Lorraine Williamson
Spain’s cybersecurity institute, INCIBE, has issued a high-priority warning over a mass sextortion email scam designed to frighten people into paying hundreds of dollars in Bitcoin. The alert, published on Tuesday, says the messages falsely claim that hackers have infected the victim’s device, recorded intimate videos through the webcam, and are ready to send them to friends, family, or work contacts unless a payment is made within 48 to 50 hours.
INCIBE says the campaign is fraudulent and that the blackmail is based on fear, pressure and empty threats rather than genuine access to compromising material. According to the official alert, scammers are demanding between $750 and $950 in Bitcoin while pretending they have installed invisible spyware and taken control of the victim’s camera and device. In reality, the institute says the supposed surveillance is fictitious, and the emails are part of an automated extortion scam.
What the scam claims
The messages are designed to look alarming from the start. Some use subject lines suggesting that personal data has been leaked, that payment is pending, or that the email is a formal notification. Others may appear to come from anonymous or generic addresses, or even use spoofing techniques to make it look as though the email was sent from the recipient’s own account.
Once opened, the email typically claims that the attacker has already compromised the victim’s device and secretly recorded explicit videos. It then demands urgent payment in cryptocurrency, usually within two days, and warns that going to the police or telling anyone will make things worse. That combination of urgency, shame and isolation is central to the scam’s design.
Why INCIBE says the threat is fake
The institute’s analysis says these emails rely on generic scripts, often built on old data leaks, rather than any real proof of hacking. One of the clearest warning signs is that the scammers do not attach screenshots, still images or any genuine evidence that they have compromising content. INCIBE says that if criminals truly had access to intimate footage or contact lists, they would usually include convincing proof rather than vague threats.
The technical story in the emails also does not stand up well. INCIBE notes that claims about “undetectable” spyware and invisible real-time webcam recording are part of the fiction used to panic victims. It also points out the contradiction at the heart of the scam: someone claiming full access to a victim’s device and accounts would hardly need to ask for a relatively modest ransom by email.
Why Bitcoin is part of the scam
The demand for Bitcoin is another major red flag. INCIBE says scammers choose cryptocurrency because transfers are difficult to reverse and much harder for authorities to trace than standard bank movements. That makes it the preferred payment route for many extortion and fraud campaigns.
For victims, that creates a dangerous trap. Once a payment is made, there is no guarantee the messages will stop. In fact, replying or paying may simply confirm that the email account is active and that the person behind it is vulnerable to pressure, increasing the risk of follow-up fraud attempts.
What to do if you receive one
INCIBE’s advice is blunt: do not pay and do not reply. If you receive the email but have not acted on it, the agency recommends reporting it through its incident mailbox, blocking the sender and deleting the message from your inbox. It also says anyone in doubt can contact its cybersecurity helpline on 017, where specialists can explain what to do next.
If someone has already paid, INCIBE says they should gather and preserve as much evidence as possible, including emails, payment screenshots and any communication with the scammers. It also recommends using online evidence witnesses where appropriate and taking all available material to the police when filing a report. Victims who are worried that images or videos may have been published are advised to search for signs of that content online and, if necessary, ask for removal using their right to erasure.
A scam built on panic, not proof
This kind of fraud is not new, but its continued success lies in something very simple: it hits people at the point where embarrassment and fear override reason. The idea that a device camera could have been activated without permission is unsettling enough on its own. Add threats about family, co-workers or friends seeing intimate content, plus a ticking clock and an anonymous demand for money, and many people can panic before they stop to question whether any evidence has actually been shown. This is an inference based on INCIBE’s description of the scam’s pressure tactics.
That is why official warnings like this matter. INCIBE is not just flagging another spam email. It is identifying a campaign designed to manipulate people psychologically and extract money through shame and urgency. In most cases, the strongest defence is not advanced technical knowledge but recognising the pattern before fear takes over.
Why this warning matters now
The alert arrives at a time when email fraud is becoming more polished, more automated and more emotionally targeted. Rather than relying only on fake bank messages or parcel scams, cybercriminals are increasingly using blackmail themes that feel personal and invasive, even when they are entirely fabricated. That makes this type of warning especially relevant to ordinary users, not just businesses or people with specialist knowledge. This broader observation is an inference supported by the nature of the campaign described in INCIBE’s alert.
For readers in Spain, the message is clear. If an email claims you have been watched through your camera, demands Bitcoin and gives you 48 hours to pay, assume it is a scam unless proven otherwise. The goal is not to expose a real secret but to make you believe you are out of time. INCIBE’s latest alert is a reminder that, in cases like this, staying calm is the first layer of protection.