900 (sic!) from 245RU(2)\u201d \u2014 laws so secret that apparently no legal expert knows they exist. Moreover, the message, sent from a generic Gmail address, is supposedly from the Minister of Internal Affairs himself. However, in the attached summons, he is referred to as the \u201cCommissioner of the Federal Police of the Russian Federation\u201d \u2014 likely a clumsy translation from English.<\/p>\n

    \"Another<\/a>

    The scam email from the non-existent \u201cRussian Federal Bureau of Investigation\u201d is signed by none other than the Minister of Internal Affairs<\/p><\/div>\n

    Similar scam emails also reach residents of Belarus, arriving in both Russian and Belarusian. The victims are supposedly being pursued by multiple agencies simultaneously: the Ministry of Internal Affairs and Ministry of Foreign Affairs of Belarus, the Militsiya of the Republic of Belarus, and a certain \u201cMain Directorate for Combating Cybercrime of the Minsk City Internal Affairs Directorate for Interpol in Belarus\u201d. One might assume that the email recipient is the country\u2019s most wanted villain, being hunted by the \u201ccyberpolice\u201d itself.<\/p>\n

    In the summons, the blackmailers cite non-existent laws, and threaten to add the victim to a fictitious \u201cNational Register of Underage (sic!) Sexual Offenders\u201d \u2014 a clear machine translation failure \u2014 and, of course, request an urgent reply to the email.<\/p>\n

    \"An<\/a>

    An email from the non-existent cyberpolice of Belarus<\/p><\/div>\n

    In another campaign, attackers sent emails in the name of the real State Security Committee of Belarus. However, they referenced a fake law and contacted the accused at the behest of the President of Europol \u2014 never mind that Europol doesn\u2019t have a President, and the name of the real executive director is completely different.<\/p>\n

    \"Another<\/a>

    Another scam campaign in Belarusian<\/p><\/div>\n

    In addition to sex crimes, citizens of Belarus are also accused of \u201crepeated use of necrotic (sic!) and psychotropic drugs\u201d. In these emails, the attackers claim to be from the DEA \u2014 the U.S. Drug Enforcement Administration<\/a>. Why a U.S. federal agency would be interested in Belarusian citizens remains a mystery.<\/p>\n

    \"Yet<\/a>

    The scammers failed to realize that the law enforcement body in Belarus is called the \u201cmilitsya\u201d (militia) rather than \u201cpolitsya\u201d (police)<\/p><\/div>\n

    Identifying scam emails<\/h2>\n

    As you can see from the examples above, the majority of these scam emails appear highly implausible \u2014 and yet they still find victims. That said, with scammers increasingly adopting AI tools, it\u2019s reasonable to expect a significant improvement in both the text quality and design of these fraudulent campaigns. Let\u2019s highlight several indicators that will help you recognize even the most skillfully crafted fakes.<\/p>\n