Sextortion Scams: What to Do in the First 24 Hours

Sextortion scams operate on a compressed timeline. Attackers give short deadlines, apply immediate pressure, and rely on victims making decisions under stress that would look obviously wrong given a few hours of calm. The single most useful thing you can do in the first 24 hours is refuse to move at the attacker's pace. This guide covers exactly what to do — in order, in the specific windows where each action matters most — from the first hour of a sextortion scam through the first day.

Understand How Sextortion Scams Work

Almost all sextortion scams share a common structure regardless of platform or origin. Recognizing the pattern is what allows you to move slowly and correctly.

The Three Phases

Phase one is contact and rapport — often days or weeks of friendly conversation on Instagram, dating apps, or gaming platforms. Phase two is the extraction — a video call or image exchange that produces the material the attacker will later use as leverage. Phase three is the threat, which usually arrives within hours of extraction.

Why Speed Matters to the Attacker

Attackers depend on victim panic. Fast response means less time to think, less time to consult a trusted person, and less time to preserve evidence properly. Every attacker instruction includes a deadline for a reason.

Why Slowness Matters to You

Slowing the exchange, refusing to engage on the attacker's timeline, and taking time to preserve evidence dramatically improve outcomes. Cases handled over 24 hours with proper documentation resolve at much higher rates than cases handled in the first two hours of panic. Understanding this frame is the first step to correct stop sextortion response.

Immediate Response in the First Hour

The first hour is about preservation and control, not decision-making. Do these things first.

Do Not Pay

Payment is treated as confirmation that the target is viable. A single payment typically produces additional demands, and paying victims are added to lists resold to other operators. Non-payment is the strongest possible signal.

Do Not Delete or Block Yet

Blocking the attacker before preserving evidence destroys message history on many messaging apps. Deletion is worse — even a screenshot may be needed to prove content and demands. Preserve first, contain second.

Screenshot Every Message and Profile

Screenshot every threat, the attacker's profile page, any wallet addresses or payment demands, and any timestamps visible in the conversation. Photograph the screen with a second device for critical evidence — this creates a version that survives account issues later.

In the Next Six Hours: Contain and Report

Once evidence is preserved, contain the exposure and start the reporting chain.

Block Across Every Channel the Attacker Uses

After evidence is captured, block the attacker on every platform where contact has occurred. Assume the attacker will attempt re-contact from new accounts and be prepared to block those too.

File With FBI IC3

The FBI Internet Crime Complaint Center accepts sextortion complaints and coordinates with international partners for cross-border cases. File within the first day — evidence quality and case priority both benefit from rapid filing. Include screenshots, payment demand details, and the attacker's profile information across every platform.

File With Your Local Police

Local police may not directly investigate a foreign-origin case, but the report creates the local record you need for content removal, insurance, or any later civil action. Get a case number.

For Minors: CyberTipline

If the victim is a minor, the CyberTipline operated by the National Center for Missing & Exploited Children provides specialized response for child sextortion cases. This should be the first call for any case involving anyone under 18.

In the First 24 Hours: Secure and Prepare Removal

The rest of the first day is about hardening your accounts and preparing content removal in case distribution begins.

Rotate Passwords on Compromised Channels

If contact occurred on a specific account, treat that account as compromised. Rotate the password, review linked devices, enable two-factor authentication, and check activity logs for unauthorized access.

Lock Down Privacy Across Social Media

Attackers use publicly visible friends lists, followers, and tagged photos to construct threat lists. Locking down privacy across Instagram, Facebook, LinkedIn, and TikTok removes those lists from view and reduces distribution capability.

Prepare Content Removal If Needed

Even if distribution has not started, prepare the removal workflow. Submit hashes to StopNCII.org proactively — the hash-blocking system prevents matching uploads on partner platforms including Meta, TikTok, Bumble, and Reddit before distribution begins.

For a detailed removal workflow reference, report sextortion guides cover the full multi-platform coordination process step by step.

Beyond the First Day: Longer-Horizon Protection

The acute phase usually resolves within days if the response is correct. Longer-horizon protection matters as much as the emergency response.

Talk to a Trusted Person

Isolation is the attacker's primary psychological weapon. Talking to a spouse, close friend, licensed counselor, or specialist team removes most of that leverage — victims consistently report that revealing the situation on their own terms neutralized most of the threat.

Monitor for Distribution

Set up Google Alerts for your name and reverse-image search key content quarterly. Even after acute threats resolve, secondary distribution can appear months later. Early detection allows fast takedown.

Reduce Your Attack Surface

Audit which platforms hold your data, which contacts have access to sensitive material, and which public information (phone number, email, workplace, family relationships) an attacker used to identify you. Removing that information — through data broker removals, privacy settings, and email/phone hygiene — reduces future targeting.

For victims dealing with lingering psychological impact, sextortion prevention resources also cover post-case recovery and how to think about safety going forward.

Get Professional Help for Sextortion Scams

Sextortion scams share a common structure, but each case has specifics — the platform, the type of material, the presence of prior payment, the attacker's country — that shape which steps matter most and in what order. Specialist teams handle evidence packaging, coordinate multi-jurisdictional reporting, engage with platform trust-and-safety escalation channels most victims cannot access, and manage content removal across dozens of platforms in parallel. The value of specialist involvement is highest in the first 48 hours of a case, when preservation, containment, and coordinated response together determine whether the case resolves cleanly.

If you are currently facing a sextortion scam, do not pay, preserve every message, and reach out for coordinated support if the case involves real material or ongoing threats. Response teams are available around the clock for cases that need immediate action.