Sextortion Scams: What to Do in the First 24 Hours

Sextortion scams operate on a compressed timeline. Attackers give short deadlines, apply immediate pressure, and rely on victims making decisions under stress that would look obviously wrong given a few hours of calm. The entire scheme depends on you moving fast, sending money or more images before you have time to think clearly or talk to anyone. Once you understand that the urgency itself is a manufactured tool rather than a real emergency, the whole situation becomes much easier to navigate. The single most useful thing you can do in the first 24 hours is refuse to move at the attacker's pace. This guide covers exactly what to do, in order, in the specific windows where each action matters most, from the first hour of a sextortion scam through the first day, so you always know what comes next instead of guessing under pressure, and so every decision you make works in your favor rather than the attacker's.

Understand How Sextortion Scams Work

Almost all sextortion scams share a common structure regardless of platform or origin. Recognizing the pattern is what allows you to move slowly and correctly.

Phase one is contact and rapport, often days or weeks of friendly conversation on Instagram, dating apps, or gaming platforms. Phase two is the extraction, a video call or image exchange that produces the material the attacker will later use as leverage. Phase three is the threat, which usually arrives within hours of extraction.

Attackers depend on victim panic to make this work. Fast response means less time to think, less time to consult a trusted person, and less time to preserve evidence properly, which is exactly why every attacker instruction includes a deadline. This is precisely why slowing down works in your favor: refusing to engage on the attacker's timeline and taking time to preserve evidence dramatically improve outcomes. Cases handled over 24 hours with proper documentation resolve at much higher rates than cases handled in the first two hours of panic. Understanding this frame is the first step to a correct stop sextortion response.

Immediate Response in the First Hour

The first hour is about preservation and control, not decision-making. Whatever the attacker is threatening can wait long enough for you to do three things right, in order, before you react to anything they've said.

Do Not Pay

Payment is treated as confirmation that the target is viable. A single payment typically produces additional demands, and paying victims are added to lists resold to other operators, which means the pressure often gets worse, not better, once you've paid once. Non-payment is the strongest possible signal you can send, even if it doesn't feel that way in the moment.

Do Not Delete or Block Yet

Blocking the attacker before preserving evidence destroys message history on many messaging apps. Deletion is worse, even a screenshot may be needed to prove content and demands later, whether to a platform, the police, or a specialist team helping you. Preserve first, contain second; the order matters more than the speed.

Screenshot Every Message and Profile

Screenshot every threat, the attacker's profile page, any wallet addresses or payment demands, and any timestamps visible in the conversation. Photograph the screen with a second device for critical evidence, this creates a version that survives account issues later, such as the attacker deleting their account or the platform removing the conversation during an investigation.

In the Next Six Hours: Contain and Report

Once evidence is preserved, contain the exposure and start the reporting chain. Block the attacker on every platform where contact has occurred, and assume they will attempt re-contact from new accounts; be prepared to block those too. If the report later needs a local record, for content removal, insurance, or any civil action, filing with your local police and getting a case number matters even when they cannot directly investigate a foreign-origin case.

File With FBI IC3

The FBI Internet Crime Complaint Center accepts sextortion complaints and coordinates with international partners for cross-border cases. File within the first day, evidence quality and case priority both benefit from rapid filing. Include screenshots, payment demand details, and the attacker's profile information across every platform.

For Minors: CyberTipline

If the victim is a minor, the CyberTipline operated by the National Center for Missing & Exploited Children provides specialized response for child sextortion cases. This should be the first call for any case involving anyone under 18; minor sextortion cases carry their own specific considerations around parental involvement and long-term recovery that this urgent-response guide doesn't fully cover.

In the First 24 Hours: Secure and Prepare Removal

The rest of the first day is about hardening your accounts and preparing content removal in case distribution begins. If contact occurred on a specific account, treat that account as compromised: rotate the password, review linked devices, enable two-factor authentication, and check activity logs for unauthorized access. At the same time, lock down privacy across Instagram, Facebook, LinkedIn, and TikTok, since attackers use publicly visible friends lists, followers, and tagged photos to construct threat lists, and removing those lists from view reduces distribution capability. It also helps to search your own name and any usernames tied to the incident, so you know exactly what a stranger could already find before the attacker does anything further.

Even if distribution has not started, prepare the removal workflow. Submit hashes to StopNCII proactively; the hash-blocking system prevents matching uploads on partner platforms including Meta, TikTok, Bumble, and Reddit before distribution begins. This step costs nothing and takes only a few minutes, which makes it one of the easiest actions in this entire guide to complete immediately. Coordinating the removal workflow across every platform where content could realistically appear matters more than focusing only on the one the threat originated on, since attackers frequently spread material, or threaten to, well beyond the app where the conversation started.

Long-Term Recovery and Protection

Isolation is the attacker's primary psychological weapon, so talking to a spouse, close friend, licensed counselor, or specialist team removes most of that leverage; victims consistently report that revealing the situation on their own terms neutralized most of the threat. Beyond that first conversation, set up Google Alerts for your name and reverse-image search key content quarterly, since secondary distribution can appear months after the acute threat resolves, and early detection allows fast takedown.

It also helps to audit which platforms hold your data, which contacts have access to sensitive material, and which public information, phone number, email, workplace, family relationships, an attacker used to identify you in the first place. Removing that information through data broker removals, privacy settings, and email or phone hygiene reduces future targeting, and preventing sextortion going forward comes down to closing exactly these kinds of exposed details before anyone can use them.

Get Professional Help for Sextortion Scams

Sextortion scams share a common structure, but each case has specifics, the platform, the type of material, the presence of prior payment, the attacker's country, that shape which steps matter most and in what order. Specialist teams handle evidence packaging, coordinate multi-jurisdictional reporting, engage with platform trust-and-safety escalation channels most victims cannot access, and manage content removal across dozens of platforms in parallel. The value of specialist involvement is highest in the first 48 hours of a case, when preservation, containment, and coordinated response together determine whether the case resolves cleanly.

If you are currently facing a sextortion scam, do not pay, preserve every message, and reach out for coordinated support if the case involves real material or ongoing threats. The instinct to handle everything alone, quietly, before anyone else finds out, is exactly what the attacker is counting on; involving the right people early is what actually shortens the ordeal rather than prolonging it. Response teams are available around the clock for cases that need immediate action, and you can get rid of sextortion faster than you might expect once the right support is in place.